{"report_id":"7a13242d-a991-46fd-9971-0544d44ada68","version":6,"status":"done","tags":[],"date":"2026-01-05T17:40:18Z","url":{"schema":"http","addr":"nivex0.one","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":0,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"nivex0.one/","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"title":"Nivex:Advanced AI-Driven Cryptocurrency Exchange","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-10T23:57:25.058416Z","times_seen":17827247,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"nivex0.one","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":0,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-09T17:40:18Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":30}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"app.nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"wsv3.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"wsv3.nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"wsv3.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"wsv3.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"wsv3.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"wsv3.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"mxws.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"mxws.nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"mxws.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"mxws.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"mxws.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"mxws.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"contract.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"contract.nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"contract.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"contract.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"contract.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"contract.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null},"summary":[{"fqdn":"nivex0.one","ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-04-14","domain_rank":0,"first_seen":"2025-09-13T12:19:09.307963Z","last_seen":"2025-09-13T12:19:09.307963Z","alert_count":744,"request_count":124,"received_data":11910331,"sent_data":53340,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"GeeTest","description":"GeeTest is a CAPTCHA and bot management provider, protects websites, mobile apps, and APIs from automated bot-driven attacks, like ATO, credential stuffing, web scalping, etc.","website":"https://www.geetest.com","common_platform_enumeration":"","icon":"GeeTest.svg","categories":["Security"]},{"name":"dc.js","description":"A multi-dimensional charting library built to work natively with crossfilter and rendered using d3.js","website":"https://dc-js.github.io/dc.js/","common_platform_enumeration":"","icon":"dc.js.png","categories":["JavaScript graphics","JavaScript libraries"]}]},{"fqdn":"hkex-dev.hkxhkx.com","ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"domain_registered":"2024-04-11","domain_rank":0,"first_seen":"2025-08-13T04:43:01.171456Z","last_seen":"2025-10-18T06:45:16.119206Z","alert_count":0,"request_count":31,"received_data":207363,"sent_data":14199,"comment":"","tags":null,"fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}]},{"fqdn":"mxws.nivex0.one","ip":{"addr":"104.21.41.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-04-14","domain_rank":0,"first_seen":"2025-11-20T04:33:18.560134Z","last_seen":"2025-11-20T04:33:19.142484Z","alert_count":6,"request_count":1,"received_data":1046,"sent_data":670,"comment":"","tags":null,"fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"api.xxxxapi.com","ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"domain_registered":"2024-08-23","domain_rank":0,"first_seen":"2025-08-15T04:17:57.377223Z","last_seen":"2025-10-18T06:45:17.662771Z","alert_count":0,"request_count":42,"received_data":932104,"sent_data":22303,"comment":"","tags":null,"fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}]},{"fqdn":"app.nivex0.one","ip":{"addr":"104.21.41.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-04-14","domain_rank":0,"first_seen":"2025-09-13T12:19:09.309236Z","last_seen":"2025-09-13T12:19:09.309236Z","alert_count":30,"request_count":5,"received_data":1686077,"sent_data":2724,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"wsv3.nivex0.one","ip":{"addr":"172.67.159.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-04-14","domain_rank":0,"first_seen":"2025-09-13T12:19:09.312583Z","last_seen":"2025-09-13T12:19:09.312583Z","alert_count":12,"request_count":2,"received_data":2080,"sent_data":1336,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}]},{"fqdn":"contract.nivex0.one","ip":{"addr":"104.21.41.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-04-14","domain_rank":0,"first_seen":"2026-01-05T17:40:24.245003Z","last_seen":"2026-01-05T17:40:24.245004Z","alert_count":6,"request_count":1,"received_data":40066,"sent_data":537,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"static.geetest.com","ip":{"addr":"104.17.5.193","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-03-05","domain_rank":196356,"first_seen":"2015-01-16T07:12:35Z","last_seen":"2026-01-01T12:53:05.208042Z","alert_count":0,"request_count":1,"received_data":15940,"sent_data":411,"comment":"","tags":null,"fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"nivex0.one/js/is-buffer.DoLxFxiE.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"1e14259fe55f1eca414026c860c1aaf3","sha1":"bc49a4fa9dd8e7efb12af1a9274ca7d4f9a3fb04","sha256":"5c14f02de63ccaa5a7cd3c99cdba8cacce55abbee714b949ef5597043f3f72a3","sha512":"f96c6774cc494a38567aa4f818ebe1eb87d67ad953933b3bde7d4f239cab5449b273c8f418d00307499b5100b699e5c198d10c56e83dd2731370011487bb221b","ssdeep":"","tlshash":"4de02b4a3a31b868427368b400ebc84ff729f49464cf4261950945b92cfb0ae4123e5d","size":403,"data":"","first_seen":"2025-11-20T04:33:33.621202Z","last_seen":"2026-06-01T01:23:31.987959Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/crypt.cVg_o3mt.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"d27fd807f99b497419ce55c51be4cddb","sha1":"bf82e7387d8b65978d6dd5a5bf2197b113882ebe","sha256":"e58c06f4ec67f2d067ac3d6ebf7c57dec9a85efc5633e447c7bc3f36287ea582","sha512":"31ea6c8793ec7934ae99f2747c8eebbdb3385fd3d4705eb877431fcb4eb7b92b454f68a71345b2a7ce14935176537fee2b9288bc2a58cfd7b324ed15032d1aeb","ssdeep":"","tlshash":"2821b3a235c5acea531399680c2f5103e07aae938d5f4581db20c5c5dce4eadd06ad58","size":1322,"data":"","first_seen":"2025-11-20T04:33:33.749134Z","last_seen":"2026-06-01T01:23:32.077736Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/tslib.BDyQ-Jie.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"5bfa8a535e5030f7cb2aa8556f8425ed","sha1":"fdcfb96973b929749dfb2c62f54b7e2dd87f1db0","sha256":"5314f1531709467c338fff833b11ee3e15d94beb150ab36419842ba2919bc46c","sha512":"27c439b69e9d0124bf155733bf52d8c7fad4a305c6eda40fdb9519b7caca126edebfe3c3374ae747dd9688b2ffd9aa1898e1cd093c3434d800ddb93a51d32b53","ssdeep":"","tlshash":"51212189b470add564b76aa02d533cc9a3adb16af415ea541094f194cabf00f862fa08","size":1275,"data":"","first_seen":"2025-11-20T04:33:33.528092Z","last_seen":"2026-06-01T01:23:31.900056Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/driver.js.DwQe8DM_.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"62568581f5f4d7d014ac2f6d36d5bf52","sha1":"4749d411e76e5fd86eb4747135928fae2879e95e","sha256":"fa3ec02b5fc44a795848eba155c7678f0cc8ab5b8f8a6106d5df6d302d00d04d","sha512":"2c44aecf390af1f5877140a1b509640031bcf4bb06920da50a2aebd7c751c5bfd5a72e2ed956162d36b1300062faf0aa194d9353c8c00342d489949a16df988f","ssdeep":"384:iD5RhuDbV8isIuPLUZUiNu9GWZ2AyeJQXjy3byX0EqdIWIAyXcGoR3HW/ugjbr0b:iDnhuHDnuPoZUiNusWYveJ5OX1X0BW/Q","tlshash":"93a2d95834103936927f7c5ed57783457b342374f9038a91707f882a271adcae27aabe","size":21381,"data":"","first_seen":"2026-01-05T17:40:40.596445Z","last_seen":"2026-01-05T17:40:40.596445Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/svg-icons.BOKYaZuS.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"aec75e703cbf172210b80a972992b8c5","sha1":"bb5c82997ddeed59755fe12e5bfe1b06f9a2a100","sha256":"7d4594025ff801b94c236469efbcb6a94a766b5822fb8fbbd9ded98c235f8beb","sha512":"261a0a3c6810a7b0c47418a6cef696998adaf87da17a57a96a0e49c0265e406839522300012949b8cc60d23a76644cc5ef6782e24f6224470f1327a2027cbe70","ssdeep":"12288:0uAkFkVT4QMcnr8cbeTBl9PgpjhmwFmrU1aC6FwqlF/DqH5PWB5j4CG5Swz/fU30:0uAjTKe4TOOUw2m5Dq4mSWE3tEafNG","tlshash":"fa852bd76330d3dc99cbd95eef2698a4671f50faf67ac4c0499e8b2851478c8fa0ac50","size":1756479,"data":"","first_seen":"2026-01-05T17:40:40.658584Z","last_seen":"2026-01-05T17:40:40.658584Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@ctrl.r5W6hzzQ.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"6c6404beb1aae34ea6704b981f8cee7d","sha1":"0c744e22fddbbf00c26abf9c8b1524de4afe002f","sha256":"6d58b80875bd909efc50174e828c6aea22d61a2c23283ae548ed40cad5c0f721","sha512":"835f85aa933de967a14aa2d48caf3991a2e22c94d65aa204f1028a64047dac6f0f9dbfd467d171a7e58a1323df6642bb7cee8238a27a188b8378dd1acfd6de09","ssdeep":"384:RS4TjiiMTnctos+tSc+kGG49Q94cZ+e4A:04Xi5n3G29p+G","tlshash":"0252749435d73069931a49b4130b0586b31fbcbe685e4578f4afc0f23cb9a58867af78","size":14133,"data":"","first_seen":"2025-11-20T04:33:33.75075Z","last_seen":"2026-01-05T17:40:40.550747Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/firsr-home.3rw-CFnS.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"b15d9d858c782daff9a351aa61686912","sha1":"219e7271626d3f817c8aa557a92aa5b0faa359b8","sha256":"6e37f71bdde4d3f6140087662c86da6bbf0f01b93b20ca54ae5f46c96b1b1846","sha512":"7cdf8c40f39da26eafac76e501e082c9a5e592a4338109a38891bf9300975db21474279f60140f11491c7bd2f351312bb00a70ec3e1a9bcfa699d32d554009df","ssdeep":"192:uZZLidJEUN0/nb+BFwTF2jIY61J4aiL4uwYyIJ0rS0xhbgfVjRO5s/mPtVKhR9cF:uPYw/nb+BFwTF2jI8XMlEjRO5yjhRI9n","tlshash":"ad5219e9b091c4754ba7d5df882a030013362297689c826dfaed4cf26648d5ed2b8f76","size":13321,"data":"","first_seen":"2026-01-05T17:40:40.536904Z","last_seen":"2026-01-05T17:40:40.536904Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/js-base64.BbY-I90a.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"d977b6abdc9dfa895ba2908444bc1a4c","sha1":"c927a78b94191e33082e93268d76328889ef28aa","sha256":"1d9533f0a528208faf28cf35da9b3f329d884fb4b03b55e17aeabf56b7ff2e65","sha512":"5780e3b033c076ccd1fb6ba001afa991886fc73212178eb117021ce7a3c1426ee54eea49805d3be85163b081ac0db732987fc6690e176f7203b54598725e6df9","ssdeep":"","tlshash":"b47185493d52b15b46fbb24634cb488afebcafac188d40d4f6051c6e31b2dc810a7f68","size":3770,"data":"","first_seen":"2025-06-24T03:29:59.818674Z","last_seen":"2026-05-19T07:58:02.670902Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/vue-i18n.DXPsAFYl.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"aa80912b734c94b05fc9c4f817ed124b","sha1":"60fd97ab32c31c644346f560ae5ce140ba4117bf","sha256":"49dd58f77ec690b5de9db8cca88d9d45f65ed53501c320c3858ad412fb2a85e5","sha512":"5bce0175897d3c32df6c6377f482682d0108b66199f92b72a04bd1e656415e8e2e2738d52e51222586a4d8b743ac175c348be78059d49737574260707984b4c6","ssdeep":"384:ztU6deMTl6OGU17+8bZBcyLmvps8xh1J58iCJ+AmK7ADtBkroDsBkX:G6dTl6dU17+8bZBcs2ps8xh1J58iCJ+l","tlshash":"606209c674e77037077906e960b32107af3c0a65341e98d4a16d9ba93fa3c5e81a7f1e","size":15439,"data":"","first_seen":"2026-01-05T17:40:40.588743Z","last_seen":"2026-01-05T17:40:40.588743Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/axios.xsH4HHeE.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"6ec5b0cb135a8c8509976ba1b11b91b0","sha1":"d110960ab1a5b3b5b5da02ee2e8bac9953853401","sha256":"806129ebbeddae98c7deabde091a2207f6796065e2f909ff678c38531904b3f5","sha512":"4d3ea7f2057cae3179b9be7a071ae7867eb4bd5da5d8d02dcd8d7161c1845da28667d47b019e78cc82a73087b9c6dea8de01f8d5d3d0fee8626ec43197dab64c","ssdeep":"768:iFtGlRBc6ai9SbTKLA4h4dozE+ILLbMNzS5+aNBHGDpIOE6A7ORqmsZccKhDFB0r:i/GM/8UVsiYpO86x","tlshash":"22f218d5b6d2b06243eb61f5406b0902f3399925784d84b4f1689ceb3db600a97bbf7c","size":35296,"data":"","first_seen":"2026-01-05T17:40:40.564249Z","last_seen":"2026-01-05T17:40:40.564249Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/echarts.zwp60nWF.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"9b4da79ed17dfb8f289faf2b51551708","sha1":"bb922a73f344ea36ab8be14c7bc93f5da55a8da6","sha256":"d44e8c097c359b31a10e86f880324a5747a10bdb20821318491193378b194931","sha512":"a05e698c3a1321ae6630da3a3d657d32a06b4a9fe45270a388edf81c8a6b986c58d9dabd1a0a24adaeb2a7825ff1fa393c646240d611b7b627a5e8493c33622a","ssdeep":"24576:tc/7E84kwVkXcxhPUMRm1Kps7zo5a51yWTTOP3:C7E84kwVicxhPUMUcps7zo5a/yWT6P3","tlshash":"8d05199c7a14742183a331b4157f050f9336280de98a8568fa99d4ea6dfd48a273ff7c","size":823843,"data":"","first_seen":"2026-01-05T17:40:40.530442Z","last_seen":"2026-01-05T17:40:40.530442Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/spotTrading.Bnxepb0p.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"d9df8363be320fa8cb4e9f545ee19834","sha1":"ec857134ed486942a1491bf2d21e1452f412f796","sha256":"dbdb8c04c7e32c16bcd717ddc098fa93910ea91e96c3c837b2ac973ccba5c763","sha512":"f35a48142ba6a8c0db806cfca41bdcce0af36e2c7df6a6274b6478698bcd9f70b0587375f0a0ab2a0398d4c6a24bfc5bc4acdac1a4e552fc9e6ad505d9325f8f","ssdeep":"","tlshash":"761127eeb046e2a1428da35ab95f331e736fef50f9e75c221c016d9d3642a0cb429b15","size":1050,"data":"","first_seen":"2026-01-05T17:40:40.605437Z","last_seen":"2026-01-05T17:40:40.605437Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/symbol-countdown.D5OfgNfO.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"9d1b6dd6eb733f2e07e80c9853ace3e4","sha1":"779e3a9e6a1097d8e8b2661e617c62316f9386ee","sha256":"9ec9b598ba55d1ff5535684424d15fb3195f46ba5a0b4d24a65c2f9d118ba111","sha512":"8960c9d18fe92179b2e1aaa9f1e13964a9d0d7d3bcbd1752df912d026f238a4e28f5dc116cdab13b55ebec68397bb920d7c7c4480ab3062659e0d3a5da3f40fc","ssdeep":"","tlshash":"0a211ed9273fd0326e218d49231033aa8f9ad788f4b785c2c1cd0cab69a9864f10d325","size":1427,"data":"","first_seen":"2026-01-05T17:40:40.526783Z","last_seen":"2026-01-05T17:40:40.526783Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/vabNodata.Dq5gDTE3.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"aea1947a1048f1e93609d3ceb0d60224","sha1":"cd6c4b564d1907fd96d0f243327a89215e6e563c","sha256":"8a017dd189954ca989da42352adca70ac2e38dacb8aab1c618974766411c0d37","sha512":"01e8c4e492acceeca87270da226ab82cdb7a7f98af7578a3f80eb2eef01cab9f6fb6ef59308133e702da257489e1048d67c9bb1f8a05fee0641eaf4bbb5c9fd4","ssdeep":"","tlshash":"98211e5b79268a79c3b71cdad429204b310836cdef94de9695bc9e163b810b8f21e371","size":1422,"data":"","first_seen":"2026-01-05T17:40:40.6244Z","last_seen":"2026-01-05T17:40:40.6244Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/price.BpPWlJRd.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e79c7700fb7ed7f6c76d279534b7d616","sha1":"eaae81197c6735250859b5c39013aedc29019461","sha256":"446e6ecaecdbd75297e810061298a30bba2787f77f96e744bd43dadb57921cac","sha512":"ce114dc4094028dbd8ccad2dd28b500d6cd4bcbd24230552d5e6c594f8f04355b6c8c5737c7851b09c529adc63f59da2c7e2cba9520e104be9a9ada5fee37623","ssdeep":"192:ZZLiAGHuPtNmdKIAN/qAVWGKI3XbhVWPhr7Xcf1a3iGi/Zs31:PBgSIGXVWGKAXFVqhHQ1aSRsF","tlshash":"c1e1b54bf822403a7375edd9c078a03151ae3f4aa380caf6e4df4f222315920e6dda17","size":7203,"data":"","first_seen":"2026-01-05T17:40:40.586259Z","last_seen":"2026-01-05T17:40:40.586259Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/pinia.Bp2oHvSE.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"8d133b0628c08dd038e0305ed548736c","sha1":"5f5e2dd9d7880e89d06cc4c9c527c299f72fbffb","sha256":"6606918a952f7ff6ab668de0c9f55e446fb4f39d5d8a27f3788fcfa7a18e2d96","sha512":"5e6ed5e2ece297d04a8efbdb2f0dfd7d72b3961d6b5f10d8abd33c3bd54b978c3b4138be343b0489cfdcb087e9010bb235983be52e4dc98c2b9c99901c89824d","ssdeep":"","tlshash":"4581b6ad36e1b43c5bba04e8013f6829e3776148305b98d1b25daaf5383204d665bf6e","size":3898,"data":"","first_seen":"2026-01-05T17:40:40.559551Z","last_seen":"2026-01-05T17:40:40.559551Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/vue-echarts.Bd6UsEJu.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"eb3f411eb42c9ce5f83fd46666bbc0d1","sha1":"6f9d138afc965dea3fd15b86cdb7e3dd627f3e26","sha256":"c2a0f0c708d565fb1eb9fc3eebbd6635a9ebbb6daac01723168f28b9fc9e11b7","sha512":"95bda3cd8e7c44ddbcbfbe9b86cb4a08233a11cedda9fbdfd348abb77081b075dc559c84dd97ce317da784bf515519dfd78e6aa0553f7347e650bf7c891e952f","ssdeep":"96:zFkk63MMQmQ2FojQRtv/WpMWRSNdf0x8zvrmQ5weqh5T/qe0p7nNMBuWkYS:Ck6c+QAIQRtv+KWINdf0WzDmEjqh5T/m","tlshash":"ff81c6eeb491b27823f708cd80671946b77d8b95b008d0e5e498ede51a39b50e233da9","size":4187,"data":"","first_seen":"2026-01-05T17:40:40.607135Z","last_seen":"2026-01-05T17:40:40.607135Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/normalize-wheel-es.BQoi3Ox2.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"d683be5e2b15f2608fb0ea78f8d0435e","sha1":"477846374145623fa6bb0fa2ca792310513a8b37","sha256":"55cb7ec4e87f8f7165225884a2696f8fef524cb4428a4bb8f2d4f3710edab568","sha512":"f10db079fe4fd124e1af467b1d49f9e9ed3515ff5754637ecf857591e50cca228152a08a60d253b0bc042cbf13d0833296375774167f717410ba6ae0c0142391","ssdeep":"","tlshash":"0d5162fc7051b1b2511a3862283f560bbb7bf4f5292d6642ea288090bd34955c337fd9","size":3103,"data":"","first_seen":"2025-11-20T04:33:33.72042Z","last_seen":"2026-06-01T01:23:31.921688Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/pako.DwGzBETv.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"223df3d75a8ca0911b0cd3b206353372","sha1":"b49f3161f11b56d1bcf9bfbdd37a14b7f9bd2799","sha256":"81607342b01f22641ebf3b71a73ed3d141172c305efdf9058a98d334bbff8b33","sha512":"a8010373cc31d31a4c12ccabc2e9d8bc9efa3fb0fd70791ea67da55e66ce39291d1b27ed77963502315e916bad8a23e322bbf2866445ed80c6918ec912abfa22","ssdeep":"768:KSPqQg09Gl6rmN8NOzsgn975TMjhriYWfo/WoPnDQLcO8TX3/5/EX30MaBdrgB+D:6ujhusxdrM+3ZPvn6+G0SPgn","tlshash":"fd231ae321e315491be41cdc86870aa2577495311c0225b8f27ddde538b0adbe2bbb7d","size":47570,"data":"","first_seen":"2025-11-20T04:33:33.606775Z","last_seen":"2026-01-05T17:40:40.558726Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/index.x8n5eXUS.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"d2339cf025bb538377f46ce3ae3ec234","sha1":"e6473a14867f3143bc7c1d2a7de3b5f6c2104c57","sha256":"bb76072b9c669a0c4ba895b3cc883acea6b5bdc04b575b33af40c8a77ba0b36b","sha512":"37064612e513b6118b1e5ac4ad2e103a50881df22eb9c77ba42c764285cb1e59102834d5e51dc1a976d5657df4c12f31046a5915e5a05ebc48c8a99aa351b949","ssdeep":"1536:ZM/CFaSJOCYw2IqUdIvjH7Ckr+GYpN1iA6h9VEDGJIuGJJGUkYpeoNVz848lvLh3:WrSJiw2/AziA6h9VEDGJIuGhU/rbJys","tlshash":"8eb33bca326242bca3896ad8ec36220d9374df44e519c476bf2d7dcbb185d48d276b18","size":109091,"data":"","first_seen":"2026-01-05T17:40:40.615076Z","last_seen":"2026-01-05T17:40:40.615076Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@vant.B6-Gj5Kj.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"80e4a6f89ac48be6964159719b3b1a8d","sha1":"bd14bc19fd207a2738cbdf2116c4af2682b6adbf","sha256":"0bfaa40a67a1e3e4acba9434961a8aa378e2742623324d067c35248267bd4f19","sha512":"b6e24f2d02c37fc8765a25f47fdf14525611e4027c59c3635c5d4c669d9c4f77de6a463a1ddf1c4ce0e38d5a3dacdfa25ba47f669cac03db0ab798c780697eed","ssdeep":"","tlshash":"bb7184ec3641b534c3694ee1007f97a5b21b6a2470cbc8a0e018ed193935ca192efedf","size":3643,"data":"","first_seen":"2026-01-05T17:40:40.561117Z","last_seen":"2026-01-05T17:40:40.561117Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/destr.BPvN1X9m.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"f4073929b9262bd4def4e6a1a12e94b9","sha1":"13353bb720d2154efb374617d9b8c113e4f5fe90","sha256":"59596c2e2409a6a95380f99391ee0617ba697e59925b95dbf4e3e9ff8689e730","sha512":"fa4b8a8458dd31dd7ed0710e8c45b1d53eb39198bb67b2d6ccab55e1426e1455b1e1b3ebd59c680708cc31b1e8406fbf5b550a9db2166b1dddf5e9f6a1ea8b55","ssdeep":"","tlshash":"0f21dba772dba65a03ee54a44a352861f42c0820ec4f28e1f0e8d427d47a444eab7f80","size":1251,"data":"","first_seen":"2026-01-05T17:40:40.554581Z","last_seen":"2026-01-05T17:40:40.554581Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"cd7a34e714de94d5c29b8ac5acdde24b","sha1":"b722bccb435490630d97ef88cafeb02d92f70fd0","sha256":"312ebfdc50a0e168cff60c206811b02e944263a7d9060c2685509dacfacd7f71","sha512":"a724bc648a508c24e5bb1788e1f02b47030893bbb0b80a99e380d95480095983a35d8ec11193c53f0a67db47a289ab608fcbc9dbca846bfdd5d61a8832290f43","ssdeep":"","tlshash":"58e07d48ff28c7f316ce28ab516e770858d104d58c1b58024cebccc86935ed87291527","size":314,"data":"","first_seen":"2023-03-11T11:23:25Z","last_seen":"2026-08-10T23:24:33.835039Z","times_seen":41347,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/async-validator.CRx4dHSJ.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"5f9eecae1312c57a7a0f1284e3ad8c3f","sha1":"de8edccfc4b435345adb5a606f3f4eddb8a355db","sha256":"812fa20f5ea0132b7fa8343c5b1e31d99769d31df0a9ae316743b93d35d3ae6b","sha512":"a4d67e4b1e5a667ddebb60ae6b557e197147c01bda49591f5bb37e0ad99a4fdb270f2abf89add30fa280681d2368d40062cdac31e1d6fd9f8e97619bf78589e7","ssdeep":"384:vHO0Rvf5n5ta3W/YSrLQfqL3y/SAeePedHe2OedjedpedYedreShed9edveezeVU:bj5tEW/bi/DeePedHe2OedjedpedYedz","tlshash":"7d7272c836d9b41d86a360f5202ba056f22fb541586ddc45f3ede0fa6bf580e4213b7a","size":16927,"data":"","first_seen":"2026-01-05T17:40:40.59041Z","last_seen":"2026-01-05T17:40:40.59041Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@intlify.DQ3eNPiO.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"005af302e0c3705dc44c301881704210","sha1":"20e332509cf5c119d014e523c94126fac30af0c3","sha256":"50664993d9774d6d8e5ed9b3f415ef22df80a3270f2b6a52fbaf21c3b7ff2d65","sha512":"215c8f1f9e01301e0d250363fb633bec84e11df2478364a3748a700a70c0d912e5d7be17c37b7494559364a07aab00e40f5ea9297d5f28d7e62afcac731dd704","ssdeep":"768:LqPoopQXc4uKdyGkldzvnv3q5P6+7IYoSJlaG1JeBDfoRasYLrz2f+k0i5WVlIO0:A6rf0BDk5kDaD","tlshash":"b3e2d7ac34927426d3a69ae954b70055a63e3d14740cd851f1aef9473e32c2f87e3f89","size":33175,"data":"","first_seen":"2026-01-05T17:40:40.647483Z","last_seen":"2026-01-05T17:40:40.647483Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"0eccdb73ac307309c77c90e11d169402","sha1":"4d0b6a27abd9c68b70939ba4e15f7daae328a8eb","sha256":"8fb50d0029358164a7a7adacd8d0807027a5d0e048e2930fce24665fd934f196","sha512":"15a52eaa7feef21457f4308c8c68690f06a97227bb50681c634c415db87026caf0e1f287756de6f00d57f52fffeb45f10e04fbf9500686a67718a7323b4237f8","ssdeep":"","tlshash":"314171ad75d8f89c4623f24b0caf144b4332db56794ec8455340c0efa4b4a8d5576bbe","size":2099,"data":"","first_seen":"2025-09-13T12:19:18.597389Z","last_seen":"2026-06-01T01:23:32.121937Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.geetest.com/v4/gt4.js","fqdn":"static.geetest.com","domain":"geetest.com","tld":"com"},"ip":{"addr":"104.17.5.193","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"3e10f4bc47f2fcd630ed843e9061cf44","sha1":"35b9e07ec532b978d2f92adcdb3d31a9f706383e","sha256":"d16f159d776bfadf27a75099cd3a16e3de499a39d26e7587d0831322f767cc4d","sha512":"8953dcdc7bf40d7c7d849719a6663c66f21fbee4460f2b7ee73d9ce2ee202a9ca68ccae586fd05b1bfa0768cddbdf4c99ce77819f8d2ec03f77ddf412fae8621","ssdeep":"384:0BDAKWacAauzIuUMYVbFX7YoUBXdwNRGjv:0BEKRa2c0","tlshash":"5b62538e68a6a05349b3b778cb5fa514fe694b7340248141bd5ce3586fb043487abfdc","size":15364,"data":"","first_seen":"2024-12-27T01:11:33.480297Z","last_seen":"2026-07-27T05:50:08.067067Z","times_seen":1600,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/md5.BcZ6lftK.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"2155d028b0edc8862b7bf54c2e8360ef","sha1":"2b70b5269c62c0da0261ec4a7411dbe3b0a4dd61","sha256":"fb0c1d4be97cbeefce73825c6b7362ed683d8d75f8db9e62c5fcd8a67cde96ca","sha512":"7e155a16845177f3fd9de769e070e03fc515e3fc02328f87882fa557c7bbe2702f06371bbf6174fd211ed23d5c8b28167e0dfed9033c9561fbb56c60a9745dab","ssdeep":"","tlshash":"0f71df9ca0020059537c48d50c9b241eaf70b49d751d04cabbee8af58ebeefd52e362d","size":3532,"data":"","first_seen":"2025-11-20T04:33:33.503446Z","last_seen":"2026-01-05T17:40:40.522805Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"911e938139c459fc2e3342b26e242ab1","sha1":"39cbb1c733b71127e2986e220d4b4974ef1e69cd","sha256":"5dd4331e6011e65f937affb920d966965fe42169d1b5920d2a091a9f0baf909f","sha512":"c6467aaeafee1daf08c93fb3fbb9ebaeda6a99a1d60930c97c73900321dede6feca585a0dbf9e33fceff410f1f3d63abe79a6aceecbcdd78ef9bcae8c25c3ee8","ssdeep":"","tlshash":"48d0a798f464816200eee44c583b144f3d2e544a060408c9fde8eed90ffefa731744e4","size":237,"data":"","first_seen":"2025-02-11T12:54:16.502084Z","last_seen":"2026-08-10T23:55:21.152584Z","times_seen":817,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"528dd01eb509d1fc3c68b48e165c9d77","sha1":"8d702f33d869eb8c53cf75c17014f96385322395","sha256":"b508dff20bdbd9138e31aa48c45bc501805e509d2fd4709b39c4a60cd5c6b43a","sha512":"4c1edeec560f431005363ff5291acc80c1c42edf7c9a6d6e4fde2f7539b6a35a8e36f0bc228503263277bf5df4525dc579575faadca614c32e5dfa885a2d343b","ssdeep":"","tlshash":"78a012bb71b851710cd51ba7a40455e01c20123105052c101c8d5151c011c171d394c0","size":84,"data":"","first_seen":"2023-04-07T06:55:59Z","last_seen":"2026-08-10T23:24:33.836059Z","times_seen":42813,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/crypto-js.BH2pn90r.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"db0597f008285a2a858f0b7fe15b2d19","sha1":"27c621d9cd3d793df519c651c1168f32b3ceff88","sha256":"98efa226698a1d9bf8682d4ae907802fa30e67f6c86817a0d63b420f83d70e76","sha512":"1029b202b5070647cdcb9f82fdc136318d7648fc45c5990e281e8c41993499651ea70473e6fe5e855cfee1ab4db06cd4c02545a57698b84f062278a3b9a21e76","ssdeep":"1536:dQtqIbmLNBJuZ2prjJJXEPtNPU9ArHMhnt:d8KnoZiZnt","tlshash":"9d6349c636d871c1a3a734e0093f204fb1773462095c99a8e565fade6cac5dd807ad3d","size":69877,"data":"","first_seen":"2025-11-20T04:33:33.565087Z","last_seen":"2026-01-05T17:40:40.566065Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/element-plus.vfrBwH7m.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"5ef31429c432e416c001faac78287ac7","sha1":"70095f9cb4fd76c37b749fd486c7a33bf1e721a1","sha256":"a3ed356556baa3b1ede8048be459737be43be4aa7840e8cde203c96b0d56cddd","sha512":"ab3736383d75ee3c3eeece1aa9515301f46490923be3686a0441e0479b665178d73fc8b02276b256d8117e9b488ce1fb4948047cc8530f9cd6bcf7ce3a2483f8","ssdeep":"6144:VvO7nkE6rFnoyHXAkWe+E35WiO7SJP3ulduHUVhY:VvO7k6y3pd353R3ulcChY","tlshash":"f5744cc9b6a57836a2f964c4d0b9050975181f09f010d8f1b9ff8a1923aad4062fffbd","size":364707,"data":"","first_seen":"2026-01-05T17:40:40.632763Z","last_seen":"2026-01-05T17:40:40.632763Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/node-forge.CDxHW0a1.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"da91b632d15a2000c026aaf4b28ac4e7","sha1":"f784d108a7827dcae17df6178c6b1936e1ae0050","sha256":"82c1c8ccb1e189a2f841081ac5ade2e60f7aa83743c4df7a1626b94bd60b1e5a","sha512":"9bee5f2b3452fc1368d562d808e93a4f5ec2971a2d8a4877b5781ed600b09ac79b91ed47d67895684e783d7d4526bfe9e3531c4d0908f406e5b94b0a303e9c22","ssdeep":"3072:hUkElpRjQRnFR3OkKXUZXuuEyL6AUaBlnpew5FQhO5GG:hUkElpRjWnFR3AMEyLp5npew5+hmGG","tlshash":"3354398436b078f043b352f7182f814bb135a519a42e4925f964d8dab9bcf9cd13eb78","size":282038,"data":"","first_seen":"2026-01-05T17:40:40.557932Z","last_seen":"2026-01-05T17:40:40.557932Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/vant.AyL9BkfU.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"3214c50942b0edf9b287baf398f9c3a6","sha1":"5077d3fd44448e309e8badb488b363032ed347e5","sha256":"94cc276ebcf5889448f9aaa14fca6ac750ad931d18a88218c00c3b9d32d705a4","sha512":"62cc21f7f3cc5ddee143e10f5062852d1f695adba8f62dc17527bb03bf737ce670cf568a6696ec986fe0b108cd90c6ccbb52b0b9f6d2181c951915d24658cb0a","ssdeep":"1536:GnDy68JJkuTaKX17+ZZzD8QUH7jQch6J0doSed:GnW68JJkuTXOzDZUH7dQJ0doSm","tlshash":"ca333c91b1d6b438d3bb68c440590940ab2d1b49b01ac8e1f1bf9e553b69ce4e5fef1c","size":54118,"data":"","first_seen":"2026-01-05T17:40:40.520041Z","last_seen":"2026-01-05T17:40:40.520041Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/CryptoJS.CZ6NzDv9.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"a538e2a71ea76e17d6f0aca8cc8a40c3","sha1":"959f52f2a521a87d5105493248c5cfd160edd925","sha256":"771218d31c64a5c41252be6fa4c2fb9806fd83c23994c688cd86d69250b36a1e","sha512":"71d40c6b646db6f452c5080d5d8c06f5f4d638ff39de3e2cb0730a82968107861d554479d7f2796f2bfb7b4d3952cc20552ad23fab9c679db26f3d68c2f68520","ssdeep":"96:4ZRf9tjAoJoQJbaGTJtgZ5rxtm14bUMVtumNWZek3E8+3sk7okTFFes0WvbZdmj9:sf9JGiTJtgZlq1bM3NWZe/8CT7okhFel","tlshash":"bdb14c9ef4e1a09143c51a1194ffe01af27f76b9264e8751fc4a0b963d1d462e336b0c","size":5469,"data":"","first_seen":"2026-01-05T17:40:40.591251Z","last_seen":"2026-01-05T17:40:40.591251Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/uuid.uLbfAFT2.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"88ac41b68bce7331ba503a266a586094","sha1":"b57880b5b81aa16e7b5b474728cbccd1686ff5b1","sha256":"199886616a9b5ed64272bfee0187db43467daffd6220dd56a1ce2918a923c994","sha512":"01a3125475a91623da77dba5ea94d31eac6408081882c519245499e64aacf9aaf23df965947c4009ddd03449715b6fa5f6ee425123cda85d5e483516414053c6","ssdeep":"","tlshash":"ee310dde27b5ab0603ba1ddb01f7ec0b639ed00234bc91645aa2248f0130bf785d392a","size":1652,"data":"","first_seen":"2025-11-20T04:33:33.782112Z","last_seen":"2026-01-05T17:40:40.591935Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/charenc.3b3Gq7bi.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"f99cedee990d3d53b9111ead4b758c5e","sha1":"92422d8844605fbdde92d28b4d17a99c78f5b72d","sha256":"de2b1aee769eb7a7fcad13c1629aa1f54c539ea396f62e6bfc4b438f8819d26a","sha512":"ba4a2faef30a8ab083fcd715da43ea0e1a9d5197821cc6596b55f764726473158ff20e6cecb781551060179726182414d17fdaa08f81c35f9faa12f1c85ccf05","ssdeep":"","tlshash":"bb11605970a0e0e4c3eb04290a3b300bf16949b502be98c0ebaac5f05ef824e5136f69","size":1102,"data":"","first_seen":"2025-11-20T04:33:33.582521Z","last_seen":"2026-01-05T17:40:40.565285Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@vue.CrdQ3V-0.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"fc6a54025db0fb6150cf14cdd8b8a7de","sha1":"326c4421aa734bbe4572bab7fb64e0f722e09e5a","sha256":"1bc84ea96283ea52a41f6e6003033313404d1efad0d4b4cf32cf2cf900b00f95","sha512":"6eee7323f7b3af5ff40d2cec157e95f231de5554490ddf07c8bc7688a7c005a1f05df7f6b71e4af276697d4e5d06285dc1fbb8fb4c63733640c80b0042453edc","ssdeep":"1536:56rAxqylaKcn1/4TO0OesE5P59QeH0maO+vKHZ:mKcn2hFYeH0o+S5","tlshash":"788318f93196b57253ea19e240770402f369284a384dc8e8b06daddf3e7384551abfbd","size":83333,"data":"","first_seen":"2026-01-05T17:40:40.535923Z","last_seen":"2026-01-05T17:40:40.535923Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/vue-qr.DNO3Ii1B.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"072ec8f6ed508432c3a9d01dee4070c5","sha1":"874116dbec22bcf84109400c94ed3ba905b6d5f2","sha256":"1d561a188553a4f3d6a034567dc281258cd1d4723648fcc46ef30c1c62fe5f91","sha512":"c271a515500b27d1f04256c7654461d2f67d7105a6d3c4e0fdd0fe067b90f2208ac702944b1df4c198fa4b69a3c9242493a07e74ddd67a7d7fbf23ed4f254697","ssdeep":"768:9KLR6MLfzSX3d6VQF7Mee7hbUiDiDWJhIg0ImflILPC8cR2zmYdWp7cgRyJVEMC/:LMreHdqQF4eU0IZggXdngEZxw","tlshash":"2f332cd4b2a052b353da59c1986f0006a534b8292c09d96cbb3de5e37de1fc264faf31","size":51021,"data":"","first_seen":"2026-01-05T17:40:40.620289Z","last_seen":"2026-01-05T17:40:40.620289Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/zrender.DwG-h7oT.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"b46207bb80862051ff9dff8e4c12d350","sha1":"c15f15f23a7bf099cd4c265a666cc9a002233a8c","sha256":"dbb0bad1c1c12ceb3b958243a95f04c6f8d7316577dc6a2fd5d852fcaafc1015","sha512":"bcd7c67abc4adb8883d7e62f1ac4a2be48b3176b93eb061fd8ffca93c237fd501144af28a9455c462f0dcfce86e7b6367a933934d34ae052f7dd7be4c8285507","ssdeep":"1536:GS8VezpdXBAsNrzwMi4Sz0w62BTPuJ9I+b5U5eZhx8XlJkTYLYwFTXM6bJ1X3HOK:bzuDSJ9Xb5UYZhx8cWFTXM6bJxYA4a","tlshash":"e024e7d872517025839366e0453f150fb33b681ca80e896cb669e4ee2cfd48d267bf79","size":214266,"data":"","first_seen":"2026-01-05T17:40:40.569073Z","last_seen":"2026-01-05T17:40:40.569073Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@popperjs.DB1lLFnh.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"002dd210431845bbe306a8b1160f44c9","sha1":"eb81ca291df0ffbcc66aff752bdf7112d75fc61f","sha256":"5a5df9e8a4943e3172c56c17450c73bcac992464e16ae775c2364520884eda64","sha512":"ef73243fdd2633cf62132fd57f8d07e33e51fcda2e1f1fd910e7b8f131fe9c6c4d628e8765094ead939e073cf974c0cb4ea94943917d466a9f8911ea5c81d8c3","ssdeep":"384:yrwANx/2ItpItrwnAF8dbvgWklk5R97jzfZ/q6rHoQ4AydetatMiCWtgV:yrHNx/2ItpUrwnAOdbYC97jV/q6rHEA5","tlshash":"a092c5883654f0b6072b82fa807f510eb2336560524fe510b155e6de3c79eba622bd7f","size":19729,"data":"","first_seen":"2025-11-20T04:33:33.768516Z","last_seen":"2026-01-05T17:40:40.621203Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/index.DGjU1x-A.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"ba19524f18231ff06f2da36fba317154","sha1":"13de88c53c0fd006c07699a6a320d915ff19ea9c","sha256":"399014812810db3aa354c432e779cb18a3610a320ccd281d38799db898a1ad7c","sha512":"28873f43938b9e62fa572ed565ac179437c93cacfcf1b3479b57c01258aadab8495f82882fb09a7cd233c4c137850501076a14e4042389aff9f262e56f9733ac","ssdeep":"384:2jAB5gAAUyZRvBZ67dzYwY4qvuAyoSyY31yXwyKYSPZksFKG3tkN6:WAtyZR367dzYwY4zoSyY3YXwyKYSWsFT","tlshash":"4582094ef8a6a438f6b6e9d9c0750562230c3f4a6184c8f5b4ff1f132745d54a29cbba","size":18710,"data":"","first_seen":"2026-01-05T17:40:40.54553Z","last_seen":"2026-01-05T17:40:40.54553Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/js-cookie.Cz0CWeBA.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"9ba84da314e546b245ef41c6730b8f4c","sha1":"0e47a7538ed8b615a0e861d840bd1f9432461c57","sha256":"aa4436d6f6679520a88403fbf61fef0734beba55b907cbd170ef4b31a1cf6ea1","sha512":"70db74bc37b7d6beff2d474dee6f4ef87d6909850be31986b7b92cf0d87e709d4ccf3fa51d7e93695171e96137614142bc12e36de0ec04a2c9bb07ebae8d7f9e","ssdeep":"","tlshash":"612194e830c61cd5079b0430872f2146f1fd4700ecceecc4a759f1e262b1a21026beb6","size":1421,"data":"","first_seen":"2025-06-24T03:29:59.865119Z","last_seen":"2026-01-05T17:40:40.593688Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/js-binary-schema-parser.by-kEvu4.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"80603c6ff1735d7320f08ca2501e2997","sha1":"fbafcf0625029f9d92a23fe9e52ea91f6c0b1e9c","sha256":"8f97f0ba6eb27f61e0251743087a92ca8cdf2522423a08cfff9f58d0153cb4a3","sha512":"a7b16b720238d03886cb3acd279577b254760278731e661da643e4a25497b33d2232bf81c6cf45f5ead0458f9d66e5232ed8ef71222984cf643b05158f88189c","ssdeep":"","tlshash":"d8513288649a92e9534a18967c3e8c68f0265691351face0e39d9c1af4d49cb406ff3b","size":2683,"data":"","first_seen":"2025-11-20T04:33:33.516485Z","last_seen":"2026-06-01T01:23:32.028617Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/vue-router.DbD1d2u6.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"f3c090f8ad3ac02c81d8fd605b6191bb","sha1":"faa659e53417ad4eb4026e45eee8fda45ea07380","sha256":"bcc9f5b514236a612c1dd48f35993314951892af6a4a823f1ae70345e33210a2","sha512":"01f5d984ede30d662af07b260171ed6c4b6e26f4a4ed943de83c46066f6c8e4abda84bba2e1e2413e9c3ae3884435eb88c8288a021d6efa46dc713cb781016e0","ssdeep":"384:X80qvY1mkP6cVUzmBRiQgTnsX659wi9ri6Ra9R7Nvc0GxhQdZgiyK5FYwyjIwB3J:sXYfPrVUzmniQgbsXw919rg9fvc0Gxhh","tlshash":"72b2e7a53283706643fa0ae5407b1146f2361cd5384e98d0f16dada73c37dacd2abe6d","size":23657,"data":"","first_seen":"2026-01-05T17:40:40.583067Z","last_seen":"2026-01-05T17:40:40.583067Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/bignumber.js.JTMmK3Hb.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"ec4a76408c5691ee8b2195786f7302c0","sha1":"e486b819669db664ec917a53d7648bfd9c7cc889","sha256":"0873639c6b478e97e3bfc4b960b79c38a44df3bf6e41d51c097a23a602eafc5f","sha512":"b2e4c7c97a281029ddfcde88a4f693a9795f4c74d14fcb635985da50d9299e6e75cca56634c83dccae874cc9f0cc998eed3cd1bc5f19fcfa10027b6cc6a81dbd","ssdeep":"384:4AJ98BMyDKcfcUXuELInPM75k31vjjRMM9iosRAdGJd7tP:4BMyeS+lnPY5krMM94AdGn7t","tlshash":"c68229d874abf09942fa34c000eb9446a239ef4aa84c5876f1509595bc35dcb93bff64","size":18639,"data":"","first_seen":"2025-11-20T04:33:33.6258Z","last_seen":"2026-01-05T17:40:40.523876Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/wssocket.BsRiRgr2.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"03c93349a41ff5cf1f841b3a59bbac7c","sha1":"ffb0e6be5bfcbe08474f0602ce1ba3c7cc54bd47","sha256":"e9e2f505e913d2250b626a4de815ed597c91188333f578036e7c9c550ea71ff1","sha512":"7b070b2c4eb7983c6b6263f410159cd217f085ff77703392f7bdc89fe19380bbb58b3ed4a0805e4c31616ea10204726007bff6e3e2183f3abbc85434e39079ca","ssdeep":"","tlshash":"1d41118d7177629552f3d294148a4d05b12979690e0e101d7abccfe2bf2ee89b3a1f38","size":2046,"data":"","first_seen":"2026-01-05T17:40:40.577133Z","last_seen":"2026-01-05T17:40:40.577133Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/pinia-plugin-persistedstate.Cat8D07D.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"e44341588f7509c4a04f35785816764e","sha1":"8ac440a8f1bdb71f8679d37c5945f1510e82533b","sha256":"57d71e73e2860fd8db96652f840a7d3589e034ec0549cfd0ef8269cf986040c1","sha512":"f6433abd4f1fa9a294e09bd6622324a118dd61e4ef310f2dce79fe7f52d0ab0753e05b7e5c19d3aa1ddb4de2af82c6efddc9dfdd9c872bc16a2c6c74fd2ce1a2","ssdeep":"","tlshash":"5131758c11260d3151b634dc58eba5535131815f1f1ccba0e4aa5fe47b5458acf1fcce","size":1522,"data":"","first_seen":"2026-01-05T17:40:40.576323Z","last_seen":"2026-01-05T17:40:40.576323Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/deep-pick-omit.CegYQlcN.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"a4cc76d93ad7c139918ef0aa35694ebb","sha1":"ccd84f6a6816906f3db230344b9db2927fefb8ac","sha256":"95bed3fc3d3efe7f365ac84ae15d3b75e7febe9f3ced0e36eac59421f1cf6781","sha512":"89291e9c53df46b0634f892781031e188991f36ac836e25e0ef9b42dd28ae38558daa1551d327415e5706687fe33c240eefbd38463e00b758728095f97866733","ssdeep":"","tlshash":"782130e2bbea9074837218f4180e819ef33c580d299d5480e218e8a132f7861e7a392d","size":1115,"data":"","first_seen":"2025-11-20T04:33:33.648908Z","last_seen":"2026-01-05T17:40:40.543392Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/secure-ls.DPBbppFk.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"90e3af036437f0c8711de29de3d4cee9","sha1":"b983b25089315fc3348e06cf63b4cbc1e1209e85","sha256":"0dc025c5d0449949dc52588fed0fc338a495eb528e3b71e0c7ca6cb0becca5cf","sha512":"8b1c426c374de21a0f76b61cad1ad0a677c7e43ff5bd0a48340f501ea8ba3495f2564dc1e2b2c4904a00a98b3b47b51e84e674ecf78a4be0c8d119f8e2ac40a1","ssdeep":"768:MX2qTNUGWmob3cDer5ueWfsloSNIPGIU3g6+gb/1pEK3VyRn/LM9OT81LFODpi+b:YZRTomPGIUQ2b/1prFyRuUdi+cc+cFyY","tlshash":"3e233bd670adb44143fb79a42c7fb08ba0b76a59451c9668f308d5cdadac5c8803ee7c","size":49578,"data":"","first_seen":"2026-01-05T17:40:40.651139Z","last_seen":"2026-01-05T17:40:40.651139Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@zumer.CQXvgQnk.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"4247956666256a3b63c183f3ff06c02a","sha1":"e9aedb07e926d7bbca69321b01960cc9777f6362","sha256":"4c7e9dc9554affb3af9c63eadce63ba420e7b2f7efb202c0d6963bc815b47c24","sha512":"8a171c3c412ffe689b78c04045f14c44bf3c797ab722a9087d9a0789b96a52b4c56dd82f8f4d9c65a1d984ac8317130892d1b10c98769415855d58884aab5ab8","ssdeep":"3072:b6vRvK/GcTqOnFWUi06FgEezsiQ+E3n2qlp:bcRi/G2qOoUi06F3Wsiwn2qX","tlshash":"0da34a7433763137a3dd009a90ba4205f26c992949074c99e27e9c7b3979c86b2f7f78","size":102707,"data":"","first_seen":"2026-01-05T17:40:40.612346Z","last_seen":"2026-01-05T17:40:40.612346Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@element-plus.Bn41Rdmt.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"9e09254c52e4dd8a4a7f1a1ec534257a","sha1":"4012de7233ba137476e113f3362edaa2c01897df","sha256":"7f083c53e0662d1058029bc8680fc735fd7897b4215e7705ff88063fd16ba98e","sha512":"e52fe20fb07576eced123241e05fd62c6ff05f847b9540df77fa2402af25ed41dcdc3d238d1488687f2fd619d71ad07f703486a7640afc933bfbbfe3020bba7c","ssdeep":"384:HVWr+yix9MWmXC+v1cFTk6FY92oh86IMbKat1zme4PEs0SzXyXxr:HVW7/6FTW92okMoEs2r","tlshash":"e2823178af1984dc452fc14c2db260221b5e6dfdb18b4831abbed93da213978c617c9d","size":18828,"data":"","first_seen":"2026-01-05T17:40:40.584671Z","last_seen":"2026-01-05T17:40:40.584671Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/lodash-es.DjvwQNwl.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"914cd6b15467109d952e5e8758bc6d5a","sha1":"27b6464b7ae83a587a8e5b20c001257eaa0f6473","sha256":"16b6b5b2d1ce3c72c3a847d9a45e3f583457919e9294d8e46e80957a368a164c","sha512":"80225a56d72e41db61c83b0de3429495637f12f61e7b98efd0e7963bb2aabee2460d67d967f1cc72fee80e9d995aebe0799e26fd05347c80e89399de82d5537b","ssdeep":"768:lIPKQJhAOwwe+geEXlrT8AFyZ2crpgJRpRTe5koU5qn7iqNf:lHQLAp8geE1rT832cdgTeCoU4n1Nf","tlshash":"8fc285c875d3f06143a6687480af180bf23c7c64948fe450e1e6d4dabd7916ad673e3a","size":26056,"data":"","first_seen":"2025-11-20T04:33:33.689794Z","last_seen":"2026-01-05T17:40:40.566939Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/index.D3030Mjq.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"472e44861cdd5db465efe3514460c7c6","sha1":"65d5ad9c03224bcb6e69f355eadfb6a279ccc370","sha256":"a0d47c366fda8dda5dbaa69bc5273e42c3f9f848a80a4e3dbdf72e8ccc8ab877","sha512":"8bcd1dd60d43c5d29cae5c89b466c261e0f8287166e820125b8ad54a4d0d36f9eb470512e64e182d787fad75fafe6dcdb17572f62f7a6b7aa1802e170a94dbf0","ssdeep":"384:S4+Ie3MM5Y1b4MN5lbW+vlpP+wP9LieafhjvOwe0rg8DUdY/dh+sGqx7M1eTb/o:Sqe38TlbTvlhPP9L3UhjvRe0rg8DJH+1","tlshash":"e482e89fb58445388773dcfa9ce9530820de4f51cec9caa6e7ec4e0a03a1d78869c719","size":18854,"data":"","first_seen":"2026-01-05T17:40:40.544332Z","last_seen":"2026-01-05T17:40:40.544332Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/CommonTable.u-6JAKnR.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"7eeb2f23bfc453036cce671ddd71cb0d","sha1":"39b41bd0de886fd13e5e9ed1caba5596e74ecf9f","sha256":"90c0aba5c57539aeb255a33503c1ef903554f00a928de56ba6c5f5f9ebb32f32","sha512":"da141f8f4f7f6ddd11bc0ff70b0ba4e1e3f5c2a192f92cbdb5c3834cf7e7378fb20667ec3ce73f911c787dc3fb978c7d7db5418a64b0caa2c11213a43ff836fc","ssdeep":"96:UZvCLlM4Y98LweVc5AZ7/P85EspMQ3fAGHUmBc6QGdI/UFce9pwwWDgS:UQLlMvEc5AZ7/PmtZ3IGteYfFBpwsS","tlshash":"0dc1e668b8badcb963ebc1b830194420a51d3b9ed010a4f1a1ff1e1617ced54838fb39","size":5847,"data":"","first_seen":"2026-01-05T17:40:40.585424Z","last_seen":"2026-01-05T17:40:40.585424Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/process.DzrMeI0r.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"57241a8c1b06047c1ef26173656dc0eb","sha1":"c61bf230f048129e928d008992cbcd0afde7eeda","sha256":"8934fae2fc4c1e83a8c28a087ceb4a35208456f1c54aaa3550c0d3d575458d66","sha512":"198d0951e96ac0082610dc185192d5922da246141ceea5607cec50476b1212013120f72f073930c1922847ab53a2c6e7a022ebe5ad28ee795e10126ba12bf562","ssdeep":"","tlshash":"af31349cb79eb5b763e223b0553f8503e07657b21c4d80a47122e5e038309797717dd8","size":1725,"data":"","first_seen":"2025-11-20T04:33:33.524994Z","last_seen":"2026-01-05T17:40:40.597212Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"nivex0.one/js/vant.AyL9BkfU.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.851Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/vant.AyL9BkfU.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/price.BpPWlJRd.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: \"1767634797\"\r\nlast-modified: Mon, 05 Jan 2026 17:39:57 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":54118,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (36539)","md5":"3214c50942b0edf9b287baf398f9c3a6","sha1":"5077d3fd44448e309e8badb488b363032ed347e5","sha256":"94cc276ebcf5889448f9aaa14fca6ac750ad931d18a88218c00c3b9d32d705a4","sha512":"62cc21f7f3cc5ddee143e10f5062852d1f695adba8f62dc17527bb03bf737ce670cf568a6696ec986fe0b108cd90c6ccbb52b0b9f6d2181c951915d24658cb0a","ssdeep":"1536:GnDy68JJkuTaKX17+ZZzD8QUH7jQch6J0doSed:GnW68JJkuTXOzDZUH7dQJ0doSm","tlshash":"ca333c91b1d6b438d3bb68c440590940ab2d1b49b01ac8e1f1bf9e553b69ce4e5fef1c","first_seen":"2026-01-05T17:40:40.520041Z","last_seen":"2026-01-05T17:40:40.520041Z","times_seen":1,"resource_available":true,"data":null}},"time_used":228,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":228,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2024-11-05/e663a7cd5f62ec73e247c36907a632a120241105154957016.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.062Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2024-11-05/e663a7cd5f62ec73e247c36907a632a120241105154957016.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":1010,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"0fb70690288109f594a3ee773a489890","sha1":"0063896e70219950943a66b781db9d3799702fb3","sha256":"8fc174251647f28d51d31f696603bcbae579788915ac49818f93b1ef695f5853","sha512":"4b37ebf118d32fb1193365836acf307907777b736e73795b3cc292a13e148f0476a840fbe02f98067e354c7408a2275b0c18b8c1552c71143a0ad185ec9632bf","ssdeep":"","tlshash":"e811c877e52c93f6dc90c4d0439e3824da355f1adbc3b5d98ac1a424f9d93140488c2b","first_seen":"2024-08-20T10:34:45.05581Z","last_seen":"2026-08-10T20:44:44.969171Z","times_seen":1637,"resource_available":false,"data":null}},"time_used":3086,"timings":{"blocked":981,"dns":3,"connect":37,"send":0,"wait":1058,"receive":0,"ssl":987},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-12-09/a5ed5db50cb668442b6f249d5067d7b120251209151041836.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.168Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-12-09/a5ed5db50cb668442b6f249d5067d7b120251209151041836.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":5744,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"e6f439f6deac85891fd4ebff54d3f944","sha1":"3a30bd55334b9d46a575bd979ec03d10d61ff4b2","sha256":"3cab2d9dc3c2153dd6d54c3ca63e4d1d3060ca9ad13a0fa9ece7c8848f23b1aa","sha512":"7660b3152ae7a5ad0bdc739ae0925b0808b597258821a65524f7e60e2cd42c301b11dd7c9de56986b0f29d5bca7dbfcbfd6a12082fe2a9601b4267a05e8dd47f","ssdeep":"96:WSE2eBBrSh0m/O3SFGh3H6b4YT5s1G/2N2id5+Y7oDWO+I0S0cthri76BH:WSDerrSGCssbv6keN2e+8OZBh86x","tlshash":"4cc16df29b8aea4573ced22890b212f9f0c9d8cc5260d535da5478a690f59323c1b7b2","first_seen":"2026-01-05T17:40:40.521929Z","last_seen":"2026-06-01T01:23:32.03868Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1860,"timings":{"blocked":854,"dns":0,"connect":0,"send":0,"wait":1006,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/md5.BcZ6lftK.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.673Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/md5.BcZ6lftK.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 1504\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3532,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3531)","md5":"2155d028b0edc8862b7bf54c2e8360ef","sha1":"2b70b5269c62c0da0261ec4a7411dbe3b0a4dd61","sha256":"fb0c1d4be97cbeefce73825c6b7362ed683d8d75f8db9e62c5fcd8a67cde96ca","sha512":"7e155a16845177f3fd9de769e070e03fc515e3fc02328f87882fa557c7bbe2702f06371bbf6174fd211ed23d5c8b28167e0dfed9033c9561fbb56c60a9745dab","ssdeep":"","tlshash":"0f71df9ca0020059537c48d50c9b241eaf70b49d751d04cabbee8af58ebeefd52e362d","first_seen":"2025-11-20T04:33:33.503446Z","last_seen":"2026-01-05T17:40:40.522805Z","times_seen":2,"resource_available":true,"data":null}},"time_used":461,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":459,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/bignumber.js.JTMmK3Hb.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.692Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/bignumber.js.JTMmK3Hb.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18639,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (18638)","md5":"ec4a76408c5691ee8b2195786f7302c0","sha1":"e486b819669db664ec917a53d7648bfd9c7cc889","sha256":"0873639c6b478e97e3bfc4b960b79c38a44df3bf6e41d51c097a23a602eafc5f","sha512":"b2e4c7c97a281029ddfcde88a4f693a9795f4c74d14fcb635985da50d9299e6e75cca56634c83dccae874cc9f0cc998eed3cd1bc5f19fcfa10027b6cc6a81dbd","ssdeep":"384:4AJ98BMyDKcfcUXuELInPM75k31vjjRMM9iosRAdGJd7tP:4BMyeS+lnPY5krMM94AdGn7t","tlshash":"c68229d874abf09942fa34c000eb9446a239ef4aa84c5876f1509595bc35dcb93bff64","first_seen":"2025-11-20T04:33:33.6258Z","last_seen":"2026-01-05T17:40:40.523876Z","times_seen":2,"resource_available":true,"data":null}},"time_used":676,"timings":{"blocked":296,"dns":0,"connect":0,"send":0,"wait":380,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/tslib.BDyQ-Jie.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.526Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/tslib.BDyQ-Jie.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:29 GMT\r\netag: \"1767634589\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:29 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 714\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1275,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (547)","md5":"5bfa8a535e5030f7cb2aa8556f8425ed","sha1":"fdcfb96973b929749dfb2c62f54b7e2dd87f1db0","sha256":"5314f1531709467c338fff833b11ee3e15d94beb150ab36419842ba2919bc46c","sha512":"27c439b69e9d0124bf155733bf52d8c7fad4a305c6eda40fdb9519b7caca126edebfe3c3374ae747dd9688b2ffd9aa1898e1cd093c3434d800ddb93a51d32b53","ssdeep":"","tlshash":"51212189b470add564b76aa02d533cc9a3adb16af415ea541094f194cabf00f862fa08","first_seen":"2025-11-20T04:33:33.528092Z","last_seen":"2026-06-01T01:23:31.900056Z","times_seen":3,"resource_available":true,"data":null}},"time_used":709,"timings":{"blocked":414,"dns":0,"connect":0,"send":0,"wait":295,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/css/vant.BnJkERFZ.css","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.005Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /css/vant.BnJkERFZ.css HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: text/css\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: W/\"695b1917-11ec1\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:19 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: UPDATING\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":73409,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65018), with no line terminators","md5":"8950bc32d6749dfc9e4027cef9bd05a6","sha1":"d413fe74aa27b62a2aef7f129b229cc2d1cd51f1","sha256":"c72b9b120705e3f6bf3df923efdaafde2d80ffd9a69d4108bf088683417fc1ca","sha512":"877f762c74a9f1dd0fd9100e0b12780c8b152b4390f1ec25ae4dc2fb4f0cd6ddeb99cde87dd7dc10d96443ee26ae7313bbda3ace76d208c94e30ecffdbe756a5","ssdeep":"1536:BtIyNBi3MFYaQj7FCwsBlDOFIxuVoxOqeh:BnNIClDsIxuVSveh","tlshash":"5b73e5a4a9c450fd6f2ae166db8632ecb03df672cd418d95f106511c0ecb7f50663a3a","first_seen":"2025-11-20T04:33:33.721413Z","last_seen":"2026-01-05T17:40:40.525909Z","times_seen":2,"resource_available":false,"data":null}},"time_used":240,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":240,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/symbol-countdown.D5OfgNfO.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.334Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/symbol-countdown.D5OfgNfO.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: W/\"695b1917-593\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:19 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: UPDATING\r\ncontent-length: 704\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1427,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1426)","md5":"9d1b6dd6eb733f2e07e80c9853ace3e4","sha1":"779e3a9e6a1097d8e8b2661e617c62316f9386ee","sha256":"9ec9b598ba55d1ff5535684424d15fb3195f46ba5a0b4d24a65c2f9d118ba111","sha512":"8960c9d18fe92179b2e1aaa9f1e13964a9d0d7d3bcbd1752df912d026f238a4e28f5dc116cdab13b55ebec68397bb920d7c7c4480ab3062659e0d3a5da3f40fc","ssdeep":"","tlshash":"0a211ed9273fd0326e218d49231033aa8f9ad788f4b785c2c1cd0cab69a9864f10d325","first_seen":"2026-01-05T17:40:40.526783Z","last_seen":"2026-01-05T17:40:40.526783Z","times_seen":1,"resource_available":true,"data":null}},"time_used":239,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":238,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-12-09/9bfd6226c853dce715a0378fb5eba6c420251209151139436.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.121Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-12-09/9bfd6226c853dce715a0378fb5eba6c420251209151139436.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":8462,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"39bb696557622cd56a232275dc5557bb","sha1":"389605c7276d9d1faac0dfbe2881887a17011b06","sha256":"e8b8a27544bb624a857152eed2f767cac8afb6bc42dc886a96d8469f7b426b8f","sha512":"f85b64b4cc225d51c87b969dc2b0f934c83fe256f6a3f38a13616b79c8ff45a3ade16716aece1e3f1b4e844b93ed76bd65e7c9163931e66ffce5082aaebb5fce","ssdeep":"192:WSSzX/bk3xecGKqLpxfMvfSeeT8Qeq9R9sPYSes80bAAigIdI2KmI/shGzQp:5KgccJqLpxETe8Qeqj48Ax87KmIMJp","tlshash":"3402c05396ebb018059c8d71ec04351b7cfb27683afa9b926cad2ec0db0754836a91c9","first_seen":"2026-01-05T17:40:40.527708Z","last_seen":"2026-01-05T17:40:40.527708Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1692,"timings":{"blocked":900,"dns":0,"connect":0,"send":0,"wait":792,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-12-09/80c8dd3bedd14fa6ead733840edfddac20251209151238505.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.172Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-12-09/80c8dd3bedd14fa6ead733840edfddac20251209151238505.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":5068,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"9b73b7eaf20ef4efd94ca8135752f06c","sha1":"4a1cf98e43c00bca204629a83fa6b21f760a71fc","sha256":"54d8e52b87508c60da40d08d7c4a1dde76ce97f38943f8b1805f04d25412b623","sha512":"1f44166473e87ef1bf743702e4c9cef96f42a70c698e540f383c98f2e485cb7f846ba223ac1677e7ab568ba4683a9e4dc6747839e72241061b79dd0497f3601b","ssdeep":"96:WSkx40LednHEgnCCC8aW2qCAMxiu/ydR4si29nAKBTV+e7ihVMH:WSkx4Yu5ntCtzqCAyzyf9FBx7ihV4","tlshash":"c8a17cf3bfe2dfa5c19e1e8795a66a5931fa4493004020109e0c5de3c869562cef8f4d","first_seen":"2026-01-05T17:40:40.528616Z","last_seen":"2026-01-05T17:40:40.528616Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2007,"timings":{"blocked":851,"dns":0,"connect":0,"send":0,"wait":1156,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2024-12-10/65687360af94ebf61268aeb7a91661e420241210124529139.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.188Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2024-12-10/65687360af94ebf61268aeb7a91661e420241210124529139.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:06 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":184184,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"0ad59107b9856b4fb8bf69b512bbad11","sha1":"b1f52fa57b73fcd2a052f7af03f76682702d1fa7","sha256":"6baaf7a8f4920b311a7094fd744ce8113d249ba117a426c89eb0a6b897715900","sha512":"4d7ca1aec685b62dd506c21f183b276adc21831af285ab7bff0caad997116ad6a10e707200d4e9b8b22cc53d2bf5a095322d2287911513ad7bd40fb01103d951","ssdeep":"3072:4Euppam7DbTVSskqN1iz9+R6ejl/THU2lGrd4XFcXqPrMx6JxcEDyQDToNHuxu:4EMpauDb5xJN1iz9+RTl7dlGrddqjJ6n","tlshash":"dd0423f1076292eedc4ff9ad130b0c456bf30b78b1868a66fa505d6740542c66fc87ab","first_seen":"2025-09-13T12:19:18.497386Z","last_seen":"2026-06-01T01:23:31.918329Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2208,"timings":{"blocked":837,"dns":0,"connect":0,"send":0,"wait":1371,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/echarts.zwp60nWF.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.528Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/echarts.zwp60nWF.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:30 GMT\r\netag: \"1767634590\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:30 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":823843,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"9b4da79ed17dfb8f289faf2b51551708","sha1":"bb922a73f344ea36ab8be14c7bc93f5da55a8da6","sha256":"d44e8c097c359b31a10e86f880324a5747a10bdb20821318491193378b194931","sha512":"a05e698c3a1321ae6630da3a3d657d32a06b4a9fe45270a388edf81c8a6b986c58d9dabd1a0a24adaeb2a7825ff1fa393c646240d611b7b627a5e8493c33622a","ssdeep":"24576:tc/7E84kwVkXcxhPUMRm1Kps7zo5a51yWTTOP3:C7E84kwVicxhPUMUcps7zo5a/yWT6P3","tlshash":"8d05199c7a14742183a331b4157f050f9336280de98a8568fa99d4ea6dfd48a273ff7c","first_seen":"2026-01-05T17:40:40.530442Z","last_seen":"2026-01-05T17:40:40.530442Z","times_seen":1,"resource_available":true,"data":null}},"time_used":834,"timings":{"blocked":603,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/css/symbol-countdown.C6h7HjM-.css","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:56.997Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /css/symbol-countdown.C6h7HjM-.css HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-type: text/css\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: \"695b1917-10e\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:19 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: UPDATING\r\ncontent-length: 270\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":270,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"ad3c377aabde726614d3f57323317b7a","sha1":"ebb7825ba83dcccf3dc1e23e40c7e4bfe07bf698","sha256":"6108d9c91fff527dca6770f5f151bd8c09f84ff3d84a68fc7d075ee4a4934b7d","sha512":"8feb6f3a477af96501ea3c78ff0c85e2c7193893d8f1e681c31eeee9cca95a1061c13b1b3791f0d4393169adfb700645548608bf4474e26d9c3ef4ec1693cb5d","ssdeep":"","tlshash":"00d0c25920f2f070cf21862b36fc9b4c004193024d70d66588c29e18a897951b930f08","first_seen":"2026-01-05T17:40:40.531462Z","last_seen":"2026-06-01T01:23:31.859265Z","times_seen":2,"resource_available":false,"data":null}},"time_used":234,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":234,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.nivex0.one/Publics/getWebInitInfo","fqdn":"app.nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"104.21.41.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:00.266Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nivex0.one","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 21:49:45 GMT","end":"Mon, 30 Mar 2026 22:47:22 GMT"},"fingerprint":{"sha1":"F3:75:42:AC:F4:B1:7A:7C:E8:04:E5:D0:28:3D:F4:39:81:43:13:7F","sha256":"31:21:32:21:BD:A2:A7:26:01:57:E2:D2:82:7C:27:AA:B6:20:97:FE:42:7B:00:B3:42:B2:66:33:59:46:80:FA"}}},"request":{"raw":"POST /Publics/getWebInitInfo HTTP/1.1\r\nHost: app.nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 195\r\nOrigin: https://nivex0.one\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":195,"data":"app_id=glqM63yrAri7JojgtRePgFl3\u0026device_id=8c414030-ea5d-11f0-b736-f91c6883da20\u0026lang=en\u0026__channel=15\u0026__platform=3\u0026__timestamp=1767634800261\u0026__version=5.0.8\u0026_CDCODE=7e88f11cba131e2353b97066fa3b9a31"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 05 Jan 2026 17:40:00 GMT\r\ncontent-type: application/json\r\ncontent-length: 507\r\nserver: cloudflare\r\nvary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers, accept-encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: content-type,Source\r\naccess-control-request-method: GET,POST\r\ncontent-encoding: br\r\nvia: 1.1 google, 1.1 google\r\ncf-cache-status: DYNAMIC\r\naccess-control-allow-methods: GET,HEAD,POST,OPTIONS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mIb2ijzU%2B%2FjMsBns834NCihqHJDPqsj7hS7cp25r7uX0Tg2wuZfPNB%2BWMe%2FF9lko324dN7mpClEgTkcEx3s1GpSlrUK9RPa8qKHB4ywj\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b94c21dae9fc759-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1199,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"d20e8556008c161a4e08ada16abd8e55","sha1":"10991f96151e7cee38ad9640fd594b392b6c6609","sha256":"5e9dc065f65723a2615f9825c5b714b4cb1487646219f5f6405ede6b11252a97","sha512":"3c1e7356cc0aac6b638a630630661325495213ed623aa865a4cd6a4a0c8b9533b1d6d2b240cc711254468caaf5fafec0deaa807d4389dc8d550e6c239d8db649","ssdeep":"","tlshash":"d8219d2f730158974be606ce069e3b9c04ec71e2bdf6e505450d673f48202e8612f6ab","first_seen":"2026-01-05T17:40:40.532346Z","last_seen":"2026-01-05T17:40:40.532346Z","times_seen":1,"resource_available":false,"data":null}},"time_used":357,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":355,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"app.nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-12-23/32c3debfe863ede3e9d4ef748c9f1a6c20251223193901155.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.149Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-12-23/32c3debfe863ede3e9d4ef748c9f1a6c20251223193901155.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":12644,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"ba900301c86d8c0cc84dbab6fef99923","sha1":"b177e231245a632f11e2b41af666e3e5802868fb","sha256":"edc80f96c4c219273b9e7cec7474dfd3e5880e3cf142b68390bd06e68e3f12fd","sha512":"01f0f9d29f3593240481bd42ce1d6c7aff02d857c25b12e4360a5c8664b68658d39da86688223042baebcebbc8bd3351dffa93fbc7d7a3f28aabd69337aee507","ssdeep":"192:WSsAIgb6on8sTzq0wtQkwKdfovsBeBiyHvX7ohhv6JrPA1cPPST/3dKzw:5xb6on8sauklkCeo6X8WJrPAwFE","tlshash":"4042bf5565c34d2245a5327622db73d3fa7bcb006304c3c96838cf8b796f99389e72a2","first_seen":"2026-01-05T17:40:40.533186Z","last_seen":"2026-01-05T17:40:40.533186Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1577,"timings":{"blocked":873,"dns":0,"connect":0,"send":0,"wait":704,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-01-03/004eb062f885406518be63e799c650ef20250103120108152.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.197Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-01-03/004eb062f885406518be63e799c650ef20250103120108152.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":9181,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"3fcf1037c2f16da99d457f291653efe9","sha1":"76d04ad98f9d3638b199dfd8a688a44a4331375d","sha256":"620ba7ab9e62d59d493635963f4ca53a8b987f3c25b622ddd17ecd9c6a367d01","sha512":"223b75a2c7d86542c7202557b9e6b7cdd769f20d7d1b46f53e806b30ef6ec2de9b71ae1b14e01280462a2ffb1d33c492b2a330db31bc12325233fbdb05e5bba7","ssdeep":"192:WS/01c4LzT7YIe1IBesA3WUeZIFqVFI0rvcH8+e/Wyzf/VRRrICnTNh2+G:56zne1IBe9GU+FItdEzDRkCnxG","tlshash":"a912af9fc3d57fbe82b2044695628d629ddb3ae642473f454f16384633cd1876463c5c","first_seen":"2025-09-13T12:19:18.585804Z","last_seen":"2026-01-05T17:40:40.534138Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1882,"timings":{"blocked":828,"dns":0,"connect":0,"send":0,"wait":1054,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-01-03/21624f7fda4b9a48e5e68d164a27ed7320250103153242804.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.204Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-01-03/21624f7fda4b9a48e5e68d164a27ed7320250103153242804.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":3315,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"355996ee18d28dbf410f285d21133b24","sha1":"ad97d2180a5d85a26025c44a9db9db0deda60418","sha256":"86c97583ffb41fd58731f25a1db965edfc72723ebbf8f7c89c9e36afa496aaba","sha512":"8ea7f90d35b8f3f865a203e39613385dd73e58058d1267d592a84fe6e84c158134f9dbdf3b0a1c2e5bb3550ab1f3c2ab56683b88e5c71fa786c9e93531aa7586","ssdeep":"","tlshash":"ba618d8cc5a188ae99f706856f55bdfedb2b642c0d91c0bccb38b22c5b10cea4709c12","first_seen":"2025-09-13T12:19:18.59238Z","last_seen":"2026-06-01T01:23:31.976776Z","times_seen":5,"resource_available":false,"data":null}},"time_used":1780,"timings":{"blocked":832,"dns":0,"connect":0,"send":0,"wait":948,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@vue.CrdQ3V-0.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.649Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/@vue.CrdQ3V-0.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:27 GMT\r\netag: \"1767634587\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:27 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":83333,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (44978)","md5":"fc6a54025db0fb6150cf14cdd8b8a7de","sha1":"326c4421aa734bbe4572bab7fb64e0f722e09e5a","sha256":"1bc84ea96283ea52a41f6e6003033313404d1efad0d4b4cf32cf2cf900b00f95","sha512":"6eee7323f7b3af5ff40d2cec157e95f231de5554490ddf07c8bc7688a7c005a1f05df7f6b71e4af276697d4e5d06285dc1fbb8fb4c63733640c80b0042453edc","ssdeep":"1536:56rAxqylaKcn1/4TO0OesE5P59QeH0maO+vKHZ:mKcn2hFYeH0o+S5","tlshash":"788318f93196b57253ea19e240770402f369284a384dc8e8b06daddf3e7384551abfbd","first_seen":"2026-01-05T17:40:40.535923Z","last_seen":"2026-01-05T17:40:40.535923Z","times_seen":1,"resource_available":true,"data":null}},"time_used":229,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":229,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/firsr-home.3rw-CFnS.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.399Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/firsr-home.3rw-CFnS.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.D3030Mjq.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: \"1767634797\"\r\nlast-modified: Mon, 05 Jan 2026 17:39:57 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13321,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (13320)","md5":"b15d9d858c782daff9a351aa61686912","sha1":"219e7271626d3f817c8aa557a92aa5b0faa359b8","sha256":"6e37f71bdde4d3f6140087662c86da6bbf0f01b93b20ca54ae5f46c96b1b1846","sha512":"7cdf8c40f39da26eafac76e501e082c9a5e592a4338109a38891bf9300975db21474279f60140f11491c7bd2f351312bb00a70ec3e1a9bcfa699d32d554009df","ssdeep":"192:uZZLidJEUN0/nb+BFwTF2jIY61J4aiL4uwYyIJ0rS0xhbgfVjRO5s/mPtVKhR9cF:uPYw/nb+BFwTF2jI8XMlEjRO5yjhRI9n","tlshash":"ad5219e9b091c4754ba7d5df882a030013362297689c826dfaed4cf26648d5ed2b8f76","first_seen":"2026-01-05T17:40:40.536904Z","last_seen":"2026-01-05T17:40:40.536904Z","times_seen":1,"resource_available":true,"data":null}},"time_used":382,"timings":{"blocked":152,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20211023/vNUu87772247443.jpg","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:03.940Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20211023/vNUu87772247443.jpg HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxMqxb8z5vcWUJluWXdiOxE6dMYCa13ZngxrPitFSRocuL_oSReeoGASLQCod85lDRfj\r\nx-goog-generation: 1729754942824655\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 4097\r\nx-goog-hash: crc32c=u5ubTg==, md5=FbHNqkuWvnb3on9L8IzU2Q==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 4097\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nexpires: Mon, 05 Jan 2026 18:40:05 GMT\r\ncache-control: public, max-age=3600\r\nlast-modified: Thu, 24 Oct 2024 07:29:02 GMT\r\netag: \"15b1cdaa4b96be76f7a27f4bf08cd4d9\"\r\ncontent-type: image/jpeg\r\nage: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":4097,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"15b1cdaa4b96be76f7a27f4bf08cd4d9","sha1":"2a4260e75410ac598a0a84d5b3407676c950a25c","sha256":"6d3c83f1434256da00f0f83d0ffd8a8642837a8ffbe42652169a35f6b0cc80d9","sha512":"cf30401ba8cfe0fd9bf063a5a962f4382292d9465edf8028be47142bfef8394fdbeed56572fd2d9a638a215d9ca0ab88ce07909a04f941c7efbdcffd73b3b91f","ssdeep":"96:lPwVEzyaKT848nav+Ui7mIkKunZ1fSkGyNr+Z3EvY0h25VP/:6eqAav+Ui2a1y+tEw33","tlshash":"df817debc88f1e4af649e176bec22a447f2ecd358242e0ce03e63454cf5e16b5041386","first_seen":"2025-09-13T12:19:18.518748Z","last_seen":"2026-07-05T04:53:58.225335Z","times_seen":7,"resource_available":false,"data":null}},"time_used":2464,"timings":{"blocked":1071,"dns":11,"connect":30,"send":0,"wait":311,"receive":0,"ssl":1027},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20210713/EnSG11207937526.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.133Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20210713/EnSG11207937526.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxMJZTcyPisRTwY2G7GXtw-h86mhavChPvQYb77IaP_UQZZ1ofUxY96COaSnrKTeXzPW\r\nx-goog-generation: 1729754934416516\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 3670\r\nx-goog-hash: crc32c=jzQL+w==, md5=baa+wj3mHT+rsijiEPqz2g==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 3670\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:28:54 GMT\r\netag: \"6da6bec23de61d3fabb228e210fab3da\"\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":3670,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"6da6bec23de61d3fabb228e210fab3da","sha1":"f179f298fb00b1407c0de9c6351c98f305d60f18","sha256":"a4abc1ed3b19e8ccf6cd992b89ad5ef56997865755bd68ed3523e2d7585e823d","sha512":"4cde0eef2d33d1d969494d6f0ad722ef17e921154333e82ddd8a3757b8daf95a5a022a846edc21238c1ef74c064b7c1fc32146ef724d453d58d56576796cc317","ssdeep":"","tlshash":"d2714c6706e41ec6c36e0db6246ab371bc8ee992d425e7fd311445297c480a8fc03778","first_seen":"2025-09-13T12:19:18.471786Z","last_seen":"2026-01-05T17:40:40.539185Z","times_seen":4,"resource_available":false,"data":null}},"time_used":343,"timings":{"blocked":309,"dns":0,"connect":0,"send":0,"wait":33,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20210805/Kcxi98758350196.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.150Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20210805/Kcxi98758350196.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxPGGYDTNfC5GgoU_g7pYejirT7BkAyXojxLlTlO8WF95sKEf1zzBE3Ddol9b2mqJuAQ\r\nx-goog-generation: 1729754975980793\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 3465\r\nx-goog-hash: crc32c=lqZz6w==, md5=r4TUMAA4LS3XPXAyUQ8cZw==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 3465\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:55 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:55 GMT\r\ncache-control: public, max-age=3600\r\nage: 1149\r\nlast-modified: Thu, 24 Oct 2024 07:29:36 GMT\r\netag: \"af84d43000382d2dd73d7032510f1c67\"\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]}],"data":{"size":3465,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"af84d43000382d2dd73d7032510f1c67","sha1":"b459f2a03f867e6e4979f318ad303755f6821e07","sha256":"24fecc506920b2faf5dc25dc8a5cde5b90a80e647a4565f5db0f0286a662cf12","sha512":"f86d1f4f00fdd8a2a63f953dbbb7bb17b348ea8c4d9b1464f2d7ef7fdf22183703d049a2465d49ca54d5e744721451b3f79d7e28d67c1e364376f39a5ab14194","ssdeep":"","tlshash":"aa616dcbb1977e38a66731f0a9eaa008da011c4527dd746cafc31c112d60e2bec0b6dc","first_seen":"2025-09-13T12:19:18.546539Z","last_seen":"2026-01-05T17:40:40.540237Z","times_seen":4,"resource_available":false,"data":null}},"time_used":330,"timings":{"blocked":293,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-12-09/eb71b21f7e14fead069305d24195e7a820251209151258682.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.182Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-12-09/eb71b21f7e14fead069305d24195e7a820251209151258682.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":6885,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"6155da846051826326e0f8ff777a5382","sha1":"b7ce3e75a781fefc24f52e3455d525d7c16897d5","sha256":"119ea399bab8b8eac28c9497d097189be2705cfdcb07211b5601ee99b28698aa","sha512":"582058686d6d97d81480500e2a126197a76e027b8903f5ca5f95b7b9c128bc594a2027367347753011ca9fe7386b40c40b108363938296acdc69a457bc327fb7","ssdeep":"192:WSBYKr7WgulUoKsDP/dPSfGBumHyItmdrY7:5e2DuEadPSfkpHQrY7","tlshash":"91e1be45e489f27c8a6a154c8c28ea2abcbc84c6718ec24022311dd9369fa2dc62786d","first_seen":"2026-01-05T17:40:40.54127Z","last_seen":"2026-01-05T17:40:40.54127Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2052,"timings":{"blocked":842,"dns":0,"connect":0,"send":0,"wait":1210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20211023/ieAB87807026650.jpg","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.184Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20211023/ieAB87807026650.jpg HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxPErcszWunsx9nH0FnB-tvDi0c7s4Z-fhv5MYpZegFsjyPZ0r57N5vzjJz5dKBhZ740\r\nx-goog-generation: 1729754945726255\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 4185\r\nx-goog-hash: crc32c=S3FgDA==, md5=xK8J04NG6FUooKp7oA7D0A==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 4185\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:29:05 GMT\r\netag: \"c4af09d38346e85528a0aa7ba00ec3d0\"\r\ncontent-type: image/jpeg\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":4185,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"c4af09d38346e85528a0aa7ba00ec3d0","sha1":"8de2a49b18cd0aa4c26e9418c133dc426d562cbd","sha256":"b667e77c4cdde513749a091bb91ec210fca4cdecfd361a33f47d17a5ee601b38","sha512":"4fcaddd07a431da49ca5acd0840e0e9d1ac5a1d3b9ea99a87f9420274e3ac60fa5512a794488f05c23586106678f085a18074f98201e550f4813ea9ac5bfe131","ssdeep":"96:lPwHF1ha//9vTCZShXBemTQ8jlXLcfeiNwzTDK26ZP:6l1h+FTCPmTQ8RLcjSDKTZP","tlshash":"96815c91c315ee11cf4a90f73b6fc76d8da862bca19430c52b4051afc94e6415aaf1db","first_seen":"2025-09-13T12:19:18.550874Z","last_seen":"2026-06-01T01:23:32.106107Z","times_seen":5,"resource_available":false,"data":null}},"time_used":297,"timings":{"blocked":259,"dns":0,"connect":0,"send":0,"wait":38,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/deep-pick-omit.CegYQlcN.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.499Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/deep-pick-omit.CegYQlcN.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 488\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1115,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1114)","md5":"a4cc76d93ad7c139918ef0aa35694ebb","sha1":"ccd84f6a6816906f3db230344b9db2927fefb8ac","sha256":"95bed3fc3d3efe7f365ac84ae15d3b75e7febe9f3ced0e36eac59421f1cf6781","sha512":"89291e9c53df46b0634f892781031e188991f36ac836e25e0ef9b42dd28ae38558daa1551d327415e5706687fe33c240eefbd38463e00b758728095f97866733","ssdeep":"","tlshash":"782130e2bbea9074837218f4180e819ef33c580d299d5480e218e8a132f7861e7a392d","first_seen":"2025-11-20T04:33:33.648908Z","last_seen":"2026-01-05T17:40:40.543392Z","times_seen":2,"resource_available":true,"data":null}},"time_used":401,"timings":{"blocked":168,"dns":0,"connect":0,"send":0,"wait":231,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/index.D3030Mjq.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:56.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/index.D3030Mjq.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:37:06 GMT\r\netag: \"1767634626\"\r\nlast-modified: Mon, 05 Jan 2026 17:37:06 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18854,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (17148)","md5":"472e44861cdd5db465efe3514460c7c6","sha1":"65d5ad9c03224bcb6e69f355eadfb6a279ccc370","sha256":"a0d47c366fda8dda5dbaa69bc5273e42c3f9f848a80a4e3dbdf72e8ccc8ab877","sha512":"8bcd1dd60d43c5d29cae5c89b466c261e0f8287166e820125b8ad54a4d0d36f9eb470512e64e182d787fad75fafe6dcdb17572f62f7a6b7aa1802e170a94dbf0","ssdeep":"384:S4+Ie3MM5Y1b4MN5lbW+vlpP+wP9LieafhjvOwe0rg8DUdY/dh+sGqx7M1eTb/o:Sqe38TlbTvlhPP9L3UhjvRe0rg8DJH+1","tlshash":"e482e89fb58445388773dcfa9ce9530820de4f51cec9caa6e7ec4e0a03a1d78869c719","first_seen":"2026-01-05T17:40:40.544332Z","last_seen":"2026-01-05T17:40:40.544332Z","times_seen":1,"resource_available":true,"data":null}},"time_used":230,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/index.DGjU1x-A.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.333Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/index.DGjU1x-A.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: W/\"695b1917-4916\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:19 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: UPDATING\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18710,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (18709)","md5":"ba19524f18231ff06f2da36fba317154","sha1":"13de88c53c0fd006c07699a6a320d915ff19ea9c","sha256":"399014812810db3aa354c432e779cb18a3610a320ccd281d38799db898a1ad7c","sha512":"28873f43938b9e62fa572ed565ac179437c93cacfcf1b3479b57c01258aadab8495f82882fb09a7cd233c4c137850501076a14e4042389aff9f262e56f9733ac","ssdeep":"384:2jAB5gAAUyZRvBZ67dzYwY4qvuAyoSyY31yXwyKYSPZksFKG3tkN6:WAtyZR367dzYwY4zoSyY3YXwyKYSWsFT","tlshash":"4582094ef8a6a438f6b6e9d9c0750562230c3f4a6184c8f5b4ff1f132745d54a29cbba","first_seen":"2026-01-05T17:40:40.54553Z","last_seen":"2026-01-05T17:40:40.54553Z","times_seen":1,"resource_available":true,"data":null}},"time_used":241,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":241,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.nivex0.one/Publics/getWebInitInfo","fqdn":"app.nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"104.21.41.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:02.342Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nivex0.one","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 21:49:45 GMT","end":"Mon, 30 Mar 2026 22:47:22 GMT"},"fingerprint":{"sha1":"F3:75:42:AC:F4:B1:7A:7C:E8:04:E5:D0:28:3D:F4:39:81:43:13:7F","sha256":"31:21:32:21:BD:A2:A7:26:01:57:E2:D2:82:7C:27:AA:B6:20:97:FE:42:7B:00:B3:42:B2:66:33:59:46:80:FA"}}},"request":{"raw":"POST /Publics/getWebInitInfo HTTP/1.1\r\nHost: app.nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 195\r\nOrigin: https://nivex0.one\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":195,"data":"app_id=glqM63yrAri7JojgtRePgFl3\u0026device_id=8c414030-ea5d-11f0-b736-f91c6883da20\u0026lang=en\u0026__channel=15\u0026__platform=3\u0026__timestamp=1767634802338\u0026__version=5.0.8\u0026_CDCODE=bbd6c0b7254b6e770821be56fe3f3d0c"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Mon, 05 Jan 2026 17:40:03 GMT\r\ncontent-type: application/json\r\ncontent-length: 510\r\nvary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers, accept-encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: content-type,Source\r\naccess-control-request-method: GET,POST\r\ncontent-encoding: br\r\nvia: 1.1 google, 1.1 google\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-methods: GET,HEAD,POST,OPTIONS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bIKMyDNk7XEcPhBgKYif%2FQqkmMLegKI2BM7tIrSWZT2uJsV90%2BbBSm6cwj7XbG3cnny%2BR42AzhkpRBSWPraHaeUjNvvOBUMHuqu4pw%3D%3D\"}]}\r\ncf-ray: 9b94c22aaf00712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1209,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"9e2cd9e53d61dd7017c739b572ad4022","sha1":"fdbab86efe64a86ca1db6a85285128675d6408bd","sha256":"7b9516524058af6c882e2382b07ad632e508d03762cc96d4395df315342ca80d","sha512":"a2c1f45a87151bc9425b76b96b40b286d09a578f15feca0f5b0175ba8b92b8a7b36ce58f85c80f51bde4236d0f7e53757eaa50b9ceb7b0885cac7bbf9bc22dbc","ssdeep":"","tlshash":"ec21e0293f3c0307072762d10b9da95a482ef737d9aae575859217db0d3abc8810ede7","first_seen":"2026-01-05T17:40:40.546745Z","last_seen":"2026-01-05T17:40:40.546745Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1250,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1250,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"app.nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20211023/2Jb587722018419.jpg","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:03.932Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20211023/2Jb587722018419.jpg HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxP43MoVI1gMA1IfFQWAZ-IP2V_LjYD8EJaktSCoScQyAD2Jn8OV_zuSmirlS0Mn2SOFKWBUPjI\r\nx-goog-generation: 1729754942557731\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 3953\r\nx-goog-hash: crc32c=Quzziw==, md5=tgV0z+aAu5pTHP204zHeZw==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 3953\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:29:02 GMT\r\netag: \"b60574cfe680bb9a531cfdb4e331de67\"\r\ncontent-type: image/jpeg\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":3953,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"b60574cfe680bb9a531cfdb4e331de67","sha1":"c26301dc67f6953e8969076d1a46d5ef190a2ac5","sha256":"8d09470200e427a51716ca44d90434e6e691d8cc5cc80fcea6588416c1a23af5","sha512":"9c3f9cef4efd1c48c5c03544aaa0a78369f1cc7a6334b88108ae204ba8c94e763f5d3decb72bd146004dc1a601ab6f20dbcb4b8e61c15429fc731ca7e15a0404","ssdeep":"","tlshash":"67816dc9245e9583f6cbf038424585c928f9ad5f7058732f5e10e07e0cf5416e9e1b75","first_seen":"2025-09-13T12:19:18.528732Z","last_seen":"2026-07-05T04:53:58.182211Z","times_seen":7,"resource_available":false,"data":null}},"time_used":1028,"timings":{"blocked":509,"dns":1,"connect":12,"send":0,"wait":18,"receive":0,"ssl":483},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20220119/rKm724883161786.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.110Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20220119/rKm724883161786.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxOAve_XQh2oPcNpDozMMrGHftkcxQ1E1JMJIL4FtrdP5WOtgzVpRKKwOXvoxGTGjZOX\r\nx-goog-generation: 1729754991567030\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 4150\r\nx-goog-hash: crc32c=/RI4fw==, md5=YN8ObfLPNbhbj2P6ABNhwg==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 4150\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:29:51 GMT\r\netag: \"60df0e6df2cf35b85b8f63fa001361c2\"\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":4150,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"60df0e6df2cf35b85b8f63fa001361c2","sha1":"13497f421fb709ffd71019d8b696f57b7ec0af3b","sha256":"7413bdb92d1d2f3843e72cf6e2ad9989e14231f9002ea2f3180464f2ee88a80b","sha512":"780cbc6096d43deb907fddf6ac51846e3be44197aa21e8c2c7f13394e1180e44ab207d7972a17e03225d86454d15ec4e5e8a4512e85687cc4e9cb16187e8d74e","ssdeep":"96:lPwioTB/LYyeaMXFyjL8Co15QkuxNQDWDHE1RLVNhhnx:6ioThqnX0f8CKkTk1RXhhnx","tlshash":"96817d7aefa35711fa4809740378c26049ebb197b7d43e61b803be15c57930648a7277","first_seen":"2025-09-13T12:19:18.549629Z","last_seen":"2026-01-05T17:40:40.54883Z","times_seen":4,"resource_available":false,"data":null}},"time_used":364,"timings":{"blocked":332,"dns":0,"connect":0,"send":0,"wait":31,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20211023/RNsR87961957284.jpg","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.111Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20211023/RNsR87961957284.jpg HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxOtna5SEK5PAf8AMjrT6NJlQUABmgkdqWwq_mnArpIUp1VkAxugOq9ynlUB8xxp9SSX\r\nx-goog-generation: 1729754947124547\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 7700\r\nx-goog-hash: crc32c=BbhdmQ==, md5=RmvZ/OpV9+vIVMlrwacIBg==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 7700\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:55 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:55 GMT\r\ncache-control: public, max-age=3600\r\nage: 1149\r\nlast-modified: Thu, 24 Oct 2024 07:29:07 GMT\r\netag: \"466bd9fcea55f7ebc854c96bc1a70806\"\r\ncontent-type: image/jpeg\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":7700,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"466bd9fcea55f7ebc854c96bc1a70806","sha1":"89fd579360eaac5af0b78d2a76c9e800567cda76","sha256":"2b6a47d651dee52b6ad266384b899b7a2e6cf4c60c549f4170d231ef096ce6e0","sha512":"2ac3cca64cfcce4bd98e2a931e72461847d4bead4b66ede82a1bac0b67ed0a1e51f22b857057075b98c90c7e2b6d4f6a755cd29e3d9971976fc72de13d32eeda","ssdeep":"192:6uPi8J2zp/eN6ucAmTdX/tkbLb6uOubBdkPyw/Ile5hu:l6pzpGN6uctBX/WPI+BCqw/Ib","tlshash":"81f1aff3947f15a2ba4002f6748b43b61ac916b0d707aa707219a9035fd87d2b4ab07b","first_seen":"2025-09-13T12:19:18.590163Z","last_seen":"2026-01-05T17:40:40.549697Z","times_seen":4,"resource_available":false,"data":null}},"time_used":364,"timings":{"blocked":331,"dns":0,"connect":0,"send":0,"wait":31,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@vue.CrdQ3V-0.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.435Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/@vue.CrdQ3V-0.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:27 GMT\r\netag: \"1767634587\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:27 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":83333,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (44978)","md5":"fc6a54025db0fb6150cf14cdd8b8a7de","sha1":"326c4421aa734bbe4572bab7fb64e0f722e09e5a","sha256":"1bc84ea96283ea52a41f6e6003033313404d1efad0d4b4cf32cf2cf900b00f95","sha512":"6eee7323f7b3af5ff40d2cec157e95f231de5554490ddf07c8bc7688a7c005a1f05df7f6b71e4af276697d4e5d06285dc1fbb8fb4c63733640c80b0042453edc","ssdeep":"1536:56rAxqylaKcn1/4TO0OesE5P59QeH0maO+vKHZ:mKcn2hFYeH0o+S5","tlshash":"788318f93196b57253ea19e240770402f369284a384dc8e8b06daddf3e7384551abfbd","first_seen":"2026-01-05T17:40:40.535923Z","last_seen":"2026-01-05T17:40:40.535923Z","times_seen":1,"resource_available":true,"data":null}},"time_used":230,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@ctrl.r5W6hzzQ.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.504Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/@ctrl.r5W6hzzQ.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:32 GMT\r\netag: \"1767634592\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:32 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14133,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (14132)","md5":"6c6404beb1aae34ea6704b981f8cee7d","sha1":"0c744e22fddbbf00c26abf9c8b1524de4afe002f","sha256":"6d58b80875bd909efc50174e828c6aea22d61a2c23283ae548ed40cad5c0f721","sha512":"835f85aa933de967a14aa2d48caf3991a2e22c94d65aa204f1028a64047dac6f0f9dbfd467d171a7e58a1323df6642bb7cee8238a27a188b8378dd1acfd6de09","ssdeep":"384:RS4TjiiMTnctos+tSc+kGG49Q94cZ+e4A:04Xi5n3G29p+G","tlshash":"0252749435d73069931a49b4130b0586b31fbcbe685e4578f4afc0f23cb9a58867af78","first_seen":"2025-11-20T04:33:33.75075Z","last_seen":"2026-01-05T17:40:40.550747Z","times_seen":2,"resource_available":true,"data":null}},"time_used":412,"timings":{"blocked":181,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20210824/PerI50120091105.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.018Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20210824/PerI50120091105.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxMYIcLpSWGs-PaypsERI_bD4pilE-U-_X96NPWmQ-fKsh_kAEO35zjitTx5k95LxbVx\r\nx-goog-generation: 1729754973866776\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 5674\r\nx-goog-hash: crc32c=lLemFg==, md5=mPZjecb8wxt7G/5GMYz+qw==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 5674\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1151\r\nlast-modified: Thu, 24 Oct 2024 07:29:33 GMT\r\netag: \"98f66379c6fcc31b7b1bfe46318cfeab\"\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":5674,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"98f66379c6fcc31b7b1bfe46318cfeab","sha1":"ad20ce24696eed712fe16c482ee03ed31f83c29c","sha256":"3101c23cf19c4e86ab14eaa4fc424226a09dd0c205cf82b2da56df24759aaa7b","sha512":"0cd4fb73a03f50891eeaa75dbdaff7c2148284f08863f57424509a28bd384939ec16b54c10aa389c1ccf7d721fc678d6d57825bce83aff8be0e3e360b7829880","ssdeep":"96:lPwWiQ63TsiWazGwKPLeFlg0L4c2AoJ6qJfJE+ITpEDdVTIGk69KQ4oGmUlQ4PEG:6lQYTsiJ2D8S0L4Z7rapSd+rM4oMvEjS","tlshash":"8ac1af8b6274e4a75fcb043e7a3d0af982523f77069b1607490d5833da7db18d958208","first_seen":"2025-09-13T12:19:18.545549Z","last_seen":"2026-06-01T01:23:31.985244Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2057,"timings":{"blocked":1001,"dns":11,"connect":28,"send":0,"wait":14,"receive":1,"ssl":995},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-12-09/1b6045ced4bf3b23de80d4c93e57b6db20251209152219459.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.118Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-12-09/1b6045ced4bf3b23de80d4c93e57b6db20251209152219459.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":6899,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"3b4b81f10e10493085af2d98b12b32b9","sha1":"f2346e54b3eead79d57ec35c8ceeb7cf8b8eb991","sha256":"ea3182e681688fcfaa0a376b6c71499435c4e93d94701051e19d3f6ddf73d732","sha512":"e13f9d1e1c3aa7318168e2044bc0fbd3b9272594dd110a0b92d0fe80df93078366484fe8c879caf4c4c24fceb24ba41cd1575152607a0c3caf3adbfd0243301d","ssdeep":"192:WSJtIfYHHD3O0PdXSSIz+jBnpYlns3WUYFotpAI:5DI+j3O01XISjBnpYi3WEtpD","tlshash":"01e19ef50e2e9d5e41a8472d326727b492fe0321ff5fa5616a25a9e7c67053840043ea","first_seen":"2026-01-05T17:40:40.552664Z","last_seen":"2026-01-05T17:40:40.552664Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1719,"timings":{"blocked":903,"dns":0,"connect":0,"send":0,"wait":816,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20220113/jR9Y56453901432.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.200Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20220113/jR9Y56453901432.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxOZRz5y4YIgHzKYt_H7LQwdsUl8ZTJwfOcB02jqEu4-NphlMcDLSieXuYLDv1YZSbwm\r\nx-goog-generation: 1729754925334661\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 20464\r\nx-goog-hash: crc32c=Dfd2+w==, md5=AoYy9Gj2LVgccXL2dar34A==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 20464\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:55 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:55 GMT\r\ncache-control: public, max-age=3600\r\nage: 1149\r\nlast-modified: Thu, 24 Oct 2024 07:28:45 GMT\r\netag: \"028632f468f62d581c7172f675aaf7e0\"\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]}],"data":{"size":20464,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"028632f468f62d581c7172f675aaf7e0","sha1":"0a8207443d2b6ec4b9b86b802b0b2850a6ad5d54","sha256":"bf7a886ec050f1ceaaa54cba75d1f2b69c439f9745dc275c955894c88afed5b6","sha512":"793bb929e21a506c754a61ba9aa34e5c93c127bf574f909538aefd1d2c957740b88de6f904e006761b24ec3da2cf9a05035157f04b5e2d594b948fa2c5c1b0fa","ssdeep":"384:P6r1XXctHTtydeAxkvmKhde9gcK/La1DAm6f5eoe91SQ7L:PKXXW0wAqhe2cK/BkR91SiL","tlshash":"4a92d0647a2d708deacd3e72c35e9c806e8de07bde7511a081d4aab33978ab4a510d90","first_seen":"2025-09-13T12:19:18.563549Z","last_seen":"2026-06-01T01:23:32.068944Z","times_seen":5,"resource_available":false,"data":null}},"time_used":291,"timings":{"blocked":244,"dns":0,"connect":0,"send":0,"wait":45,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/md5.BcZ6lftK.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.485Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/md5.BcZ6lftK.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 1504\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":3532,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3531)","md5":"2155d028b0edc8862b7bf54c2e8360ef","sha1":"2b70b5269c62c0da0261ec4a7411dbe3b0a4dd61","sha256":"fb0c1d4be97cbeefce73825c6b7362ed683d8d75f8db9e62c5fcd8a67cde96ca","sha512":"7e155a16845177f3fd9de769e070e03fc515e3fc02328f87882fa557c7bbe2702f06371bbf6174fd211ed23d5c8b28167e0dfed9033c9561fbb56c60a9745dab","ssdeep":"","tlshash":"0f71df9ca0020059537c48d50c9b241eaf70b49d751d04cabbee8af58ebeefd52e362d","first_seen":"2025-11-20T04:33:33.503446Z","last_seen":"2026-01-05T17:40:40.522805Z","times_seen":2,"resource_available":true,"data":null}},"time_used":231,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":230,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/destr.BPvN1X9m.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.497Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/destr.BPvN1X9m.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 632\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1251,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1250)","md5":"f4073929b9262bd4def4e6a1a12e94b9","sha1":"13353bb720d2154efb374617d9b8c113e4f5fe90","sha256":"59596c2e2409a6a95380f99391ee0617ba697e59925b95dbf4e3e9ff8689e730","sha512":"fa4b8a8458dd31dd7ed0710e8c45b1d53eb39198bb67b2d6ccab55e1426e1455b1e1b3ebd59c680708cc31b1e8406fbf5b550a9db2166b1dddf5e9f6a1ea8b55","ssdeep":"","tlshash":"0f21dba772dba65a03ee54a44a352861f42c0820ec4f28e1f0e8d427d47a444eab7f80","first_seen":"2026-01-05T17:40:40.554581Z","last_seen":"2026-01-05T17:40:40.554581Z","times_seen":1,"resource_available":true,"data":null}},"time_used":399,"timings":{"blocked":166,"dns":0,"connect":0,"send":0,"wait":232,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20211023/D4cK87832403354.jpeg","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:03.991Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20211023/D4cK87832403354.jpeg HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxNK8az1qmfPAPs8HIstbVxT9K_Yr2idVQQYXFvhKpU-v8ljxM0JHGUZUM5vK0fPLkpSbhlbzEg\r\nx-goog-generation: 1729754945630309\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 3806\r\nx-goog-hash: crc32c=YMm7HA==, md5=pGSI70Jy0/R3CUb8MdlH9g==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 3806\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:55 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:55 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:29:05 GMT\r\netag: \"a46488ef4272d3f4770946fc31d947f6\"\r\ncontent-type: image/jpeg\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":3806,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 97 x 96, 8-bit/color RGBA, non-interlaced","md5":"a46488ef4272d3f4770946fc31d947f6","sha1":"cb2e1ea89f35468fbcc90a2345b9bd0cd1062e7a","sha256":"e6d099327f0a6614971c3df0ca40297743e0faef2bd68d4e9109551997ecc0b3","sha512":"0b9e9ca8ed0aa97b1044a0470c5d1cb3051a8e0dd4db7f02593866b9a50f2898d4c63e5c6fcf96a5c5c6af6168a6dec8f5ec2a78a1ba6adaa94f913f74f5c28f","ssdeep":"","tlshash":"b3718dd7c3610c8b640e87727b964e327a1944370326c71b1fc0714bfdaa695d1a42c7","first_seen":"2025-09-13T12:19:18.529718Z","last_seen":"2026-06-01T01:23:32.067475Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2092,"timings":{"blocked":1022,"dns":1,"connect":29,"send":0,"wait":14,"receive":1,"ssl":1016},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-01-03/261eb9d8b19d96384a9e6bf6b01725d720250103130027623.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.126Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-01-03/261eb9d8b19d96384a9e6bf6b01725d720250103130027623.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":8923,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"f9783842d41a1c7165e1f27a0b85b61b","sha1":"5b0eca03f83a17090008c609c5dd2e60f91ceeba","sha256":"e326966fbefdeb0dbdd9173a32801ca395ad0c1f84d762fcba74efdfaa844d32","sha512":"7ecb81ab53aa890eaa23ad4b198d0949f992c366b574f76d912529082d4d86484af178614e9fbcab486916126fa0792e1822536d8b3df5c36aa3070f617212e5","ssdeep":"192:WSEpytseytDq/+M3mBndr5gKCRki1VAkr6aZfsLvkAef485:5Ep6shtDIOg3RkivAQ6cCvktfN5","tlshash":"f102bfca1a193d74fc6681a5e1873e7f4570bd59cb84b4a8c80d7f71688244f594cf46","first_seen":"2025-09-13T12:19:18.530717Z","last_seen":"2026-01-05T17:40:40.55626Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1767,"timings":{"blocked":896,"dns":0,"connect":0,"send":0,"wait":871,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20211123/pomu65733347299.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.193Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20211123/pomu65733347299.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxN7ZVAiFxd7dh71Wa3_ZZqIbzKNKopQQ74rDpmVwHngYZvC9lXCdyzC28aiYDkFUHyA\r\nx-goog-generation: 1729754899488222\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 2655\r\nx-goog-hash: crc32c=Eq5rHg==, md5=c/nVuwPs7KsSQ9qwzmYbkQ==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 2655\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:55 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:55 GMT\r\ncache-control: public, max-age=3600\r\nage: 1149\r\nlast-modified: Thu, 24 Oct 2024 07:28:19 GMT\r\netag: \"73f9d5bb03ececab1243dab0ce661b91\"\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]}],"data":{"size":2655,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"73f9d5bb03ececab1243dab0ce661b91","sha1":"fe1effab1d0550d927d01ab78e3092e118a18d8b","sha256":"845bd6cf512aeb831b302e740e80d16ddf606e2d85c071e69755b2704b4e44e1","sha512":"a45a0021f9f5171e73a722fd451093c09442a6e99c12e8930a42802d257775249add7656cf359b59e56f6cb5193e43a31fc82a9dc5e98bd7f6a7592db615bd49","ssdeep":"","tlshash":"ac515be4d9d31069c7ea4271a37f80237fa791715584836ed90c301303b7a4cc42396d","first_seen":"2025-09-13T12:19:18.569505Z","last_seen":"2026-06-01T01:23:31.989651Z","times_seen":5,"resource_available":false,"data":null}},"time_used":295,"timings":{"blocked":251,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/node-forge.CDxHW0a1.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.488Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/node-forge.CDxHW0a1.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":282038,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"da91b632d15a2000c026aaf4b28ac4e7","sha1":"f784d108a7827dcae17df6178c6b1936e1ae0050","sha256":"82c1c8ccb1e189a2f841081ac5ade2e60f7aa83743c4df7a1626b94bd60b1e5a","sha512":"9bee5f2b3452fc1368d562d808e93a4f5ec2971a2d8a4877b5781ed600b09ac79b91ed47d67895684e783d7d4526bfe9e3531c4d0908f406e5b94b0a303e9c22","ssdeep":"3072:hUkElpRjQRnFR3OkKXUZXuuEyL6AUaBlnpew5FQhO5GG:hUkElpRjWnFR3AMEyLp5npew5+hmGG","tlshash":"3354398436b078f043b352f7182f814bb135a519a42e4925f964d8dab9bcf9cd13eb78","first_seen":"2026-01-05T17:40:40.557932Z","last_seen":"2026-01-05T17:40:40.557932Z","times_seen":1,"resource_available":true,"data":null}},"time_used":230,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/pako.DwGzBETv.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.660Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/pako.DwGzBETv.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:27 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47570,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (47569)","md5":"223df3d75a8ca0911b0cd3b206353372","sha1":"b49f3161f11b56d1bcf9bfbdd37a14b7f9bd2799","sha256":"81607342b01f22641ebf3b71a73ed3d141172c305efdf9058a98d334bbff8b33","sha512":"a8010373cc31d31a4c12ccabc2e9d8bc9efa3fb0fd70791ea67da55e66ce39291d1b27ed77963502315e916bad8a23e322bbf2866445ed80c6918ec912abfa22","ssdeep":"768:KSPqQg09Gl6rmN8NOzsgn975TMjhriYWfo/WoPnDQLcO8TX3/5/EX30MaBdrgB+D:6ujhusxdrM+3ZPvn6+G0SPgn","tlshash":"fd231ae321e315491be41cdc86870aa2577495311c0225b8f27ddde538b0adbe2bbb7d","first_seen":"2025-11-20T04:33:33.606775Z","last_seen":"2026-01-05T17:40:40.558726Z","times_seen":2,"resource_available":true,"data":null}},"time_used":368,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":368,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/pinia.Bp2oHvSE.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.463Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/pinia.Bp2oHvSE.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 2004\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3898,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3668)","md5":"8d133b0628c08dd038e0305ed548736c","sha1":"5f5e2dd9d7880e89d06cc4c9c527c299f72fbffb","sha256":"6606918a952f7ff6ab668de0c9f55e446fb4f39d5d8a27f3788fcfa7a18e2d96","sha512":"5e6ed5e2ece297d04a8efbdb2f0dfd7d72b3961d6b5f10d8abd33c3bd54b978c3b4138be343b0489cfdcb087e9010bb235983be52e4dc98c2b9c99901c89824d","ssdeep":"","tlshash":"4581b6ad36e1b43c5bba04e8013f6829e3776148305b98d1b25daaf5383204d665bf6e","first_seen":"2026-01-05T17:40:40.559551Z","last_seen":"2026-01-05T17:40:40.559551Z","times_seen":1,"resource_available":true,"data":null}},"time_used":231,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/favicon/nivex-pc.ico","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:56.401Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /favicon/nivex-pc.ico HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-type: image/webp\r\ndate: Mon, 05 Jan 2026 17:39:56 GMT\r\netag: \"695b18da-21ff\"\r\nlast-modified: Mon, 05 Jan 2026 01:50:18 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: UPDATING\r\ncontent-length: 2072\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2072,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"3c52ac60d773aeefe02312b6ea43f21d","sha1":"cfdbd4f53d7c944351097c5551a22ff574ddb9f2","sha256":"25b56ab81cc90cca1dea2f5ed969a488eea75c15fbcdfa410795bcb20d4682aa","sha512":"30d2f95a9906c82692529cac86da2194bd34f5086244858c332ea35265a253596cf5acbef07e942c995083391e33235a6328860cbc5dbd6938802d8661a05d2d","ssdeep":"","tlshash":"01414c5e3988a36ed4cefd59b91671bf4087dfb44a4f42e5f00114204bcb1de00dae42","first_seen":"2025-09-13T12:19:18.468514Z","last_seen":"2026-06-01T01:23:32.026453Z","times_seen":4,"resource_available":false,"data":null}},"time_used":270,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":269,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@vant.B6-Gj5Kj.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.853Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/@vant.B6-Gj5Kj.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/price.BpPWlJRd.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: \"1767634797\"\r\nlast-modified: Mon, 05 Jan 2026 17:39:57 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 1737\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3643,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3642)","md5":"80e4a6f89ac48be6964159719b3b1a8d","sha1":"bd14bc19fd207a2738cbdf2116c4af2682b6adbf","sha256":"0bfaa40a67a1e3e4acba9434961a8aa378e2742623324d067c35248267bd4f19","sha512":"b6e24f2d02c37fc8765a25f47fdf14525611e4027c59c3635c5d4c669d9c4f77de6a463a1ddf1c4ce0e38d5a3dacdfa25ba47f669cac03db0ab798c780697eed","ssdeep":"","tlshash":"bb7184ec3641b534c3694ee1007f97a5b21b6a2470cbc8a0e018ed193935ca192efedf","first_seen":"2026-01-05T17:40:40.561117Z","last_seen":"2026-01-05T17:40:40.561117Z","times_seen":1,"resource_available":true,"data":null}},"time_used":323,"timings":{"blocked":93,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20211023/jMEt87852911215.jpg","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:03.944Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20211023/jMEt87852911215.jpg HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxP79RXl5fl-qAuRsyunYZHpZOYn-TYc6X-9xvwoPCSTioKtJ-AqcPGeUdcRdp0lRi5h\r\nx-goog-generation: 1729754943457037\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 4988\r\nx-goog-hash: crc32c=2bJDlw==, md5=tayORl4yyCkPWPxK66juQQ==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 4988\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nexpires: Mon, 05 Jan 2026 18:40:05 GMT\r\ncache-control: public, max-age=3600\r\nlast-modified: Thu, 24 Oct 2024 07:29:03 GMT\r\netag: \"b5ac8e465e32c8290f58fc4aeba8ee41\"\r\ncontent-type: image/jpeg\r\nage: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":4988,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 97 x 96, 8-bit/color RGBA, non-interlaced","md5":"b5ac8e465e32c8290f58fc4aeba8ee41","sha1":"719e5cfa5ed95e7ebd3da8f08790021610cab54e","sha256":"d16644a224deb9b756b797028e4eb1e8bd21b09e59658e48e48cd9d137f2845d","sha512":"f606f68fd1ab772a33f18df25d56246cd7feea1fda3fad87317106700c0280e52a0213c101dbd3375b6e0054da4d8966af408e94384964e1132aabd4110edbe0","ssdeep":"96:OeEcrNjAcvAnLbg67fvqgD+Kq1HoaWdMz3VpmTDto6/7DHyb5CPYhIeLkc2sf:OcrNjAcvAL17DqKq1HlWKTOTlzVP7KF/","tlshash":"1aa19ec62a42193cd9e7be7f77465338385ca88247b00b25c264ed09a3249c7cf17e5b","first_seen":"2025-09-13T12:19:18.478487Z","last_seen":"2026-07-05T04:53:58.158212Z","times_seen":6,"resource_available":false,"data":null}},"time_used":2457,"timings":{"blocked":1062,"dns":15,"connect":25,"send":0,"wait":313,"receive":1,"ssl":1035},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2024-11-15/6f390d17257f0a0a2495cca2547ec61e20241115170402211.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.014Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2024-11-15/6f390d17257f0a0a2495cca2547ec61e20241115170402211.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":12692,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"17439f9d41b4e35b5868e862202551ae","sha1":"da7ee5a944ba6213e74cb6704eb8c9302e1230ee","sha256":"872485c75d504c663bedce51102308bdb3e75e6d301096f1f702277568924457","sha512":"bf4be7a608d12038ccab918cd6b03321891762c19b5e2702681ee0273a77f662e4b8f263036302fc54e303f0b3e403d161c8a2ddbdc5ce03dbd4b8d9b8ddc61c","ssdeep":"384:SRAALEJQPTG1jPQ2wlhm5eLWYkaatdGrGy:jA4oS1ilsRYkOrGy","tlshash":"b542c07cbc117079d3be8307840678815b07369a4377784af7644a843de78ea767e079","first_seen":"2025-09-13T12:19:18.519639Z","last_seen":"2026-06-01T01:23:32.044263Z","times_seen":5,"resource_available":false,"data":null}},"time_used":3214,"timings":{"blocked":1062,"dns":24,"connect":13,"send":0,"wait":1041,"receive":0,"ssl":1062},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-01-03/d7e0ed5c635f22796c5121cbea8a2a6320250103114207197.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.175Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-01-03/d7e0ed5c635f22796c5121cbea8a2a6320250103114207197.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":2759,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"52a1de4cc494d3443f6516e4d5881ab7","sha1":"81e232a80cd1cef227ed48129d227b15b85798cf","sha256":"e7d201a9fa29a56b900f8f51c54c59067a03c84d53a232cfd97f85afde302bd2","sha512":"9fd6c721f020bf6d46d447b62033bea5298e1788576f271943f5bb824b3c28a96bcdcb167a20d6df4028a472744102f80ebe88dfea071ce0f69a0a7946821e03","ssdeep":"","tlshash":"c7514b9e27489d35a393c825e20a8751bfae6073c923c47893743934b1d276e14c2e92","first_seen":"2025-09-13T12:19:18.515918Z","last_seen":"2026-06-01T01:23:31.905293Z","times_seen":5,"resource_available":false,"data":null}},"time_used":1924,"timings":{"blocked":848,"dns":0,"connect":0,"send":0,"wait":1076,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/axios.xsH4HHeE.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.502Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/axios.xsH4HHeE.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:32 GMT\r\netag: \"1767634592\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:32 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35296,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (35295)","md5":"6ec5b0cb135a8c8509976ba1b11b91b0","sha1":"d110960ab1a5b3b5b5da02ee2e8bac9953853401","sha256":"806129ebbeddae98c7deabde091a2207f6796065e2f909ff678c38531904b3f5","sha512":"4d3ea7f2057cae3179b9be7a071ae7867eb4bd5da5d8d02dcd8d7161c1845da28667d47b019e78cc82a73087b9c6dea8de01f8d5d3d0fee8626ec43197dab64c","ssdeep":"768:iFtGlRBc6ai9SbTKLA4h4dozE+ILLbMNzS5+aNBHGDpIOE6A7ORqmsZccKhDFB0r:i/GM/8UVsiYpO86x","tlshash":"22f218d5b6d2b06243eb61f5406b0902f3399925784d84b4f1689ceb3db600a97bbf7c","first_seen":"2026-01-05T17:40:40.564249Z","last_seen":"2026-01-05T17:40:40.564249Z","times_seen":1,"resource_available":true,"data":null}},"time_used":405,"timings":{"blocked":174,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/bignumber.js.JTMmK3Hb.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.512Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/bignumber.js.JTMmK3Hb.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18639,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (18638)","md5":"ec4a76408c5691ee8b2195786f7302c0","sha1":"e486b819669db664ec917a53d7648bfd9c7cc889","sha256":"0873639c6b478e97e3bfc4b960b79c38a44df3bf6e41d51c097a23a602eafc5f","sha512":"b2e4c7c97a281029ddfcde88a4f693a9795f4c74d14fcb635985da50d9299e6e75cca56634c83dccae874cc9f0cc998eed3cd1bc5f19fcfa10027b6cc6a81dbd","ssdeep":"384:4AJ98BMyDKcfcUXuELInPM75k31vjjRMM9iosRAdGJd7tP:4BMyeS+lnPY5krMM94AdGn7t","tlshash":"c68229d874abf09942fa34c000eb9446a239ef4aa84c5876f1509595bc35dcb93bff64","first_seen":"2025-11-20T04:33:33.6258Z","last_seen":"2026-01-05T17:40:40.523876Z","times_seen":2,"resource_available":true,"data":null}},"time_used":618,"timings":{"blocked":386,"dns":0,"connect":0,"send":0,"wait":232,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/charenc.3b3Gq7bi.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.473Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/charenc.3b3Gq7bi.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 544\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":1102,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1101)","md5":"f99cedee990d3d53b9111ead4b758c5e","sha1":"92422d8844605fbdde92d28b4d17a99c78f5b72d","sha256":"de2b1aee769eb7a7fcad13c1629aa1f54c539ea396f62e6bfc4b438f8819d26a","sha512":"ba4a2faef30a8ab083fcd715da43ea0e1a9d5197821cc6596b55f764726473158ff20e6cecb781551060179726182414d17fdaa08f81c35f9faa12f1c85ccf05","ssdeep":"","tlshash":"bb11605970a0e0e4c3eb04290a3b300bf16949b502be98c0ebaac5f05ef824e5136f69","first_seen":"2025-11-20T04:33:33.582521Z","last_seen":"2026-01-05T17:40:40.565285Z","times_seen":2,"resource_available":true,"data":null}},"time_used":230,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/crypto-js.BH2pn90r.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.669Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/crypto-js.BH2pn90r.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":69877,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (30402)","md5":"db0597f008285a2a858f0b7fe15b2d19","sha1":"27c621d9cd3d793df519c651c1168f32b3ceff88","sha256":"98efa226698a1d9bf8682d4ae907802fa30e67f6c86817a0d63b420f83d70e76","sha512":"1029b202b5070647cdcb9f82fdc136318d7648fc45c5990e281e8c41993499651ea70473e6fe5e855cfee1ab4db06cd4c02545a57698b84f062278a3b9a21e76","ssdeep":"1536:dQtqIbmLNBJuZ2prjJJXEPtNPU9ArHMhnt:d8KnoZiZnt","tlshash":"9d6349c636d871c1a3a734e0093f204fb1773462095c99a8e565fade6cac5dd807ad3d","first_seen":"2025-11-20T04:33:33.565087Z","last_seen":"2026-01-05T17:40:40.566065Z","times_seen":2,"resource_available":true,"data":null}},"time_used":403,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":403,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/lodash-es.DjvwQNwl.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.711Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/lodash-es.DjvwQNwl.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:32 GMT\r\netag: \"1767634592\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:32 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26056,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (26055)","md5":"914cd6b15467109d952e5e8758bc6d5a","sha1":"27b6464b7ae83a587a8e5b20c001257eaa0f6473","sha256":"16b6b5b2d1ce3c72c3a847d9a45e3f583457919e9294d8e46e80957a368a164c","sha512":"80225a56d72e41db61c83b0de3429495637f12f61e7b98efd0e7963bb2aabee2460d67d967f1cc72fee80e9d995aebe0799e26fd05347c80e89399de82d5537b","ssdeep":"768:lIPKQJhAOwwe+geEXlrT8AFyZ2crpgJRpRTe5koU5qn7iqNf:lHQLAp8geE1rT832cdgTeCoU4n1Nf","tlshash":"8fc285c875d3f06143a6687480af180bf23c7c64948fe450e1e6d4dabd7916ad673e3a","first_seen":"2025-11-20T04:33:33.689794Z","last_seen":"2026-01-05T17:40:40.566939Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1183,"timings":{"blocked":885,"dns":0,"connect":0,"send":0,"wait":298,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"wsv3.nivex0.one/?m=Z7nbRYiLbQG+ID4kOsOflbZU+y0klEw2VF3Q8rdZm89KMF4yea71PF2Hjt+Vei3rH8DDbGAwPvw6TWtHFUk5Q+apfdc=\u0026k=JIFHKFDJRJu0DV2V92me","fqdn":"wsv3.nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"172.67.159.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:00.852Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nivex0.one","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 21:49:45 GMT","end":"Mon, 30 Mar 2026 22:47:22 GMT"},"fingerprint":{"sha1":"F3:75:42:AC:F4:B1:7A:7C:E8:04:E5:D0:28:3D:F4:39:81:43:13:7F","sha256":"31:21:32:21:BD:A2:A7:26:01:57:E2:D2:82:7C:27:AA:B6:20:97:FE:42:7B:00:B3:42:B2:66:33:59:46:80:FA"}}},"request":{"raw":"GET /?m=Z7nbRYiLbQG+ID4kOsOflbZU+y0klEw2VF3Q8rdZm89KMF4yea71PF2Hjt+Vei3rH8DDbGAwPvw6TWtHFUk5Q+apfdc=\u0026k=JIFHKFDJRJu0DV2V92me HTTP/1.1\r\nHost: wsv3.nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://nivex0.one\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: IKneyx9UeI7KbN2Y0Z+1xw==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nDate: Mon, 05 Jan 2026 17:40:02 GMT\r\nConnection: upgrade\r\nsec-websocket-accept: Hm1ivakOOldTboiHnNh8fSBRJes=\r\nsec-websocket-version: 13\r\nsec-websocket-extensions: permessage-deflate; client_no_context_takeover; server_no_context_takeover\r\nvia: 1.1 google\r\nUpgrade: websocket\r\ncf-cache-status: DYNAMIC\r\nReport-To: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=5k4pVt2KnTXdrQsK6YBdGKiRnVD1mhmtF9WXsNYA2LaNnpyTCUraHxXMUe1MUqKgxsC1P2BJVdT80H817BB6fHKTBpNey2PqLtke%2FNZVDMARd2eWWJexGjP7rPCE43vEJNw%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nNEL: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nAccess-Control-Allow-Methods: GET,HEAD,POST,OPTIONS\r\nAccess-Control-Allow-Origin: *\r\nServer: cloudflare\r\nCF-RAY: 9b94c221a9f60b3d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=747\u0026min_rtt=595\u0026rtt_var=361\u0026sent=5\u0026recv=8\u0026lost=0\u0026retrans=0\u0026sent_bytes=3105\u0026recv_bytes=1269\u0026delivery_rate=3857904\u0026cwnd=252\u0026unsent_bytes=0\u0026cid=a8a1745fe4f6230e\u0026ts=1254\u0026x=0\"\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-10T23:57:25.058416Z","times_seen":17827247,"resource_available":true,"data":null}},"time_used":1321,"timings":{"blocked":0,"dns":31,"connect":32,"send":0,"wait":1238,"receive":0,"ssl":51},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"wsv3.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"wsv3.nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"wsv3.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"wsv3.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"wsv3.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"wsv3.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20211023/Nz7n87894017791.jpg","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.026Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20211023/Nz7n87894017791.jpg HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxPDhzbkDj7IqB9wI9pJPL0dcOlW_8LcNQpEk_C_6JaGxukqXr70pFzaj8WuGPqrKlNVYUtvatQ\r\nx-goog-generation: 1729754946813685\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 5829\r\nx-goog-hash: crc32c=I8OsmA==, md5=pFxcZMzRrutdkrJlM1K3nw==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 5829\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:29:06 GMT\r\netag: \"a45c5c64ccd1aeeb5d92b2653352b79f\"\r\ncontent-type: image/jpeg\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":5829,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"a45c5c64ccd1aeeb5d92b2653352b79f","sha1":"b6e9f437cb998dd7233e418e7ede76f291a36443","sha256":"4d5f683e241b8ebb8ba414af994671210f9e1decadca2ffe242cbd89dcf242e3","sha512":"a264f851e1a3981b2c009f6247ade625b5eb6fe9d3c5166046b5760e6ce26160ec908fd651c57956d616a3b9bb1cfff84f9a44af8bcf5db48f7f6917f8686741","ssdeep":"96:lPwawYbTcvORGwmrWd7NqGKDLCMCLZDS5ZGoUu14qV+KHJ+B:6a8vYCrWdZqDyNMZGoUu1l+UcB","tlshash":"e5c18dc589aff842c5d6d1b8021fd2f96204c1fbde006e79e5076d27802e2ed76865a6","first_seen":"2025-09-13T12:19:18.503907Z","last_seen":"2026-07-05T04:53:58.435164Z","times_seen":6,"resource_available":false,"data":null}},"time_used":429,"timings":{"blocked":415,"dns":0,"connect":0,"send":0,"wait":13,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/zrender.DwG-h7oT.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.527Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/zrender.DwG-h7oT.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:30 GMT\r\netag: \"1767634590\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:30 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":214266,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"b46207bb80862051ff9dff8e4c12d350","sha1":"c15f15f23a7bf099cd4c265a666cc9a002233a8c","sha256":"dbb0bad1c1c12ceb3b958243a95f04c6f8d7316577dc6a2fd5d852fcaafc1015","sha512":"bcd7c67abc4adb8883d7e62f1ac4a2be48b3176b93eb061fd8ffca93c237fd501144af28a9455c462f0dcfce86e7b6367a933934d34ae052f7dd7be4c8285507","ssdeep":"1536:GS8VezpdXBAsNrzwMi4Sz0w62BTPuJ9I+b5U5eZhx8XlJkTYLYwFTXM6bJ1X3HOK:bzuDSJ9Xb5UYZhx8cWFTXM6bJxYA4a","tlshash":"e024e7d872517025839366e0453f150fb33b681ca80e896cb669e4ee2cfd48d267bf79","first_seen":"2026-01-05T17:40:40.569073Z","last_seen":"2026-01-05T17:40:40.569073Z","times_seen":1,"resource_available":true,"data":null}},"time_used":708,"timings":{"blocked":423,"dns":0,"connect":0,"send":0,"wait":285,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/css/price.DTkFRU4a.css","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.009Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /css/price.DTkFRU4a.css HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: text/css\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: W/\"695b1917-175c\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:19 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: UPDATING\r\ncontent-length: 1467\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5980,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (5979)","md5":"87912d64db9f55135bd1616e431217c8","sha1":"de2b29d0c6cdd61689970a6e57692d1ebef2a7f4","sha256":"179a3e72e05a2a859b61a796a1c1d001f3462b8614248d0b987ebc943e4eb723","sha512":"751e021b860f06db0015afa3c2865cd84e199f9c8aecaa81ec1c7612cf0deff79e503d6a930220be3a9d2869701850f83fa99dfc50e381b9f2ec05cb60655893","ssdeep":"96:pvnTkK5iMj0h8PTE7FxYdExp9998OEfadM:mK5HjATAM999RdM","tlshash":"61c1cc23f20e2486a23bd44760ac57bc6cdc6313eeb31e3655636636ee571872364b4b","first_seen":"2026-01-05T17:40:40.570066Z","last_seen":"2026-01-05T17:40:40.570066Z","times_seen":1,"resource_available":false,"data":null}},"time_used":242,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":242,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/png/Group%201533212145.CXohpSx_.png","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.347Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /png/Group%201533212145.CXohpSx_.png HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/css/index.-a00dYCq.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/webp\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: W/\"695b1916-1d34\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:18 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: UPDATING\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":11054,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"35a043d5c4c09c5ba6dcd3f56d5efd5c","sha1":"d4c1c806dcd36a41c192e7c794459f2b965d67c0","sha256":"f54089fda8cd64765f496aa7e2410dd249d5fe4f0c4e63ec2ce7795716d3d347","sha512":"b56f99e43e7e4913aec6233be2058eebc6b4dc7c0e284ccfb85525620b024c221d8b574503af364f4e0a2403650aa9d7ac82fd1f26bc06858ec67d745a330559","ssdeep":"192:DBOg4w5I2E+fKaUJeVYK6p35555555555555555555555555555555555555555H:z75riXGYKqiH0+Ip","tlshash":"303237b9053da840c386747762ba582ebb3bf11ed53e38d84565e475c4018823f12dfe","first_seen":"2025-09-13T12:19:18.556086Z","last_seen":"2026-06-01T01:23:32.101124Z","times_seen":4,"resource_available":false,"data":null}},"time_used":681,"timings":{"blocked":197,"dns":0,"connect":0,"send":0,"wait":484,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20211023/7la188041551281.jpg","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.079Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20211023/7la188041551281.jpg HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxPQfkjikvqdcP5GTgCSyrCTHFeMlNPXMvlJ-9ZOcCalgJ4xNT-TXoBHmWSC6PEzmXhR\r\nx-goog-generation: 1729754945171824\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 10513\r\nx-goog-hash: crc32c=qXNg6Q==, md5=w0nLU+o7siW7NdYCIXI/TQ==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 10513\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:29:05 GMT\r\netag: \"c349cb53ea3bb225bb35d60221723f4d\"\r\ncontent-type: image/jpeg\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":10513,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 97, 8-bit/color RGBA, non-interlaced","md5":"c349cb53ea3bb225bb35d60221723f4d","sha1":"95c366edadb55227d6772eca30edd66d903b42b7","sha256":"6d64ca7d6c3627459577a3a589cb80b256deedc06617d33ab834c0f6c86a77d9","sha512":"d034c675c38b45d5408de619c5a871a30ffc55affd9efdbf8e82817743ee497e160df573f15b29c72e95ef6bfc984e478e57bf4507d106af3de8bf6031a6a84f","ssdeep":"192:1n/2tsQCdaURpu8JKTB2Or49lSzbHr0xQrCnZEJcI7u2ppPj:1/2UAmJKTzgIzbHr0QcpiPn","tlshash":"e722b0c5b928bc89ae1b48b6b743d6063b28d6d0c5823575762ec3cd4e038e4b787825","first_seen":"2025-09-13T12:19:18.557079Z","last_seen":"2026-06-01T01:23:32.021664Z","times_seen":5,"resource_available":false,"data":null}},"time_used":389,"timings":{"blocked":363,"dns":0,"connect":0,"send":0,"wait":25,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-01-03/09333aa0d99d40f39255fe117e229f9f20250103113113977.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.097Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-01-03/09333aa0d99d40f39255fe117e229f9f20250103113113977.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":9022,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"7b7b6f678ac2d5156529c9a54fd25849","sha1":"b46b9f9463bcaea9aedf7f5d29d8c46275fd9560","sha256":"39758ec020a58496ed43996e4164edb1fab35af47758915c97b7430bcab2461f","sha512":"2f496d11a0814f0ad58b7004ee0b4fe64d6abbf518882dda323eb1567a4e07060788bc4da868b195e087a3d97f9e9ce3c52f6a741a04b7b1c9453ed49cf8e7e8","ssdeep":"192:WSDbVNkgLu69eOVd5iHI/rucg2XGPNvL+VfRLie:53kKfood5iHIjup2XNfRL5","tlshash":"a312bfa4177c5419d50a4bff89eef9203c09756f01ff259e393961ca1c23f8256a11ab","first_seen":"2025-09-13T12:19:18.534692Z","last_seen":"2026-01-05T17:40:40.573198Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1811,"timings":{"blocked":923,"dns":0,"connect":0,"send":0,"wait":888,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-01-03/1850c01b1c33e8ad108a046854d1d32620250103112507002.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.195Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-01-03/1850c01b1c33e8ad108a046854d1d32620250103112507002.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:06 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":11835,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"949cddb817bca3171a9b4b761afe50c2","sha1":"4d2da02a2eff786318c775ba765266a26f8bacb7","sha256":"985ab971efbe310f9c82a3bec1ede4be00242366eb390b3c040d511886c5024d","sha512":"a22bc2a91eba74629fb48043e38c16b67e6001c569a7b0c6d8cf7f28192f2ef17cea0246c9cde3eb599ac204a975656903c2d4391b68ac15fe3d1668a249c7c7","ssdeep":"192:WSJNoEP+knenQP/EpJY+jSNZo45bcsFWsMsHX0+xsCwjMIUPdp2+HuQbVjrxPE:5jhfFXEPvjSNCkbA+b6Cuk+IbhxPE","tlshash":"dc32bf13533863c026d99518cae13c3959f84b45f3ade1c8ca6eede6985772c5092e22","first_seen":"2025-09-13T12:19:18.498495Z","last_seen":"2026-01-05T17:40:40.574024Z","times_seen":4,"resource_available":false,"data":null}},"time_used":2140,"timings":{"blocked":830,"dns":0,"connect":0,"send":0,"wait":1310,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-01-03/54563ec9d8359f9a61659cc34a8a4a3c20250103130740246.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.201Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-01-03/54563ec9d8359f9a61659cc34a8a4a3c20250103130740246.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":4332,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"6e04101cdd85648706f91d5dd89fb0f5","sha1":"4d69eb44315804033a661842b363605e266ca427","sha256":"392759da452ff870eb686ff6dcfe6ef5f64059352d422ee75e72bb3754781cf3","sha512":"bf83fee3332e990ec34436a8aabb515ee352929b9cc43e9762e74a51dcca78fe702da7b3d355c0074c7b0587bd3a6bb5d56d279409ced10ee9b869b92fd8df8e","ssdeep":"96:WSAvp0TMlVHQWU7fDQ+t/3jETpQtJvhu37JLgdDE0SFejkzFWnw:WSsnK73fIqtJvhuFfTzFR","tlshash":"57917dbc6b590fbe01b229b359b5b8874d010df12779d8123569ca72062f8be0a6e1e1","first_seen":"2025-09-13T12:19:18.587002Z","last_seen":"2026-01-05T17:40:40.574994Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1820,"timings":{"blocked":827,"dns":0,"connect":0,"send":0,"wait":993,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/axios.xsH4HHeE.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.688Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/axios.xsH4HHeE.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:32 GMT\r\netag: \"1767634592\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:32 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35296,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (35295)","md5":"6ec5b0cb135a8c8509976ba1b11b91b0","sha1":"d110960ab1a5b3b5b5da02ee2e8bac9953853401","sha256":"806129ebbeddae98c7deabde091a2207f6796065e2f909ff678c38531904b3f5","sha512":"4d3ea7f2057cae3179b9be7a071ae7867eb4bd5da5d8d02dcd8d7161c1845da28667d47b019e78cc82a73087b9c6dea8de01f8d5d3d0fee8626ec43197dab64c","ssdeep":"768:iFtGlRBc6ai9SbTKLA4h4dozE+ILLbMNzS5+aNBHGDpIOE6A7ORqmsZccKhDFB0r:i/GM/8UVsiYpO86x","tlshash":"22f218d5b6d2b06243eb61f5406b0902f3399925784d84b4f1689ceb3db600a97bbf7c","first_seen":"2026-01-05T17:40:40.564249Z","last_seen":"2026-01-05T17:40:40.564249Z","times_seen":1,"resource_available":true,"data":null}},"time_used":569,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":569,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/pinia-plugin-persistedstate.Cat8D07D.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.500Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/pinia-plugin-persistedstate.Cat8D07D.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:31 GMT\r\netag: \"1767634591\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:31 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 790\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1522,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1521)","md5":"e44341588f7509c4a04f35785816764e","sha1":"8ac440a8f1bdb71f8679d37c5945f1510e82533b","sha256":"57d71e73e2860fd8db96652f840a7d3589e034ec0549cfd0ef8269cf986040c1","sha512":"f6433abd4f1fa9a294e09bd6622324a118dd61e4ef310f2dce79fe7f52d0ab0753e05b7e5c19d3aa1ddb4de2af82c6efddc9dfdd9c872bc16a2c6c74fd2ce1a2","ssdeep":"","tlshash":"5131758c11260d3151b634dc58eba5535131815f1f1ccba0e4aa5fe47b5458acf1fcce","first_seen":"2026-01-05T17:40:40.576323Z","last_seen":"2026-01-05T17:40:40.576323Z","times_seen":1,"resource_available":true,"data":null}},"time_used":402,"timings":{"blocked":171,"dns":0,"connect":0,"send":0,"wait":230,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/wssocket.BsRiRgr2.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.837Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/wssocket.BsRiRgr2.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/price.BpPWlJRd.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: \"1767634797\"\r\nlast-modified: Mon, 05 Jan 2026 17:39:57 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 888\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":2046,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (2045)","md5":"03c93349a41ff5cf1f841b3a59bbac7c","sha1":"ffb0e6be5bfcbe08474f0602ce1ba3c7cc54bd47","sha256":"e9e2f505e913d2250b626a4de815ed597c91188333f578036e7c9c550ea71ff1","sha512":"7b070b2c4eb7983c6b6263f410159cd217f085ff77703392f7bdc89fe19380bbb58b3ed4a0805e4c31616ea10204726007bff6e3e2183f3abbc85434e39079ca","ssdeep":"","tlshash":"1d41118d7177629552f3d294148a4d05b12979690e0e101d7abccfe2bf2ee89b3a1f38","first_seen":"2026-01-05T17:40:40.577133Z","last_seen":"2026-01-05T17:40:40.577133Z","times_seen":1,"resource_available":true,"data":null}},"time_used":229,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":229,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-11-27/e90dd670167bbd03501e49e749130a5220251127225815597.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.107Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-11-27/e90dd670167bbd03501e49e749130a5220251127225815597.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":110123,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1948 x 1912, 8-bit colormap, non-interlaced","md5":"00f2f5a8674e8023e1c13f0a80b2109a","sha1":"c54987636e7c0a40931447612ea0b953ff4dbed3","sha256":"60e50e47ff7a0f65d1d640e896e83e5a9ec90a70afbb95e0907e72a7d35243cb","sha512":"8cb2c0ef0ffedcf250fd02d38238b363d662b442d25260fabb17f33eaba5251b6d630607645b2b0b33a451ac842ceae9e0c36e8855a99748907b685349dc694a","ssdeep":"3072:sSveZ4lhG+HyS3otRVLIUZmRXPceqmleJUb07dksC:7veZuoS3ov+RXPa0mUb07dksC","tlshash":"b8b3129e68804d47cb6e84c15f6cd5f3d1ae1ab06b0012ad661cb44730fcaf68e967e6","first_seen":"2026-01-05T17:40:40.577876Z","last_seen":"2026-01-05T17:40:40.577876Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1969,"timings":{"blocked":914,"dns":0,"connect":0,"send":0,"wait":1055,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-12-09/77d15e1f3310990825349632c81146e020251209143552172.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.159Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-12-09/77d15e1f3310990825349632c81146e020251209143552172.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":14532,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"e9b7d6fd4ec59d703ebc05112067ba7c","sha1":"afae2445e3cf852506c70869841ce27026f4976c","sha256":"cfa9e2642318223f27281064c232fe5c6c27992dd610a143226ebafe51b171e0","sha512":"2b06efd4f6a39cb38db3d3febb04dcaa6dd4ce5c4a0205b276f3a6a24e006296ef113f5f020816ca238d8c96214a220a57ee31a9439c76f8f5b7aca8a6d73a9a","ssdeep":"384:5DGcDgQ+HzjzzfyMOzu5lrMM4WTuI//8ul9sROVipziiaB3QpMeb7PBmG5ZBx:VGIazzfyPmBuouI3bZgzvaBApMen5mGD","tlshash":"7e62c043abc4b76683212a6e6e625ac2e9fbac52c0dd21ccc544e02699bcf55f24d064","first_seen":"2026-01-05T17:40:40.578829Z","last_seen":"2026-01-05T17:40:40.578829Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1884,"timings":{"blocked":862,"dns":0,"connect":0,"send":0,"wait":1022,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20210729/dRfl06590328905.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.173Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20210729/dRfl06590328905.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxP-FLMBvxkKYeESwXZZjkC3OHm1ka0tp10ZFxNzz4NgwjHpMiTC3IQk9SGRngHgNVJj\r\nx-goog-generation: 1729754904144308\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 5356\r\nx-goog-hash: crc32c=JWRNdg==, md5=/depeLrd2QHUwj5LDgiEvQ==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 5356\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:28:24 GMT\r\netag: \"fdd7a978baddd901d4c23e4b0e0884bd\"\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":5356,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"fdd7a978baddd901d4c23e4b0e0884bd","sha1":"d97be0a580f05521f0b8dd7cb46f18f516a810d0","sha256":"d2b76ae8ed842730d8fad18d3535538f005229263b0c8e9faeb1e59f5ed07bda","sha512":"63e81440d5416c11648b13ecf736ae67e63bd58fcdce65af750e1ac19645825426196c5575db9ea5bc7ad50bc069197399ab3b510285e8e6aa01dc8eb5f09700","ssdeep":"96:lPww8cEt/MyJT5boQXvqFjfTEVe3QQqSrZ9rfQukQ/4rThLZ7:64EtEyJTXvqFHlNkWO","tlshash":"90b19d4abd94362bc30a64f3e4057b242639454ebb47384686365df78bdd9ae0404fb3","first_seen":"2025-09-13T12:19:18.566737Z","last_seen":"2026-06-01T01:23:32.107507Z","times_seen":5,"resource_available":false,"data":null}},"time_used":307,"timings":{"blocked":269,"dns":0,"connect":0,"send":0,"wait":37,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20210817/vq2v02544535468.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.187Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20210817/vq2v02544535468.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxOy0H58t3DF3PsgK17lX_RWJO6KdJpco_YWGCRR-utL8Th03MPRCESU3VP8_udIsX5gwwy_1Uc\r\nx-goog-generation: 1729754956157974\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 6483\r\nx-goog-hash: crc32c=eXAbxQ==, md5=3q3GliLrt5ZPF4tnrsYjAg==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 6483\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:29:16 GMT\r\netag: \"deadc69622ebb7964f178b67aec62302\"\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":6483,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"deadc69622ebb7964f178b67aec62302","sha1":"021063d1bf4f6799989c5afc6ef8f58ee0626199","sha256":"cf92efd02fe3d0b9277f7051d5d29e5b873fd4fc37db15bbaa62c4d8e74db630","sha512":"b733bd5d11f56bbd6f87bf7bb88ab64a2430cbd3808f0c135d0b8b84846f96abb6292d3b36822d974234d4356dc94d4671940a48fe4aa5152b274d2dc199ce97","ssdeep":"192:6ZfenjOhmYs3FrWUYkm/o7S0Ao13Mv/FBBbwfKmt7tiZETv:Khm/pWUYkmw7Spo1cv/3RwfE2","tlshash":"6cd19fc302bacb05c6320b330d2f45e18e1bc2ae46436e8a94aa79d4f29234d4f31516","first_seen":"2025-09-13T12:19:18.46957Z","last_seen":"2026-01-05T17:40:40.580526Z","times_seen":4,"resource_available":false,"data":null}},"time_used":297,"timings":{"blocked":257,"dns":0,"connect":0,"send":0,"wait":39,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-01-03/f28ec37687319316e9d110f9661858e120250103131528923.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.189Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-01-03/f28ec37687319316e9d110f9661858e120250103131528923.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":5680,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"0bd977c494265089e141ff2a9574eccb","sha1":"97433f6b6189885bf44b7c9fa85d244510388a11","sha256":"4a12961f535520be9b6aa1e12bac4328a30a58cfb8c92fc9b02c6d8dba5e6899","sha512":"0ec3340a8fb348bba0d1ac047d2705ff73274b50cbbdbacfa2fc508aa390d16a1e8d8f14936b3868ddffb92e886cd6818681aef37c4ae45aacdce0fdca17acec","ssdeep":"96:WSbKy6A4pMEwpFPlJpKjxfTvM7Jz1a6yMKunn3IdPGKf0t1oyZbLMUBU7aO:WSOwblgpUz1aYbnyei0tKk3fBU7f","tlshash":"53c18d6e50ddf11cfa907f2ed343af51925d60245e2676863bea426c47c8878916f831","first_seen":"2025-09-13T12:19:18.470695Z","last_seen":"2026-01-05T17:40:40.581399Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1728,"timings":{"blocked":836,"dns":0,"connect":0,"send":0,"wait":892,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-05T17:39:52.213Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: text/html\r\ndate: Mon, 05 Jan 2026 17:39:52 GMT\r\netag: W/\"695b1917-1a44\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:19 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: BYPASS\r\ncontent-length: 2107\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"GeeTest","description":"GeeTest is a CAPTCHA and bot management provider, protects websites, mobile apps, and APIs from automated bot-driven attacks, like ATO, credential stuffing, web scalping, etc.","website":"https://www.geetest.com","common_platform_enumeration":"","icon":"GeeTest.svg","categories":["Security"]},{"name":"dc.js","description":"A multi-dimensional charting library built to work natively with crossfilter and rendered using d3.js","website":"https://dc-js.github.io/dc.js/","common_platform_enumeration":"","icon":"dc.js.png","categories":["JavaScript graphics","JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":6724,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (4980)","md5":"a9e0ccfda27fd5ad3e7a1ad365f2fb1f","sha1":"3681d91b242bff28c9d8f71e620ce9c6894da8d9","sha256":"4745a06583df2b31525f1c9b4a1afc99aaec3a4832bacb17a49b45c755fe491f","sha512":"7494a72a389bf4047d47c4f74e71dec2589f1ae341a1ef6e890864c1fa236b5f02f329d445b85c87008a9b739cd4c5b11f35cc6d6a79b07af2dda497d62777a9","ssdeep":"192:RDLkHMOZOh/3iLBZZCxfZuB1piE/7isf4:NUBohfOXZCxOktsw","tlshash":"8ed1d41af160ccee53241f1bfde6f40ce986b7874555d890d1ee61fe4d40fd18aa181a","first_seen":"2026-01-05T17:40:40.582212Z","last_seen":"2026-01-05T17:40:40.582212Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1246,"timings":{"blocked":503,"dns":25,"connect":230,"send":0,"wait":239,"receive":1,"ssl":244},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/vue-router.DbD1d2u6.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.656Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/vue-router.DbD1d2u6.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":23657,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (23453)","md5":"f3c090f8ad3ac02c81d8fd605b6191bb","sha1":"faa659e53417ad4eb4026e45eee8fda45ea07380","sha256":"bcc9f5b514236a612c1dd48f35993314951892af6a4a823f1ae70345e33210a2","sha512":"01f5d984ede30d662af07b260171ed6c4b6e26f4a4ed943de83c46066f6c8e4abda84bba2e1e2413e9c3ae3884435eb88c8288a021d6efa46dc713cb781016e0","ssdeep":"384:X80qvY1mkP6cVUzmBRiQgTnsX659wi9ri6Ra9R7Nvc0GxhQdZgiyK5FYwyjIwB3J:sXYfPrVUzmniQgbsXw919rg9fvc0Gxhh","tlshash":"72b2e7a53283706643fa0ae5407b1146f2361cd5384e98d0f16dada73c37dacd2abe6d","first_seen":"2026-01-05T17:40:40.583067Z","last_seen":"2026-01-05T17:40:40.583067Z","times_seen":1,"resource_available":true,"data":null}},"time_used":349,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":349,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/js-binary-schema-parser.by-kEvu4.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.715Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/js-binary-schema-parser.by-kEvu4.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:32 GMT\r\netag: \"1767634592\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:32 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 1209\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":2683,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2682)","md5":"80603c6ff1735d7320f08ca2501e2997","sha1":"fbafcf0625029f9d92a23fe9e52ea91f6c0b1e9c","sha256":"8f97f0ba6eb27f61e0251743087a92ca8cdf2522423a08cfff9f58d0153cb4a3","sha512":"a7b16b720238d03886cb3acd279577b254760278731e661da643e4a25497b33d2232bf81c6cf45f5ead0458f9d66e5232ed8ef71222984cf643b05158f88189c","ssdeep":"","tlshash":"d8513288649a92e9534a18967c3e8c68f0265691351face0e39d9c1af4d49cb406ff3b","first_seen":"2025-11-20T04:33:33.516485Z","last_seen":"2026-06-01T01:23:32.028617Z","times_seen":3,"resource_available":true,"data":null}},"time_used":1406,"timings":{"blocked":1177,"dns":0,"connect":0,"send":0,"wait":229,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@element-plus.Bn41Rdmt.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.503Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/@element-plus.Bn41Rdmt.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:31 GMT\r\netag: \"1767634591\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:31 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18828,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (18827)","md5":"9e09254c52e4dd8a4a7f1a1ec534257a","sha1":"4012de7233ba137476e113f3362edaa2c01897df","sha256":"7f083c53e0662d1058029bc8680fc735fd7897b4215e7705ff88063fd16ba98e","sha512":"e52fe20fb07576eced123241e05fd62c6ff05f847b9540df77fa2402af25ed41dcdc3d238d1488687f2fd619d71ad07f703486a7640afc933bfbbfe3020bba7c","ssdeep":"384:HVWr+yix9MWmXC+v1cFTk6FY92oh86IMbKat1zme4PEs0SzXyXxr:HVW7/6FTW92okMoEs2r","tlshash":"e2823178af1984dc452fc14c2db260221b5e6dfdb18b4831abbed93da213978c617c9d","first_seen":"2026-01-05T17:40:40.584671Z","last_seen":"2026-01-05T17:40:40.584671Z","times_seen":1,"resource_available":true,"data":null}},"time_used":408,"timings":{"blocked":176,"dns":0,"connect":0,"send":0,"wait":232,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/CommonTable.u-6JAKnR.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.336Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/CommonTable.u-6JAKnR.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: W/\"695b1917-16d7\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:19 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: UPDATING\r\ncontent-length: 2453\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5847,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (5846)","md5":"7eeb2f23bfc453036cce671ddd71cb0d","sha1":"39b41bd0de886fd13e5e9ed1caba5596e74ecf9f","sha256":"90c0aba5c57539aeb255a33503c1ef903554f00a928de56ba6c5f5f9ebb32f32","sha512":"da141f8f4f7f6ddd11bc0ff70b0ba4e1e3f5c2a192f92cbdb5c3834cf7e7378fb20667ec3ce73f911c787dc3fb978c7d7db5418a64b0caa2c11213a43ff836fc","ssdeep":"96:UZvCLlM4Y98LweVc5AZ7/P85EspMQ3fAGHUmBc6QGdI/UFce9pwwWDgS:UQLlMvEc5AZ7/PmtZ3IGteYfFBpwsS","tlshash":"0dc1e668b8badcb963ebc1b830194420a51d3b9ed010a4f1a1ff1e1617ced54838fb39","first_seen":"2026-01-05T17:40:40.585424Z","last_seen":"2026-01-05T17:40:40.585424Z","times_seen":1,"resource_available":true,"data":null}},"time_used":238,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":238,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/price.BpPWlJRd.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.421Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/price.BpPWlJRd.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.D3030Mjq.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: \"1767634797\"\r\nlast-modified: Mon, 05 Jan 2026 17:39:57 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 3153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":7203,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (7202)","md5":"e79c7700fb7ed7f6c76d279534b7d616","sha1":"eaae81197c6735250859b5c39013aedc29019461","sha256":"446e6ecaecdbd75297e810061298a30bba2787f77f96e744bd43dadb57921cac","sha512":"ce114dc4094028dbd8ccad2dd28b500d6cd4bcbd24230552d5e6c594f8f04355b6c8c5737c7851b09c529adc63f59da2c7e2cba9520e104be9a9ada5fee37623","ssdeep":"192:ZZLiAGHuPtNmdKIAN/qAVWGKI3XbhVWPhr7Xcf1a3iGi/Zs31:PBgSIGXVWGKAXFVqhHQ1aSRsF","tlshash":"c1e1b54bf822403a7375edd9c078a03151ae3f4aa380caf6e4df4f222315920e6dda17","first_seen":"2026-01-05T17:40:40.586259Z","last_seen":"2026-01-05T17:40:40.586259Z","times_seen":1,"resource_available":true,"data":null}},"time_used":367,"timings":{"blocked":139,"dns":0,"connect":0,"send":0,"wait":228,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/woff2/ping-fang-sc-medium.ClZat5Qx.woff2","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.460Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /woff2/ping-fang-sc-medium.ClZat5Qx.woff2 HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/css/index.D6p3pYi2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-type: font/woff2\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: \"695b1916-c5cc4\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:18 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: UPDATING\r\ncontent-length: 810180\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":810180,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 810180, version 1.0","md5":"2420a827b393210362c189e05b7e62fb","sha1":"3a55fc2aee7da38aa63024fc1c975f14309f4946","sha256":"f179f2d6c5113e7516acaf48bc3ad3a0e6f985b1463b9dc34b315e0e3aeb565b","sha512":"c2f2b56bb909ccbe61a8540f0e479fd328f4593da74fb7daf01c23e0bf49c791cd9e9241042fd4bdd7c3788cfb24a6d1e74c8eca7b365439b2cb0b4935dc8045","ssdeep":"12288:kK+yBO81DJKrF7/9qdIRsLH3S39gwYqCVEHmeb2a4ay2r:Kyo81DAqTo9gjAmeb2a4Wr","tlshash":"5c05336cd99c3d2aad66ee3f8410ddd9cef122b30ed458fba132e7481536be53640261","first_seen":"2025-11-20T04:33:33.522593Z","last_seen":"2026-06-01T01:23:32.023867Z","times_seen":3,"resource_available":false,"data":null}},"time_used":545,"timings":{"blocked":100,"dns":0,"connect":0,"send":0,"wait":237,"receive":208,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/symbol-countdown.D5OfgNfO.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.844Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/symbol-countdown.D5OfgNfO.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/price.BpPWlJRd.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: \"1767634797\"\r\nlast-modified: Mon, 05 Jan 2026 17:39:57 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 704\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1427,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1426)","md5":"9d1b6dd6eb733f2e07e80c9853ace3e4","sha1":"779e3a9e6a1097d8e8b2661e617c62316f9386ee","sha256":"9ec9b598ba55d1ff5535684424d15fb3195f46ba5a0b4d24a65c2f9d118ba111","sha512":"8960c9d18fe92179b2e1aaa9f1e13964a9d0d7d3bcbd1752df912d026f238a4e28f5dc116cdab13b55ebec68397bb920d7c7c4480ab3062659e0d3a5da3f40fc","ssdeep":"","tlshash":"0a211ed9273fd0326e218d49231033aa8f9ad788f4b785c2c1cd0cab69a9864f10d325","first_seen":"2026-01-05T17:40:40.526783Z","last_seen":"2026-01-05T17:40:40.526783Z","times_seen":1,"resource_available":true,"data":null}},"time_used":228,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":228,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/js-base64.BbY-I90a.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.684Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/js-base64.BbY-I90a.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 1654\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3770,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3769)","md5":"d977b6abdc9dfa895ba2908444bc1a4c","sha1":"c927a78b94191e33082e93268d76328889ef28aa","sha256":"1d9533f0a528208faf28cf35da9b3f329d884fb4b03b55e17aeabf56b7ff2e65","sha512":"5780e3b033c076ccd1fb6ba001afa991886fc73212178eb117021ce7a3c1426ee54eea49805d3be85163b081ac0db732987fc6690e176f7203b54598725e6df9","ssdeep":"","tlshash":"b47185493d52b15b46fbb24634cb488afebcafac188d40d4f6051c6e31b2dc810a7f68","first_seen":"2025-06-24T03:29:59.818674Z","last_seen":"2026-05-19T07:58:02.670902Z","times_seen":4,"resource_available":true,"data":null}},"time_used":569,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":567,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/vue-i18n.DXPsAFYl.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.695Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/vue-i18n.DXPsAFYl.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:29 GMT\r\netag: \"1767634589\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:29 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15439,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (13902)","md5":"aa80912b734c94b05fc9c4f817ed124b","sha1":"60fd97ab32c31c644346f560ae5ce140ba4117bf","sha256":"49dd58f77ec690b5de9db8cca88d9d45f65ed53501c320c3858ad412fb2a85e5","sha512":"5bce0175897d3c32df6c6377f482682d0108b66199f92b72a04bd1e656415e8e2e2738d52e51222586a4d8b743ac175c348be78059d49737574260707984b4c6","ssdeep":"384:ztU6deMTl6OGU17+8bZBcyLmvps8xh1J58iCJ+AmK7ADtBkroDsBkX:G6dTl6dU17+8bZBcs2ps8xh1J58iCJ+l","tlshash":"606209c674e77037077906e960b32107af3c0a65341e98d4a16d9ba93fa3c5e81a7f1e","first_seen":"2026-01-05T17:40:40.588743Z","last_seen":"2026-01-05T17:40:40.588743Z","times_seen":1,"resource_available":true,"data":null}},"time_used":698,"timings":{"blocked":354,"dns":0,"connect":0,"send":0,"wait":344,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/crypt.cVg_o3mt.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.706Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/crypt.cVg_o3mt.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 665\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":1322,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1321)","md5":"d27fd807f99b497419ce55c51be4cddb","sha1":"bf82e7387d8b65978d6dd5a5bf2197b113882ebe","sha256":"e58c06f4ec67f2d067ac3d6ebf7c57dec9a85efc5633e447c7bc3f36287ea582","sha512":"31ea6c8793ec7934ae99f2747c8eebbdb3385fd3d4705eb877431fcb4eb7b92b454f68a71345b2a7ce14935176537fee2b9288bc2a58cfd7b324ed15032d1aeb","ssdeep":"","tlshash":"2821b3a235c5acea531399680c2f5103e07aae938d5f4581db20c5c5dce4eadd06ad58","first_seen":"2025-11-20T04:33:33.749134Z","last_seen":"2026-06-01T01:23:32.077736Z","times_seen":3,"resource_available":true,"data":null}},"time_used":1186,"timings":{"blocked":672,"dns":0,"connect":0,"send":0,"wait":514,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/async-validator.CRx4dHSJ.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.507Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/async-validator.CRx4dHSJ.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:32 GMT\r\netag: \"1767634592\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:32 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16927,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (16926)","md5":"5f9eecae1312c57a7a0f1284e3ad8c3f","sha1":"de8edccfc4b435345adb5a606f3f4eddb8a355db","sha256":"812fa20f5ea0132b7fa8343c5b1e31d99769d31df0a9ae316743b93d35d3ae6b","sha512":"a4d67e4b1e5a667ddebb60ae6b557e197147c01bda49591f5bb37e0ad99a4fdb270f2abf89add30fa280681d2368d40062cdac31e1d6fd9f8e97619bf78589e7","ssdeep":"384:vHO0Rvf5n5ta3W/YSrLQfqL3y/SAeePedHe2OedjedpedYedreShed9edveezeVU:bj5tEW/bi/DeePedHe2OedjedpedYedz","tlshash":"7d7272c836d9b41d86a360f5202ba056f22fb541586ddc45f3ede0fa6bf580e4213b7a","first_seen":"2026-01-05T17:40:40.59041Z","last_seen":"2026-01-05T17:40:40.59041Z","times_seen":1,"resource_available":true,"data":null}},"time_used":413,"timings":{"blocked":182,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/CryptoJS.CZ6NzDv9.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.511Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/CryptoJS.CZ6NzDv9.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:30 GMT\r\netag: \"1767634590\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:30 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 3449\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":5469,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (5468)","md5":"a538e2a71ea76e17d6f0aca8cc8a40c3","sha1":"959f52f2a521a87d5105493248c5cfd160edd925","sha256":"771218d31c64a5c41252be6fa4c2fb9806fd83c23994c688cd86d69250b36a1e","sha512":"71d40c6b646db6f452c5080d5d8c06f5f4d638ff39de3e2cb0730a82968107861d554479d7f2796f2bfb7b4d3952cc20552ad23fab9c679db26f3d68c2f68520","ssdeep":"96:4ZRf9tjAoJoQJbaGTJtgZ5rxtm14bUMVtumNWZek3E8+3sk7okTFFes0WvbZdmj9:sf9JGiTJtgZlq1bM3NWZe/8CT7okhFel","tlshash":"bdb14c9ef4e1a09143c51a1194ffe01af27f76b9264e8751fc4a0b963d1d462e336b0c","first_seen":"2026-01-05T17:40:40.591251Z","last_seen":"2026-01-05T17:40:40.591251Z","times_seen":1,"resource_available":true,"data":null}},"time_used":428,"timings":{"blocked":196,"dns":0,"connect":0,"send":0,"wait":232,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/uuid.uLbfAFT2.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.519Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/uuid.uLbfAFT2.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:31 GMT\r\netag: \"1767634591\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:31 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 822\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1652,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1651)","md5":"88ac41b68bce7331ba503a266a586094","sha1":"b57880b5b81aa16e7b5b474728cbccd1686ff5b1","sha256":"199886616a9b5ed64272bfee0187db43467daffd6220dd56a1ce2918a923c994","sha512":"01a3125475a91623da77dba5ea94d31eac6408081882c519245499e64aacf9aaf23df965947c4009ddd03449715b6fa5f6ee425123cda85d5e483516414053c6","ssdeep":"","tlshash":"ee310dde27b5ab0603ba1ddb01f7ec0b639ed00234bc91645aa2248f0130bf785d392a","first_seen":"2025-11-20T04:33:33.782112Z","last_seen":"2026-01-05T17:40:40.591935Z","times_seen":2,"resource_available":true,"data":null}},"time_used":628,"timings":{"blocked":397,"dns":0,"connect":0,"send":0,"wait":230,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/vant.AyL9BkfU.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.338Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/vant.AyL9BkfU.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: W/\"695b1917-d366\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:19 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: UPDATING\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":54118,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (36539)","md5":"3214c50942b0edf9b287baf398f9c3a6","sha1":"5077d3fd44448e309e8badb488b363032ed347e5","sha256":"94cc276ebcf5889448f9aaa14fca6ac750ad931d18a88218c00c3b9d32d705a4","sha512":"62cc21f7f3cc5ddee143e10f5062852d1f695adba8f62dc17527bb03bf737ce670cf568a6696ec986fe0b108cd90c6ccbb52b0b9f6d2181c951915d24658cb0a","ssdeep":"1536:GnDy68JJkuTaKX17+ZZzD8QUH7jQch6J0doSed:GnW68JJkuTXOzDZUH7dQJ0doSm","tlshash":"ca333c91b1d6b438d3bb68c440590940ab2d1b49b01ac8e1f1bf9e553b69ce4e5fef1c","first_seen":"2026-01-05T17:40:40.520041Z","last_seen":"2026-01-05T17:40:40.520041Z","times_seen":1,"resource_available":true,"data":null}},"time_used":241,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":241,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/woff2/Outfit-Regular.HI1-IRnq.woff2","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.943Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /woff2/Outfit-Regular.HI1-IRnq.woff2 HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/css/index.D6p3pYi2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-type: font/woff2\r\ndate: Mon, 05 Jan 2026 17:39:58 GMT\r\netag: \"1767634798\"\r\nlast-modified: Mon, 05 Jan 2026 17:39:58 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 28748\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28748,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 28748, version 1.6554","md5":"26e50773e08a93181edc24716945e248","sha1":"741f357c1693a28017da76e9592cdcd136cabdaa","sha256":"ec67667e022f75a7a96f69ab96192c97115b906245569ad0a9189e42d7665460","sha512":"b681b19427a10bd6f25431e401e3034c107dcf6327e176fac30322f16efb13373ef4034d8d0dbccd9e0e04e64b544ba288907a44f8dac34aa347aa3f4078cc59","ssdeep":"768:WzsPxRG+YL2T6e9eLTHjzcfmQkMhuF2XnnZ7BHE:WzeWD2TXeL7kfNDm2X1Bk","tlshash":"35d2e0519e3427f1c87b05bd40a22aca9adbc44cd39643d21237e0fbea0305865f85ee","first_seen":"2025-03-08T06:47:35.772743Z","last_seen":"2026-08-10T18:26:53.641892Z","times_seen":181,"resource_available":false,"data":null}},"time_used":296,"timings":{"blocked":64,"dns":0,"connect":0,"send":0,"wait":229,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/js-cookie.Cz0CWeBA.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.693Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/js-cookie.Cz0CWeBA.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:29 GMT\r\netag: \"1767634589\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:29 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 731\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1421,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1420)","md5":"9ba84da314e546b245ef41c6730b8f4c","sha1":"0e47a7538ed8b615a0e861d840bd1f9432461c57","sha256":"aa4436d6f6679520a88403fbf61fef0734beba55b907cbd170ef4b31a1cf6ea1","sha512":"70db74bc37b7d6beff2d474dee6f4ef87d6909850be31986b7b92cf0d87e709d4ccf3fa51d7e93695171e96137614142bc12e36de0ec04a2c9bb07ebae8d7f9e","ssdeep":"","tlshash":"612194e830c61cd5079b0430872f2146f1fd4700ecceecc4a759f1e262b1a21026beb6","first_seen":"2025-06-24T03:29:59.865119Z","last_seen":"2026-01-05T17:40:40.593688Z","times_seen":3,"resource_available":true,"data":null}},"time_used":684,"timings":{"blocked":318,"dns":0,"connect":0,"send":0,"wait":366,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/css/CommonTable.C8VeBH6S.css","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.006Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /css/CommonTable.C8VeBH6S.css HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-type: text/css\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: \"695b1917-78\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:19 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvia: 1.1 google\r\nx-cache: UPDATING\r\ncontent-length: 120\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":120,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"60b78e56278872e7626f5dbb464121f2","sha1":"39096cb5ecad0d535f8ca1aa7f6f55ad6203ad15","sha256":"c3ea18cc4b5952c8ab2a96c01539d5143cd2f9a4a7e27b3bfd53db1d2dcede43","sha512":"81c6f4a6629f0c1468d6ee46e207e10943f3dd0ade82a3d53c96bc4a0e1b89433ce4044d0ec5fbd9aa9f151799f87d1bbccd5dc6bae1efecf06644047fde8217","ssdeep":"","tlshash":"d9b0922ef50f1a1510afdb547aa5ccc96679b3a211460747be42002abe0b2a228ca980","first_seen":"2026-01-05T17:40:40.59454Z","last_seen":"2026-06-01T01:23:32.034492Z","times_seen":2,"resource_available":false,"data":null}},"time_used":241,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":241,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@vant.B6-Gj5Kj.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.339Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/@vant.B6-Gj5Kj.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: W/\"695b1917-e3b\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:19 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: UPDATING\r\ncontent-length: 1737\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3643,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3642)","md5":"80e4a6f89ac48be6964159719b3b1a8d","sha1":"bd14bc19fd207a2738cbdf2116c4af2682b6adbf","sha256":"0bfaa40a67a1e3e4acba9434961a8aa378e2742623324d067c35248267bd4f19","sha512":"b6e24f2d02c37fc8765a25f47fdf14525611e4027c59c3635c5d4c669d9c4f77de6a463a1ddf1c4ce0e38d5a3dacdfa25ba47f669cac03db0ab798c780697eed","ssdeep":"","tlshash":"bb7184ec3641b534c3694ee1007f97a5b21b6a2470cbc8a0e018ed193935ca192efedf","first_seen":"2026-01-05T17:40:40.561117Z","last_seen":"2026-01-05T17:40:40.561117Z","times_seen":1,"resource_available":true,"data":null}},"time_used":236,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":236,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-01-03/013b187419fd1ee1d739df2b7096fa6920250103113345824.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.163Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-01-03/013b187419fd1ee1d739df2b7096fa6920250103113345824.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":6686,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"6784adbccf9e2d94e9670228293c8fa8","sha1":"0d45148e2de575f56478a6f579548120aa138a86","sha256":"9880b8e365e7e48a3c3e32a691fc7533dd968edf72a741dc54cac773da6e5766","sha512":"c61c87ef0ae5ec828c1b69761941f306bd6a4b497ac51b060ec543cee5bd00167bc38cd61e114819d7e4eedc7fbfdc01acf53dc0c3018b346fa6c25f8cffe42f","ssdeep":"96:WS9DN0bCSqfog3uJV3RMYWuO2KA21KHMJpNpApDJ5nBSeOA6iQ6unYvFHkRnsmtq:WSo3qfn+nRMJuxbM7N45Bf3JXuYKRs2I","tlshash":"eed18d26208d58f97438caf786ef68314b6e6e238f2b929662f58431b267d4521163d1","first_seen":"2025-09-13T12:19:18.541627Z","last_seen":"2026-06-01T01:23:32.085581Z","times_seen":5,"resource_available":false,"data":null}},"time_used":1819,"timings":{"blocked":859,"dns":0,"connect":0,"send":0,"wait":960,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/driver.js.DwQe8DM_.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.696Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/driver.js.DwQe8DM_.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:32 GMT\r\netag: \"1767634592\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:32 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21381,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (21380)","md5":"62568581f5f4d7d014ac2f6d36d5bf52","sha1":"4749d411e76e5fd86eb4747135928fae2879e95e","sha256":"fa3ec02b5fc44a795848eba155c7678f0cc8ab5b8f8a6106d5df6d302d00d04d","sha512":"2c44aecf390af1f5877140a1b509640031bcf4bb06920da50a2aebd7c751c5bfd5a72e2ed956162d36b1300062faf0aa194d9353c8c00342d489949a16df988f","ssdeep":"384:iD5RhuDbV8isIuPLUZUiNu9GWZ2AyeJQXjy3byX0EqdIWIAyXcGoR3HW/ugjbr0b:iDnhuHDnuPoZUiNusWYveJ5OX1X0BW/Q","tlshash":"93a2d95834103936927f7c5ed57783457b342374f9038a91707f882a271adcae27aabe","first_seen":"2026-01-05T17:40:40.596445Z","last_seen":"2026-01-05T17:40:40.596445Z","times_seen":1,"resource_available":true,"data":null}},"time_used":701,"timings":{"blocked":410,"dns":0,"connect":0,"send":0,"wait":291,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/process.DzrMeI0r.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.701Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/process.DzrMeI0r.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:31 GMT\r\netag: \"1767634591\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:31 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 733\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1725,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1724)","md5":"57241a8c1b06047c1ef26173656dc0eb","sha1":"c61bf230f048129e928d008992cbcd0afde7eeda","sha256":"8934fae2fc4c1e83a8c28a087ceb4a35208456f1c54aaa3550c0d3d575458d66","sha512":"198d0951e96ac0082610dc185192d5922da246141ceea5607cec50476b1212013120f72f073930c1922847ab53a2c6e7a022ebe5ad28ee795e10126ba12bf562","ssdeep":"","tlshash":"af31349cb79eb5b763e223b0553f8503e07657b21c4d80a47122e5e038309797717dd8","first_seen":"2025-11-20T04:33:33.524994Z","last_seen":"2026-01-05T17:40:40.597212Z","times_seen":2,"resource_available":true,"data":null}},"time_used":948,"timings":{"blocked":524,"dns":0,"connect":0,"send":0,"wait":420,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/svg-icons.BOKYaZuS.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.521Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/svg-icons.BOKYaZuS.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:31 GMT\r\netag: \"1767634591\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:31 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":1756479,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"179bac31789bce5c48d6d31a06e27593","sha1":"9eb2012d87ae868d159cb6f5049124646ccaae11","sha256":"744fe8e3fc730cf6c54940c075a15d446bce0918a2675ee62d39c999883735bc","sha512":"34680d613088ddced218b7ab0be66ae9ca7aca828a11327fd72040cd479a4427a7b4493befb56def18d7b5d9359adf1cc12468de59bbe381f245cc59ad1a6f2c","ssdeep":"12288:0uAkFkVT4QMcnr8cbeTBl9PgpjhmwFmri:0uAjTKe4TOOi","tlshash":"a0250bd76734939c99cbd99eef26a4e4231f50faba7b84c0499f8b6850478c8f607c50","first_seen":"2026-01-05T17:40:40.598045Z","last_seen":"2026-01-05T17:40:40.598045Z","times_seen":1,"resource_available":false,"data":null}},"time_used":628,"timings":{"blocked":398,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/js-binary-schema-parser.by-kEvu4.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.523Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/js-binary-schema-parser.by-kEvu4.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:32 GMT\r\netag: \"1767634592\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:32 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 1209\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":2683,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2682)","md5":"80603c6ff1735d7320f08ca2501e2997","sha1":"fbafcf0625029f9d92a23fe9e52ea91f6c0b1e9c","sha256":"8f97f0ba6eb27f61e0251743087a92ca8cdf2522423a08cfff9f58d0153cb4a3","sha512":"a7b16b720238d03886cb3acd279577b254760278731e661da643e4a25497b33d2232bf81c6cf45f5ead0458f9d66e5232ed8ef71222984cf643b05158f88189c","ssdeep":"","tlshash":"d8513288649a92e9534a18967c3e8c68f0265691351face0e39d9c1af4d49cb406ff3b","first_seen":"2025-11-20T04:33:33.516485Z","last_seen":"2026-06-01T01:23:32.028617Z","times_seen":3,"resource_available":true,"data":null}},"time_used":647,"timings":{"blocked":398,"dns":0,"connect":0,"send":0,"wait":247,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/api/Site/configH5","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.552Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /api/Site/configH5 HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-headers: content-type,Source\r\naccess-control-allow-origin: *\r\naccess-control-request-method: GET,POST\r\ncontent-encoding: br\r\ncontent-type: application/json\r\ndate: Mon, 05 Jan 2026 17:39:56 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers\r\nvia: 1.1 google, 1.1 google\r\nx-cache: BYPASS\r\ncontent-length: 3783\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13365,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"11d675de15ee6f5689fedcdb1bb6f800","sha1":"9f0d232a3e8caff6503c58066791efc416b4a680","sha256":"e7509ab722e4705ded481d320f3c6edcdda4bd5fc4dc30a5155142371d05615f","sha512":"4c237d3af6d01e5e93aa867730da4213614dea38a2dc6b49fb4bbba055e6140e869216fb1b90ffa5fb8f9af9574f6b28997c8e36a8b650db7d515af3458e5458","ssdeep":"384:sX7JNdqaA+oMwXFT80ikhJxKJ8ltD7ntJYA4ZoBOnQIg:s+4g","tlshash":"c75284ffb3ad0a3287e096c851b76d4d98d276026cd1ab32d77ded06f0a4158e21e493","first_seen":"2026-01-05T17:40:40.598895Z","last_seen":"2026-01-05T17:40:40.598895Z","times_seen":1,"resource_available":false,"data":null}},"time_used":839,"timings":{"blocked":581,"dns":0,"connect":0,"send":0,"wait":257,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/price.BpPWlJRd.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.325Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/price.BpPWlJRd.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: W/\"695b1917-1c23\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:19 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: UPDATING\r\ncontent-length: 3153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":7203,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (7202)","md5":"e79c7700fb7ed7f6c76d279534b7d616","sha1":"eaae81197c6735250859b5c39013aedc29019461","sha256":"446e6ecaecdbd75297e810061298a30bba2787f77f96e744bd43dadb57921cac","sha512":"ce114dc4094028dbd8ccad2dd28b500d6cd4bcbd24230552d5e6c594f8f04355b6c8c5737c7851b09c529adc63f59da2c7e2cba9520e104be9a9ada5fee37623","ssdeep":"192:ZZLiAGHuPtNmdKIAN/qAVWGKI3XbhVWPhr7Xcf1a3iGi/Zs31:PBgSIGXVWGKAXFVqhHQ1aSRsF","tlshash":"c1e1b54bf822403a7375edd9c078a03151ae3f4aa380caf6e4df4f222315920e6dda17","first_seen":"2026-01-05T17:40:40.586259Z","last_seen":"2026-01-05T17:40:40.586259Z","times_seen":1,"resource_available":true,"data":null}},"time_used":243,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":241,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.nivex0.one/Settings/getStaticTableInfoList","fqdn":"app.nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"104.21.41.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.342Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nivex0.one","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 21:49:45 GMT","end":"Mon, 30 Mar 2026 22:47:22 GMT"},"fingerprint":{"sha1":"F3:75:42:AC:F4:B1:7A:7C:E8:04:E5:D0:28:3D:F4:39:81:43:13:7F","sha256":"31:21:32:21:BD:A2:A7:26:01:57:E2:D2:82:7C:27:AA:B6:20:97:FE:42:7B:00:B3:42:B2:66:33:59:46:80:FA"}}},"request":{"raw":"POST /Settings/getStaticTableInfoList HTTP/1.1\r\nHost: app.nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 321\r\nOrigin: https://nivex0.one\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":321,"data":"app_id=glqM63yrAri7JojgtRePgFl3\u0026device_id=8c414030-ea5d-11f0-b736-f91c6883da20\u0026lang=en\u0026sv_ids=1%2C2%2C3%2C7%2C13%2C14%2C22%2C23%2C25%2C26%2C27%2C42%2C46%2C55%2C56%2C57%2C58%2C59%2C63%2C69%2C68%2C69%2C70%2C75%2C49\u0026__channel=15\u0026__platform=3\u0026__timestamp=1767634797310\u0026__version=5.0.8\u0026_CDCODE=a48a19c785ad5e1dbbe3bb6450483304"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 05 Jan 2026 17:39:58 GMT\r\ncontent-type: application/json\r\ncontent-length: 233690\r\nserver: cloudflare\r\nvary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers, accept-encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: content-type,Source\r\naccess-control-request-method: GET,POST\r\ncontent-encoding: br\r\nvia: 1.1 google, 1.1 google\r\ncf-cache-status: DYNAMIC\r\naccess-control-allow-methods: GET,HEAD,POST,OPTIONS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vU1ycBGcvX1CA9YGHpaNDSOzrb3GsjRpk7agrU72Whb9XCpGdoZCIvGHQBlT12590h%2BdTt4agUpWvdBkYTNgYZiif8kVWN%2FuqxMqQdSf\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b94c20b594fc759-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1534236,"size_decoded":0,"mime_type":"application/json","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"bf43c6322f14c79260bb9dc18b19e6b6","sha1":"2ca9139fe16fc0ca1964514cf8a2273d6b56e1dd","sha256":"8f7e87a65fed93bf821737cf82897b4c7084e175476748e9ee259e127ec16c2e","sha512":"b28282cab28623bf2a8d968029e466d60460770b323fcfb94cd3a9441f881d9a8b7d94bedc0045b3a7bd3221e1b8dd28f2456d1fba0e8e277ed66b7433aeb548","ssdeep":"3072:6S45qvirfEWAuw3Bs/stklZQnFQUGv8nsrPFQ5EwBspAimOfZPLQ90u7SO2gQB:6S45qviYWAMstkTgTsrLpAimgLQAPgQB","tlshash":"b2257678375c46a68df0c1ca8cc67b96967c3c0f584d4ebbaeaa9f12406fd73950701a","first_seen":"2026-01-05T17:40:40.59973Z","last_seen":"2026-01-05T17:40:40.59973Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2147,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1405,"receive":742,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"app.nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-08-24/c72fc9e88e2080f9c436c750a241169620250824135908633.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:03.982Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-08-24/c72fc9e88e2080f9c436c750a241169620250824135908633.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":3671,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"68c2fc9ad34c095b84e7a44893948ffb","sha1":"50da87c35064f2846d0f2cbe75f8a8ff15f825dd","sha256":"c679d1d6f7000f13d1c8d6c1253c33b74da54e95d4b281dda24461a9afa1ff82","sha512":"e30f2d48bfa8b52c80cae47b192308a02aadbfd6af6093e1174ffa86a9232dec3eed9f3b52047d9f1cf4307ed56b2cb9a1dd0e78028bbe23669f31710980fa2d","ssdeep":"","tlshash":"2c719d705289311238cd458f12640120d5e8a22b198c1aa4a38ffed43bb5efc5bf8376","first_seen":"2025-09-13T12:19:18.589103Z","last_seen":"2026-01-05T17:40:40.600563Z","times_seen":4,"resource_available":false,"data":null}},"time_used":2798,"timings":{"blocked":1038,"dns":19,"connect":13,"send":0,"wait":710,"receive":0,"ssl":1011},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/uuid.uLbfAFT2.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.698Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/uuid.uLbfAFT2.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:31 GMT\r\netag: \"1767634591\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:31 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 822\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1652,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1651)","md5":"88ac41b68bce7331ba503a266a586094","sha1":"b57880b5b81aa16e7b5b474728cbccd1686ff5b1","sha256":"199886616a9b5ed64272bfee0187db43467daffd6220dd56a1ce2918a923c994","sha512":"01a3125475a91623da77dba5ea94d31eac6408081882c519245499e64aacf9aaf23df965947c4009ddd03449715b6fa5f6ee425123cda85d5e483516414053c6","ssdeep":"","tlshash":"ee310dde27b5ab0603ba1ddb01f7ec0b639ed00234bc91645aa2248f0130bf785d392a","first_seen":"2025-11-20T04:33:33.782112Z","last_seen":"2026-01-05T17:40:40.591935Z","times_seen":2,"resource_available":true,"data":null}},"time_used":707,"timings":{"blocked":411,"dns":0,"connect":0,"send":0,"wait":295,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/is-buffer.DoLxFxiE.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.707Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/is-buffer.DoLxFxiE.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 403\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":403,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"1e14259fe55f1eca414026c860c1aaf3","sha1":"bc49a4fa9dd8e7efb12af1a9274ca7d4f9a3fb04","sha256":"5c14f02de63ccaa5a7cd3c99cdba8cacce55abbee714b949ef5597043f3f72a3","sha512":"f96c6774cc494a38567aa4f818ebe1eb87d67ad953933b3bde7d4f239cab5449b273c8f418d00307499b5100b699e5c198d10c56e83dd2731370011487bb221b","ssdeep":"","tlshash":"4de02b4a3a31b868427368b400ebc84ff729f49464cf4261950945b92cfb0ae4123e5d","first_seen":"2025-11-20T04:33:33.621202Z","last_seen":"2026-06-01T01:23:31.987959Z","times_seen":3,"resource_available":true,"data":null}},"time_used":1186,"timings":{"blocked":687,"dns":0,"connect":0,"send":0,"wait":499,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/js-cookie.Cz0CWeBA.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.513Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/js-cookie.Cz0CWeBA.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:29 GMT\r\netag: \"1767634589\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:29 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 731\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1421,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1420)","md5":"9ba84da314e546b245ef41c6730b8f4c","sha1":"0e47a7538ed8b615a0e861d840bd1f9432461c57","sha256":"aa4436d6f6679520a88403fbf61fef0734beba55b907cbd170ef4b31a1cf6ea1","sha512":"70db74bc37b7d6beff2d474dee6f4ef87d6909850be31986b7b92cf0d87e709d4ccf3fa51d7e93695171e96137614142bc12e36de0ec04a2c9bb07ebae8d7f9e","ssdeep":"","tlshash":"612194e830c61cd5079b0430872f2146f1fd4700ecceecc4a759f1e262b1a21026beb6","first_seen":"2025-06-24T03:29:59.865119Z","last_seen":"2026-01-05T17:40:40.593688Z","times_seen":3,"resource_available":true,"data":null}},"time_used":876,"timings":{"blocked":626,"dns":0,"connect":0,"send":0,"wait":250,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/woff2/Outfit-Regular.HI1-IRnq.woff2","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.939Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /woff2/Outfit-Regular.HI1-IRnq.woff2 HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/css/index.D6p3pYi2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-type: font/woff2\r\ndate: Mon, 05 Jan 2026 17:39:58 GMT\r\netag: \"695b1916-704c\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:18 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvia: 1.1 google\r\nx-cache: UPDATING\r\ncontent-length: 28748\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":28748,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 28748, version 1.6554","md5":"26e50773e08a93181edc24716945e248","sha1":"741f357c1693a28017da76e9592cdcd136cabdaa","sha256":"ec67667e022f75a7a96f69ab96192c97115b906245569ad0a9189e42d7665460","sha512":"b681b19427a10bd6f25431e401e3034c107dcf6327e176fac30322f16efb13373ef4034d8d0dbccd9e0e04e64b544ba288907a44f8dac34aa347aa3f4078cc59","ssdeep":"768:WzsPxRG+YL2T6e9eLTHjzcfmQkMhuF2XnnZ7BHE:WzeWD2TXeL7kfNDm2X1Bk","tlshash":"35d2e0519e3427f1c87b05bd40a22aca9adbc44cd39643d21237e0fbea0305865f85ee","first_seen":"2025-03-08T06:47:35.772743Z","last_seen":"2026-08-10T18:26:53.641892Z","times_seen":181,"resource_available":false,"data":null}},"time_used":287,"timings":{"blocked":43,"dns":0,"connect":0,"send":0,"wait":239,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20211022/UmLf99291061309.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.072Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20211022/UmLf99291061309.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxP2iqbeBmzEmsdJUSONEkuJ2r-PoZ-mExjYbEogFpL_8e760DgjLsjsOabiKgln5ct8\r\nx-goog-generation: 1729754949703762\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 5086\r\nx-goog-hash: crc32c=iCJhhA==, md5=lZoS2klqW+TmqZI9TSMTCQ==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 5086\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:29:09 GMT\r\netag: \"959a12da496a5be4e6a9923d4d231309\"\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":5086,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"959a12da496a5be4e6a9923d4d231309","sha1":"d076893f5992f428089d0a1b623ef308f9608b08","sha256":"963304993ceb82da6eb1f7dc1113e421166e51a9bbd0576f99c09604dc31f6f6","sha512":"0a85c1117b7fc84618e5d3a7ceb12dafa9fd9e913854fd6f3075ace7f9309d8e269bf045e38a232604642c9f7a9735e34c4ff527675edc3c67c2542e1bdd62f2","ssdeep":"96:lPw1Fhg1XOqe08MBSLCnEfIL6WtH+9mTp6jU9JwrC6xgO6lpOnj:61FC1+HMBGCEfSdJ+tPrC6WO6lpOj","tlshash":"01a17eab93d4e481e02565f3ba6d0a07b6f03c0c7c421603a66d65bb4ed744d00da59a","first_seen":"2025-09-13T12:19:18.578684Z","last_seen":"2026-06-01T01:23:32.11531Z","times_seen":5,"resource_available":false,"data":null}},"time_used":401,"timings":{"blocked":370,"dns":0,"connect":0,"send":0,"wait":30,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20220210/oyMu74321395372.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.191Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20220210/oyMu74321395372.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxN--MF4mvQEghpWrnqtoop5ZJ3TV34oLDZTeIRe348no9DK-yOdhJAvHLsrzqMs_ap29RJ0LcA\r\nx-goog-generation: 1729754963436330\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 5976\r\nx-goog-hash: crc32c=gciiFw==, md5=Iqe1YH6n1aZavXiY60bWmQ==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 5976\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:29:23 GMT\r\netag: \"22a7b5607ea7d5a65abd7898eb46d699\"\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":5976,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"22a7b5607ea7d5a65abd7898eb46d699","sha1":"0859fc5c899b687a4d2ab224610f2a6079be7c3b","sha256":"e6d23cc4390f57250d4c1c751a8a52913039b734c3ef245b19213e85a31a41de","sha512":"7e8cdb306b962d8dba14874c27ba2809975ec3a5ea73742ff6a3b2fc83ffd1fb5184a831ed3ef51b0e0f398bf017f350ba37105a75c56264e74fc5ca7419dfcf","ssdeep":"96:lPwJVF4g2PgT+d6DM2QUtZiXHg5s/Vr9VVfJpuaHLzwLtRDXnSJlxpLQdDjD8VA6:6LF4g2W+dszhtZiXA5sVr7VfJp7kTyln","tlshash":"83c18e4954193a68458967aa31d04409cc2be897b51dc42891c5f6ef17c4fcb8b82b37","first_seen":"2025-09-13T12:19:18.540631Z","last_seen":"2026-01-05T17:40:40.602846Z","times_seen":4,"resource_available":false,"data":null}},"time_used":295,"timings":{"blocked":252,"dns":0,"connect":0,"send":0,"wait":42,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-01-03/c1970cd12c4c9c4f2053de8d605b8c7d20250103104441923.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.203Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-01-03/c1970cd12c4c9c4f2053de8d605b8c7d20250103104441923.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":5738,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"b73003bf5eb556b8e8bc171e8c25daff","sha1":"199f37d6a51e28b8d9280e651cbc1dee2d19fcb6","sha256":"75951b619263c861bc07ce9c2a0818972340aad13e3564061e581b973a046b6f","sha512":"17126be67f1d98d76f53da7c7a088d6e7e97a3449ec54cbfdf230f17d89d4c53c0b482bc94481ba83db8f07399772d36b3fd0108fdca94f9ef23b3b7184cca37","ssdeep":"96:WS68kp/j7+am0GDhzTb4k6NfpgfMuYkPc5GHkQCPAcGphs2o0:WS68kIoGD9Tb4k6NB4w15GwPAJo0","tlshash":"e7c1aff1223385de0b05b9e72afdc9eeca06429d7f01235136d784a8e28f048181dd7b","first_seen":"2025-09-13T12:19:18.525314Z","last_seen":"2026-01-05T17:40:40.603658Z","times_seen":4,"resource_available":false,"data":null}},"time_used":2037,"timings":{"blocked":831,"dns":0,"connect":0,"send":0,"wait":1206,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-01-03/e98051b514c1199430e2dfd0b798f5b820250103125735432.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.170Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-01-03/e98051b514c1199430e2dfd0b798f5b820250103125735432.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":3338,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"d5cfe5a369345e6217096f94a8284123","sha1":"9052a3e15916413f93b1a2363ea2502dfd3bb789","sha256":"b03da0e7d46416ed56b721fd4d7f944676ce1be6c0f5050c6a24ca76813f702d","sha512":"2d84d09f12199563ea90452fd547fe987e9d1a0bc26075792dd0cc97ac0e3f3169e24727029857fefb67ea5a8d1991faa2f62271380baa7004f4e6dfd52da9eb","ssdeep":"","tlshash":"a1614b87d5844bdbddba7aa34058c0887e3baa3f9d48b5418c194c032bb7a888655de6","first_seen":"2025-09-13T12:19:18.576342Z","last_seen":"2026-01-05T17:40:40.604586Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1979,"timings":{"blocked":853,"dns":0,"connect":0,"send":0,"wait":1126,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/spotTrading.Bnxepb0p.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.329Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/spotTrading.Bnxepb0p.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: W/\"695b1917-41a\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:19 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: UPDATING\r\ncontent-length: 381\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1050,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1049)","md5":"d9df8363be320fa8cb4e9f545ee19834","sha1":"ec857134ed486942a1491bf2d21e1452f412f796","sha256":"dbdb8c04c7e32c16bcd717ddc098fa93910ea91e96c3c837b2ac973ccba5c763","sha512":"f35a48142ba6a8c0db806cfca41bdcce0af36e2c7df6a6274b6478698bcd9f70b0587375f0a0ab2a0398d4c6a24bfc5bc4acdac1a4e552fc9e6ad505d9325f8f","ssdeep":"","tlshash":"761127eeb046e2a1428da35ab95f331e736fef50f9e75c221c016d9d3642a0cb429b15","first_seen":"2026-01-05T17:40:40.605437Z","last_seen":"2026-01-05T17:40:40.605437Z","times_seen":1,"resource_available":true,"data":null}},"time_used":238,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":238,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20211222/rXMn69701748612.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.201Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20211222/rXMn69701748612.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxOLtkdlnBHaMqfiVnesrw8JWEU3TNLHxAlR4wkMB73A9pQm8O8VCG-zU_lXa1ALwReR\r\nx-goog-generation: 1729754967530758\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 7442\r\nx-goog-hash: crc32c=3jIh2g==, md5=zF1h5vj0FJ40urUdMvJtUA==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 7442\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:29:27 GMT\r\netag: \"cc5d61e6f8f4149e34bab51d32f26d50\"\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":7442,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"cc5d61e6f8f4149e34bab51d32f26d50","sha1":"35ca5516301d4297f859dcf753b7dfe726c64489","sha256":"854077ab505cdbca356a00bd232a1cebd6338fe0bc7959954e78fb9e00f0ac01","sha512":"e83e15739d35722ff4021e8bc1967e261aec0e44aa58ee7fbf73c360f160b7e095b5094daf5c72180a11e0adb6e8c23f9fde5fffd5c557ae66149c634070036d","ssdeep":"192:6onZYGiyzbP0NsOEQIIutVj4lRja8wZoQ66B8peT:vnqG3z9QVutVEllOZ96480T","tlshash":"16e1b06d77128bade1c36f3f227f0311d67f4d0990126aa3d0e0876909da4cc9d5508e","first_seen":"2025-09-13T12:19:18.552761Z","last_seen":"2026-01-05T17:40:40.606258Z","times_seen":4,"resource_available":false,"data":null}},"time_used":292,"timings":{"blocked":244,"dns":0,"connect":0,"send":0,"wait":47,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@element-plus.Bn41Rdmt.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.702Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/@element-plus.Bn41Rdmt.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:31 GMT\r\netag: \"1767634591\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:31 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18828,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (18827)","md5":"9e09254c52e4dd8a4a7f1a1ec534257a","sha1":"4012de7233ba137476e113f3362edaa2c01897df","sha256":"7f083c53e0662d1058029bc8680fc735fd7897b4215e7705ff88063fd16ba98e","sha512":"e52fe20fb07576eced123241e05fd62c6ff05f847b9540df77fa2402af25ed41dcdc3d238d1488687f2fd619d71ad07f703486a7640afc933bfbbfe3020bba7c","ssdeep":"384:HVWr+yix9MWmXC+v1cFTk6FY92oh86IMbKat1zme4PEs0SzXyXxr:HVW7/6FTW92okMoEs2r","tlshash":"e2823178af1984dc452fc14c2db260221b5e6dfdb18b4831abbed93da213978c617c9d","first_seen":"2026-01-05T17:40:40.584671Z","last_seen":"2026-01-05T17:40:40.584671Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1105,"timings":{"blocked":620,"dns":0,"connect":0,"send":0,"wait":485,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/destr.BPvN1X9m.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.709Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/destr.BPvN1X9m.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 632\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":1251,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1250)","md5":"f4073929b9262bd4def4e6a1a12e94b9","sha1":"13353bb720d2154efb374617d9b8c113e4f5fe90","sha256":"59596c2e2409a6a95380f99391ee0617ba697e59925b95dbf4e3e9ff8689e730","sha512":"fa4b8a8458dd31dd7ed0710e8c45b1d53eb39198bb67b2d6ccab55e1426e1455b1e1b3ebd59c680708cc31b1e8406fbf5b550a9db2166b1dddf5e9f6a1ea8b55","ssdeep":"","tlshash":"0f21dba772dba65a03ee54a44a352861f42c0820ec4f28e1f0e8d427d47a444eab7f80","first_seen":"2026-01-05T17:40:40.554581Z","last_seen":"2026-01-05T17:40:40.554581Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1184,"timings":{"blocked":688,"dns":0,"connect":0,"send":0,"wait":496,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/vue-echarts.Bd6UsEJu.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.530Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/vue-echarts.Bd6UsEJu.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:30 GMT\r\netag: \"1767634590\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:30 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 2066\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":4187,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4186)","md5":"eb3f411eb42c9ce5f83fd46666bbc0d1","sha1":"6f9d138afc965dea3fd15b86cdb7e3dd627f3e26","sha256":"c2a0f0c708d565fb1eb9fc3eebbd6635a9ebbb6daac01723168f28b9fc9e11b7","sha512":"95bda3cd8e7c44ddbcbfbe9b86cb4a08233a11cedda9fbdfd348abb77081b075dc559c84dd97ce317da784bf515519dfd78e6aa0553f7347e650bf7c891e952f","ssdeep":"96:zFkk63MMQmQ2FojQRtv/WpMWRSNdf0x8zvrmQ5weqh5T/qe0p7nNMBuWkYS:Ck6c+QAIQRtv+KWINdf0WzDmEjqh5T/m","tlshash":"ff81c6eeb491b27823f708cd80671946b77d8b95b008d0e5e498ede51a39b50e233da9","first_seen":"2026-01-05T17:40:40.607135Z","last_seen":"2026-01-05T17:40:40.607135Z","times_seen":1,"resource_available":true,"data":null}},"time_used":833,"timings":{"blocked":601,"dns":0,"connect":0,"send":0,"wait":231,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/png/image245222.X_CEt0ez.png","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.345Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /png/image245222.X_CEt0ez.png HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/css/index.-a00dYCq.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/webp\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: W/\"695b1916-2046e\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:18 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: UPDATING\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25812,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b9c77daf863cd437a57229143403095c","sha1":"363d1d0a38d2a9548ca277b01d748cd77c34878e","sha256":"f01e531d7621e1558f0378708e62f78c281cc9a2849c3b5ef5ad684177770418","sha512":"b35bd776a3b6896828ca24a710704559fc60e26001077ea22c850d5faecff54fdbac5f98ca7272dcac486bfb32b327fcb1a80d59333770da7442b32486c17ace","ssdeep":"384:XMvr+6i+CkJdsq9ry99jm7Wl1xEetkXiDez2x1X29D8htwxAahwM:cvaZdkJdseI9jmE1xVqNKxV2F228","tlshash":"9fc2f7dc8dc5ab36c4509db167e15a0502c4630aadbf4843a73f37a88f5ed21be82767","first_seen":"2025-09-13T12:19:18.565695Z","last_seen":"2026-06-01T01:23:32.076218Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1059,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1059,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.nivex0.one/MarketV2/getSpotList","fqdn":"app.nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"104.21.41.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:00.817Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nivex0.one","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 21:49:45 GMT","end":"Mon, 30 Mar 2026 22:47:22 GMT"},"fingerprint":{"sha1":"F3:75:42:AC:F4:B1:7A:7C:E8:04:E5:D0:28:3D:F4:39:81:43:13:7F","sha256":"31:21:32:21:BD:A2:A7:26:01:57:E2:D2:82:7C:27:AA:B6:20:97:FE:42:7B:00:B3:42:B2:66:33:59:46:80:FA"}}},"request":{"raw":"POST /MarketV2/getSpotList HTTP/1.1\r\nHost: app.nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 195\r\nOrigin: https://nivex0.one\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":195,"data":"app_id=glqM63yrAri7JojgtRePgFl3\u0026device_id=8c414030-ea5d-11f0-b736-f91c6883da20\u0026lang=en\u0026__channel=15\u0026__platform=3\u0026__timestamp=1767634800814\u0026__version=5.0.8\u0026_CDCODE=66a22300ae5e272f8baf56a2550f17b1"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Mon, 05 Jan 2026 17:40:02 GMT\r\ncontent-type: application/json\r\ncontent-length: 13747\r\nvary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers, accept-encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: content-type,Source\r\naccess-control-request-method: GET,POST\r\ncontent-encoding: br\r\nvia: 1.1 google, 1.1 google\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-methods: GET,HEAD,POST,OPTIONS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ikcqhvQ3g4Ql9Y6uHc%2BU4hVETkC%2B5yyMAdrR0RAEGxGW0qjmDzJyfdNbrjIjQQ%2FqVzNkxZXfvsRXdfYTw5Q7e4BWT55vMwvA6zONKw%3D%3D\"}]}\r\ncf-ray: 9b94c2211e8a712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43644,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"c31ea3e314be51d48a9fee697676c541","sha1":"635fed8619fbe283c8bf6fd94bc2b9dc2778476e","sha256":"3f27a2e6ec44f09ccc4b4139d35e1e0714113c614b8c1cc4b21ccabbf163ed1d","sha512":"9f03c98daa3a138095e389ca187be96b493e3305327d4cb309dabe7907af5b1a4520f8d6364a42af1effe3a7207e8cbfcabdeaf2b947e04340b60840e0fce2b8","ssdeep":"768:YbaMCk0JSP0L7deF4ok/ZrsIJO/pHEPkuIKLIB9PleKRzu5au3X:oJBG4XkBfJOmkuIKLXK5utH","tlshash":"5213449209bc358edaf14f890242f5b0a52f715fdad64bd06779de1810c8bc773446ea","first_seen":"2026-01-05T17:40:40.609108Z","last_seen":"2026-01-05T17:40:40.609108Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1392,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1383,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"app.nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-12-23/30ed7470c32eeb16d3639f0446238b2620251223192253267.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.180Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-12-23/30ed7470c32eeb16d3639f0446238b2620251223192253267.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":15203,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"66ff17a6f1e6a6e0bf25639702cc7b39","sha1":"92a2af9fbc659ec13e74b31145d2f31ebe065ffa","sha256":"84cf85a9c24d976bdcb550bcd0c8da1853e7d34933310284d125b0d913f4491a","sha512":"df68edc4d8a9c6dd489e43076681ae89a97ec1be7164f254208347c8b9277184a40418d6f7429bebb2dd1973f0f088db5ebcf0f25c91a9b02a49cbc67673dc8e","ssdeep":"384:5mSm4O2qzXXA6LgMF1WG2C7Guxqc/fEuBez230Je2/CHsxLOwNhtmlIa:caOJrwsgQ1WlTbufEIN3+e2aMxqomlx","tlshash":"ec62c0a6dd50eb7a8689f80d65453f6af0f7208a3c3633b4fa3935181d108d959c26d2","first_seen":"2026-01-05T17:40:40.609941Z","last_seen":"2026-01-05T17:40:40.609941Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1943,"timings":{"blocked":844,"dns":0,"connect":0,"send":0,"wait":1099,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20211023/Jw6887875096169.jpg","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.185Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20211023/Jw6887875096169.jpg HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxMIV1Yfidlw30HZimunFw4EkhYOquZ2Cu8NrvtJVpfQ6E-a91T4s-R33ec-cIxnDkNB\r\nx-goog-generation: 1729754944104404\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 5029\r\nx-goog-hash: crc32c=tXEn9g==, md5=wC+6RYaCdijSUx1VjJ30iA==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 5029\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:29:04 GMT\r\netag: \"c02fba4586827628d2531d558c9df488\"\r\ncontent-type: image/jpeg\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":5029,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 97 x 96, 8-bit/color RGBA, non-interlaced","md5":"c02fba4586827628d2531d558c9df488","sha1":"31d660df8baabb850bf00e858ac4d77c1efef1e5","sha256":"deeedc25434ed7fb23ad8e9faf31876648dd5da1358191c11271aa64c9aa0bde","sha512":"e45a175e3eeb56822ee4e2f755fd1b95b286d5bab8a5f3cbd34b710dc0ed3783db186f43d23d4fc584c3be0cb1b16ea188cb74fb1d96c0a82744e8d81b4684b2","ssdeep":"96:OeEZ2wVC7NGRLa8iBAHYlS05EM5eDYccE5gWQDvs5UWWFSshhxUnU:OcQcgRLa8iB60SKEM5eDyWEUHxYF","tlshash":"75a18e02b53d6e26d088a439f47d5064887ea8ae801d166bb777b3c50ec519621ad6b3","first_seen":"2025-09-13T12:19:18.577383Z","last_seen":"2026-06-01T01:23:31.968003Z","times_seen":5,"resource_available":false,"data":null}},"time_used":297,"timings":{"blocked":258,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20211006/e6LC55314958933.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.198Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20211006/e6LC55314958933.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxPYmeHD-ts-8htdDoxgoF9yDcNSlyLyvcrDa4gXixwL0qxuB_0xKWH8XTEvFcLRr5ILvTZB4n0\r\nx-goog-generation: 1729754933471521\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 4275\r\nx-goog-hash: crc32c=jIlHBA==, md5=4kWEH3B80ddsOhV0feCXMg==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 4275\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:28:53 GMT\r\netag: \"e245841f707cd1d76c3a15747de09732\"\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":4275,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"e245841f707cd1d76c3a15747de09732","sha1":"980e227a21da2edb95c5ba1b6985a45653b7312e","sha256":"891f48e932066f85893bcbf42c41aedb27f87c69e494a58f6e74b4cb24c8a01e","sha512":"a0970fc2a4fd6a5db3534055aa7429125de25b7d79b4e144222302bb91f2e7eda9ff89b243975e5318d40cc2e062cd18ba1a1fbee99ae4994a5d4d04131bcb45","ssdeep":"96:lPw1/6rUCczPg4D9BQ13NHecrPMWggmCzjTzQsG4erRElj:6krAPgG9ytNHVPXNjTzQWARE1","tlshash":"b7918fd6ea529f7c5eecb676641f5d0e622ba04f81c1f85cd853a871c874802d1074bb","first_seen":"2025-09-13T12:19:18.562667Z","last_seen":"2026-01-05T17:40:40.611515Z","times_seen":4,"resource_available":false,"data":null}},"time_used":293,"timings":{"blocked":246,"dns":0,"connect":0,"send":0,"wait":47,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@zumer.CQXvgQnk.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.654Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/@zumer.CQXvgQnk.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:27 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":102707,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65534), with no line terminators","md5":"4247956666256a3b63c183f3ff06c02a","sha1":"e9aedb07e926d7bbca69321b01960cc9777f6362","sha256":"4c7e9dc9554affb3af9c63eadce63ba420e7b2f7efb202c0d6963bc815b47c24","sha512":"8a171c3c412ffe689b78c04045f14c44bf3c797ab722a9087d9a0789b96a52b4c56dd82f8f4d9c65a1d984ac8317130892d1b10c98769415855d58884aab5ab8","ssdeep":"3072:b6vRvK/GcTqOnFWUi06FgEezsiQ+E3n2qlp:bcRi/G2qOoUi06F3Wsiwn2qX","tlshash":"0da34a7433763137a3dd009a90ba4205f26c992949074c99e27e9c7b3979c86b2f7f78","first_seen":"2026-01-05T17:40:40.612346Z","last_seen":"2026-01-05T17:40:40.612346Z","times_seen":1,"resource_available":true,"data":null}},"time_used":272,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":272,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/normalize-wheel-es.BQoi3Ox2.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.714Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/normalize-wheel-es.BQoi3Ox2.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:30 GMT\r\netag: \"1767634590\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:30 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 1457\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3103,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2616)","md5":"d683be5e2b15f2608fb0ea78f8d0435e","sha1":"477846374145623fa6bb0fa2ca792310513a8b37","sha256":"55cb7ec4e87f8f7165225884a2696f8fef524cb4428a4bb8f2d4f3710edab568","sha512":"f10db079fe4fd124e1af467b1d49f9e9ed3515ff5754637ecf857591e50cca228152a08a60d253b0bc042cbf13d0833296375774167f717410ba6ae0c0142391","ssdeep":"","tlshash":"0d5162fc7051b1b2511a3862283f560bbb7bf4f5292d6642ea288090bd34955c337fd9","first_seen":"2025-11-20T04:33:33.72042Z","last_seen":"2026-06-01T01:23:31.921688Z","times_seen":3,"resource_available":true,"data":null}},"time_used":1327,"timings":{"blocked":1095,"dns":0,"connect":0,"send":0,"wait":231,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/zrender.DwG-h7oT.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.717Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/zrender.DwG-h7oT.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:30 GMT\r\netag: \"1767634590\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:30 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":214266,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"b46207bb80862051ff9dff8e4c12d350","sha1":"c15f15f23a7bf099cd4c265a666cc9a002233a8c","sha256":"dbb0bad1c1c12ceb3b958243a95f04c6f8d7316577dc6a2fd5d852fcaafc1015","sha512":"bcd7c67abc4adb8883d7e62f1ac4a2be48b3176b93eb061fd8ffca93c237fd501144af28a9455c462f0dcfce86e7b6367a933934d34ae052f7dd7be4c8285507","ssdeep":"1536:GS8VezpdXBAsNrzwMi4Sz0w62BTPuJ9I+b5U5eZhx8XlJkTYLYwFTXM6bJ1X3HOK:bzuDSJ9Xb5UYZhx8cWFTXM6bJxYA4a","tlshash":"e024e7d872517025839366e0453f150fb33b681ca80e896cb669e4ee2cfd48d267bf79","first_seen":"2026-01-05T17:40:40.569073Z","last_seen":"2026-01-05T17:40:40.569073Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1407,"timings":{"blocked":1176,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/webp/theme-nivex-mockup.BAA61VcN.webp","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.010Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /webp/theme-nivex-mockup.BAA61VcN.webp HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-type: image/webp\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: \"695b1916-39476\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:18 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: UPDATING\r\ncontent-length: 234614\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":234614,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"74df7f73b682af4f89fc1798b5b44e94","sha1":"9ce8efc9892bb4c2755f528996ec187f77d958fc","sha256":"12f1eea9ec57b347a7cc9dca81bbd0d0e0d91696ea3401ea7379e3d32cb38ff6","sha512":"c63abb5b8d8ff189a873b50ff2490a2000a756217a1ffc9122360f984c62f26daab3c217f8d989df3d74d4fb35beb8c45c0670efdc655a1e06209bb17bb4b5d1","ssdeep":"6144:LmskoEbT4eB2/EtlsxWNoJFY9TnsPeD6ojt5JPjtj8FZqoW:LzE3p2/Cs0oiTsPe2CorjW","tlshash":"7d34f1d7ff9180ecef81693e1ba8b01217d3ad522486385bd626b351cbb1cd6c31e1a5","first_seen":"2025-11-20T04:33:33.709074Z","last_seen":"2026-06-01T01:23:32.019908Z","times_seen":3,"resource_available":false,"data":null}},"time_used":270,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":239,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/index.x8n5eXUS.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.318Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/index.x8n5eXUS.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:30 GMT\r\netag: \"1767634590\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:30 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":109091,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (61068)","md5":"d2339cf025bb538377f46ce3ae3ec234","sha1":"e6473a14867f3143bc7c1d2a7de3b5f6c2104c57","sha256":"bb76072b9c669a0c4ba895b3cc883acea6b5bdc04b575b33af40c8a77ba0b36b","sha512":"37064612e513b6118b1e5ac4ad2e103a50881df22eb9c77ba42c764285cb1e59102834d5e51dc1a976d5657df4c12f31046a5915e5a05ebc48c8a99aa351b949","ssdeep":"1536:ZM/CFaSJOCYw2IqUdIvjH7Ckr+GYpN1iA6h9VEDGJIuGJJGUkYpeoNVz848lvLh3:WrSJiw2/AziA6h9VEDGJIuGhU/rbJys","tlshash":"8eb33bca326242bca3896ad8ec36220d9374df44e519c476bf2d7dcbb185d48d276b18","first_seen":"2026-01-05T17:40:40.615076Z","last_seen":"2026-01-05T17:40:40.615076Z","times_seen":1,"resource_available":true,"data":null}},"time_used":230,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20211023/QTcs87789137813.jpg","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.032Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20211023/QTcs87789137813.jpg HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxNfeALllsMUq98NBglOJ_jbKBVnD_hAi4pCy4W_X4J3yxGPRTqMWPYuymlzSgoMUajfom29H3M\r\nx-goog-generation: 1729754944811306\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 5620\r\nx-goog-hash: crc32c=qxUUCQ==, md5=stEl+mh8MDEg6iwIOUBEng==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 5620\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:29:04 GMT\r\netag: \"b2d125fa687c303120ea2c083940449e\"\r\ncontent-type: image/jpeg\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":5620,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"b2d125fa687c303120ea2c083940449e","sha1":"f9d77bf2f921ffcd1e05dc02392d1ee65e757291","sha256":"d17951aa2fdad53ff9104e3648eec70878a3a7df6477b9254f21d0166047944f","sha512":"4c98bbe7abda118df61097c5d8814f46ec81d62965c976e98cf1bcdab5b6153dbdee5652904d7b8b3082eb3c090269a7e6c80cf708e1d9d322fdcc2e19fa8cb7","ssdeep":"96:lPw2rqfsHSG5eD35C0ip1VdplOAON8sI7+vexMvfOR9mQ5BBZASDvryGpzAbnReb:62OEyG5G35GQxNNGTX5B7DvrOrReXx9f","tlshash":"fec17d46d4599835cb2b2775502232295402e4adfa5097b7cbd7c0284de18f627ffaf3","first_seen":"2025-09-13T12:19:18.533734Z","last_seen":"2026-06-01T01:23:32.096125Z","times_seen":5,"resource_available":false,"data":null}},"time_used":426,"timings":{"blocked":409,"dns":0,"connect":0,"send":0,"wait":15,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20211029/jQ4S42651267359.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.123Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20211029/jQ4S42651267359.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxPo8xGuta8JjRgmF3cfSescD4TBAfO_tvd-T15x5yraob01exQyT4gWPi47G0aaBT9k\r\nx-goog-generation: 1729754931540353\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 8344\r\nx-goog-hash: crc32c=fw9M6g==, md5=qPNUs8oSYnbDW97gNP7i9A==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 8344\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:55 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:55 GMT\r\ncache-control: public, max-age=3600\r\nage: 1149\r\nlast-modified: Thu, 24 Oct 2024 07:28:51 GMT\r\netag: \"a8f354b3ca126276c35bdee034fee2f4\"\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":8344,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"a8f354b3ca126276c35bdee034fee2f4","sha1":"a5d60452e6982a302702045d8ecc0897e748d919","sha256":"851b6eb43b30792104c98c655491563f63d30cae0976c8ec5b563fb72800b7b4","sha512":"e6b7e5504de18d490446b550ae905c7808fafbb49e0352c7021fe0a186e7c5f64da914ca488467b35b330315523c3ca754eef32357d17996251fbe1cebf250d1","ssdeep":"192:6Dk1HdhDGXp1ymMKh1KlKV5ByQFAm75IdcyF2d45cjq+ERo:6k19hqSmM0vMm6ZmEOYo","tlshash":"bb029e88073d681cde9b642198e4cf2a49f0f94e646026379ba0d3071a790ac91e66b7","first_seen":"2025-09-13T12:19:18.584734Z","last_seen":"2026-01-05T17:40:40.616797Z","times_seen":4,"resource_available":false,"data":null}},"time_used":354,"timings":{"blocked":319,"dns":0,"connect":0,"send":0,"wait":34,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/vue-i18n.DXPsAFYl.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.516Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/vue-i18n.DXPsAFYl.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:29 GMT\r\netag: \"1767634589\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:29 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15439,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (13902)","md5":"aa80912b734c94b05fc9c4f817ed124b","sha1":"60fd97ab32c31c644346f560ae5ce140ba4117bf","sha256":"49dd58f77ec690b5de9db8cca88d9d45f65ed53501c320c3858ad412fb2a85e5","sha512":"5bce0175897d3c32df6c6377f482682d0108b66199f92b72a04bd1e656415e8e2e2738d52e51222586a4d8b743ac175c348be78059d49737574260707984b4c6","ssdeep":"384:ztU6deMTl6OGU17+8bZBcyLmvps8xh1J58iCJ+AmK7ADtBkroDsBkX:G6dTl6dU17+8bZBcs2ps8xh1J58iCJ+l","tlshash":"606209c674e77037077906e960b32107af3c0a65341e98d4a16d9ba93fa3c5e81a7f1e","first_seen":"2026-01-05T17:40:40.588743Z","last_seen":"2026-01-05T17:40:40.588743Z","times_seen":1,"resource_available":true,"data":null}},"time_used":623,"timings":{"blocked":392,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/wssocket.BsRiRgr2.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.331Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/wssocket.BsRiRgr2.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: W/\"695b1917-7fe\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:19 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: UPDATING\r\ncontent-length: 888\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2046,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (2045)","md5":"03c93349a41ff5cf1f841b3a59bbac7c","sha1":"ffb0e6be5bfcbe08474f0602ce1ba3c7cc54bd47","sha256":"e9e2f505e913d2250b626a4de815ed597c91188333f578036e7c9c550ea71ff1","sha512":"7b070b2c4eb7983c6b6263f410159cd217f085ff77703392f7bdc89fe19380bbb58b3ed4a0805e4c31616ea10204726007bff6e3e2183f3abbc85434e39079ca","ssdeep":"","tlshash":"1d41118d7177629552f3d294148a4d05b12979690e0e101d7abccfe2bf2ee89b3a1f38","first_seen":"2026-01-05T17:40:40.577133Z","last_seen":"2026-01-05T17:40:40.577133Z","times_seen":1,"resource_available":true,"data":null}},"time_used":241,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":241,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-03-13/682342fec482e2a6775ea61d7dd4896420250313160530533.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.045Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-03-13/682342fec482e2a6775ea61d7dd4896420250313160530533.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:06 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":2330,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"39edd8e5c80256300562f68afb1ab525","sha1":"506e80486e2b9e90f7344334cd95e93ac8fa0338","sha256":"cf4c3c2ec18de3d4dcd49151ffe00cb299f86fc98467cf806b9c447467935479","sha512":"029abf77a53608d0e0a92ca7764bbed17cf0960e540fee5f8eb0a9cb1bbbb490e730ec22e8dc186b07b784cd87410f5667207c22478773346d725579673e5e2c","ssdeep":"","tlshash":"a3410ad884a0624d2924177332a3193dfc6d3f949a066dffc81d563c84a1e8271b5d64","first_seen":"2023-05-04T14:58:57Z","last_seen":"2026-08-10T20:44:45.101728Z","times_seen":17743,"resource_available":false,"data":null}},"time_used":3392,"timings":{"blocked":1038,"dns":6,"connect":22,"send":0,"wait":1260,"receive":0,"ssl":1056},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-01-03/f4a2fb771aedef7db327044c68eb550620250103104109705.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.188Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-01-03/f4a2fb771aedef7db327044c68eb550620250103104109705.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":4651,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"e64ba18eb298d75ee703d6f7d59fb4ec","sha1":"7c0d420a2505ad94cde48d18e840791eeb61ea09","sha256":"d5a58564e9e27a929e28535c5efb294c81b165854e4e77205ba84d838c3ad700","sha512":"7b8db0c1a3aad359930065de1e879c7fe52450803afa11975b13d9f9ae46a564f4a4ee5a422a98230e475c1a403ff2fe971796d10f44d56248b3492325499f70","ssdeep":"96:WSJmSVQqlNDvAFXwE3wSV+vRvfIn/U+ahOXKHhXsTDCvwveGqehFDN7:WSiqf6Se+9g/YHh8TXhr7","tlshash":"d7a17dc54f0b79007e6bf82a07a66c7877a535f89860ac5cc4c418bfea26cd8163c162","first_seen":"2025-09-13T12:19:18.5243Z","last_seen":"2026-01-05T17:40:40.618571Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1769,"timings":{"blocked":836,"dns":0,"connect":0,"send":0,"wait":933,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-12-09/268d095ff17b649e4932724067add88920251209151202734.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.196Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-12-09/268d095ff17b649e4932724067add88920251209151202734.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":7023,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"15ad9d7c9dcfb25707fe86030e81fea8","sha1":"f288bb3ed6ccd5fc3e7eceeb9ff3e2866e1a4285","sha256":"13b1447dcf712bc20014d5c5b1e9f3e6162df3cf0a0f55a53d052537d77f0dc6","sha512":"fed728bbcb2fe2ee8b30ed5bb000e0cabf2f7bce91f90ee105f10076bec5c37a8ebe54fce9474a2dcf30365a85c64c417314e47280c676343c549b6573620588","ssdeep":"192:WSyVbbcNAWi7MteX/1gI+w6OFzrG3sc49biu:5yVbbcNUX/1g94rGz49b3","tlshash":"6ce1afff593e2c30713054850e0866b1bdde3ceb9348a7a059e42741f346a2d3594f8c","first_seen":"2026-01-05T17:40:40.619431Z","last_seen":"2026-01-05T17:40:40.619431Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2085,"timings":{"blocked":829,"dns":0,"connect":0,"send":0,"wait":1256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/vue-qr.DNO3Ii1B.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.700Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/vue-qr.DNO3Ii1B.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:31 GMT\r\netag: \"1767634591\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:31 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":51021,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (51020)","md5":"072ec8f6ed508432c3a9d01dee4070c5","sha1":"874116dbec22bcf84109400c94ed3ba905b6d5f2","sha256":"1d561a188553a4f3d6a034567dc281258cd1d4723648fcc46ef30c1c62fe5f91","sha512":"c271a515500b27d1f04256c7654461d2f67d7105a6d3c4e0fdd0fe067b90f2208ac702944b1df4c198fa4b69a3c9242493a07e74ddd67a7d7fbf23ed4f254697","ssdeep":"768:9KLR6MLfzSX3d6VQF7Mee7hbUiDiDWJhIg0ImflILPC8cR2zmYdWp7cgRyJVEMC/:LMreHdqQF4eU0IZggXdngEZxw","tlshash":"2f332cd4b2a052b353da59c1986f0006a534b8292c09d96cbb3de5e37de1fc264faf31","first_seen":"2026-01-05T17:40:40.620289Z","last_seen":"2026-01-05T17:40:40.620289Z","times_seen":1,"resource_available":true,"data":null}},"time_used":859,"timings":{"blocked":523,"dns":0,"connect":0,"send":0,"wait":336,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@popperjs.DB1lLFnh.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.713Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/@popperjs.DB1lLFnh.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:30 GMT\r\netag: \"1767634590\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:30 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":19729,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (19728)","md5":"002dd210431845bbe306a8b1160f44c9","sha1":"eb81ca291df0ffbcc66aff752bdf7112d75fc61f","sha256":"5a5df9e8a4943e3172c56c17450c73bcac992464e16ae775c2364520884eda64","sha512":"ef73243fdd2633cf62132fd57f8d07e33e51fcda2e1f1fd910e7b8f131fe9c6c4d628e8765094ead939e073cf974c0cb4ea94943917d466a9f8911ea5c81d8c3","ssdeep":"384:yrwANx/2ItpItrwnAF8dbvgWklk5R97jzfZ/q6rHoQ4AydetatMiCWtgV:yrHNx/2ItpUrwnAOdbYC97jV/q6rHEA5","tlshash":"a092c5883654f0b6072b82fa807f510eb2336560524fe510b155e6de3c79eba622bd7f","first_seen":"2025-11-20T04:33:33.768516Z","last_seen":"2026-01-05T17:40:40.621203Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1326,"timings":{"blocked":1095,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-12-09/3e37b249ccea804177a291360c414a4e20251209110923571.jpeg\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.088Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-12-09/3e37b249ccea804177a291360c414a4e20251209110923571.jpeg\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/jpeg\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":15134,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 400x400, components 3","md5":"0b0211800fc380cc51253d7777f05a57","sha1":"54728e1e421e9a2aa953fa200df453812ff94d4c","sha256":"714cb2ace30f01c43e7f329703cdb8e3daa1c690f8c8a05ab1701a7c5bf8aed4","sha512":"041f7e742ef02afddc7ee30a93a8a6c737d089681236ff768185ad1c28338ad5dd472a5d32cecee9b5301aba9c8dccc69cf900f96d76835b9d495254bd70c387","ssdeep":"192:m8cDZvIJtufJ9rox/fxf7pKgiVem5ClvNdxRi2JTR6jCW+atxFa0:m8EZQHSLsNxfV08Pi2JTcjC0tP","tlshash":"73628c179f2937a1e4740afca12b0f5d996abf18ba0251bb42811ed638359c48d7ccac","first_seen":"2026-01-05T17:40:40.62253Z","last_seen":"2026-01-05T17:40:40.62253Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3137,"timings":{"blocked":956,"dns":11,"connect":13,"send":0,"wait":1169,"receive":0,"ssl":976},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/vue-router.DbD1d2u6.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.455Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/vue-router.DbD1d2u6.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":23657,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (23453)","md5":"f3c090f8ad3ac02c81d8fd605b6191bb","sha1":"faa659e53417ad4eb4026e45eee8fda45ea07380","sha256":"bcc9f5b514236a612c1dd48f35993314951892af6a4a823f1ae70345e33210a2","sha512":"01f5d984ede30d662af07b260171ed6c4b6e26f4a4ed943de83c46066f6c8e4abda84bba2e1e2413e9c3ae3884435eb88c8288a021d6efa46dc713cb781016e0","ssdeep":"384:X80qvY1mkP6cVUzmBRiQgTnsX659wi9ri6Ra9R7Nvc0GxhQdZgiyK5FYwyjIwB3J:sXYfPrVUzmniQgbsXw919rg9fvc0Gxhh","tlshash":"72b2e7a53283706643fa0ae5407b1146f2361cd5384e98d0f16dada73c37dacd2abe6d","first_seen":"2026-01-05T17:40:40.583067Z","last_seen":"2026-01-05T17:40:40.583067Z","times_seen":1,"resource_available":true,"data":null}},"time_used":230,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/vue-qr.DNO3Ii1B.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.524Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/vue-qr.DNO3Ii1B.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:31 GMT\r\netag: \"1767634591\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:31 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":51021,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (51020)","md5":"072ec8f6ed508432c3a9d01dee4070c5","sha1":"874116dbec22bcf84109400c94ed3ba905b6d5f2","sha256":"1d561a188553a4f3d6a034567dc281258cd1d4723648fcc46ef30c1c62fe5f91","sha512":"c271a515500b27d1f04256c7654461d2f67d7105a6d3c4e0fdd0fe067b90f2208ac702944b1df4c198fa4b69a3c9242493a07e74ddd67a7d7fbf23ed4f254697","ssdeep":"768:9KLR6MLfzSX3d6VQF7Mee7hbUiDiDWJhIg0ImflILPC8cR2zmYdWp7cgRyJVEMC/:LMreHdqQF4eU0IZggXdngEZxw","tlshash":"2f332cd4b2a052b353da59c1986f0006a534b8292c09d96cbb3de5e37de1fc264faf31","first_seen":"2026-01-05T17:40:40.620289Z","last_seen":"2026-01-05T17:40:40.620289Z","times_seen":1,"resource_available":true,"data":null}},"time_used":682,"timings":{"blocked":400,"dns":0,"connect":0,"send":0,"wait":282,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.nivex0.one/Lang/WebLangPackage","fqdn":"app.nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"104.21.41.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:56.457Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nivex0.one","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 21:49:45 GMT","end":"Mon, 30 Mar 2026 22:47:22 GMT"},"fingerprint":{"sha1":"F3:75:42:AC:F4:B1:7A:7C:E8:04:E5:D0:28:3D:F4:39:81:43:13:7F","sha256":"31:21:32:21:BD:A2:A7:26:01:57:E2:D2:82:7C:27:AA:B6:20:97:FE:42:7B:00:B3:42:B2:66:33:59:46:80:FA"}}},"request":{"raw":"POST /Lang/WebLangPackage HTTP/1.1\r\nHost: app.nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 210\r\nOrigin: https://nivex0.one\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":210,"data":"app_id=glqM63yrAri7JojgtRePgFl3\u0026device_id=8c414030-ea5d-11f0-b736-f91c6883da20\u0026lang=en\u0026lang_version=0\u0026__channel=15\u0026__platform=3\u0026__timestamp=1767634796448\u0026__version=5.0.8\u0026_CDCODE=047cf7936f022d52e06abedad0f6612d"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\ncontent-type: application/json\r\ncontent-length: 35525\r\nserver: cloudflare\r\nvary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers, accept-encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: content-type,Source\r\naccess-control-request-method: GET,POST\r\ncontent-encoding: br\r\nvia: 1.1 google, 1.1 google\r\ncf-cache-status: DYNAMIC\r\naccess-control-allow-methods: GET,HEAD,POST,OPTIONS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pRiIg1QRRgKnLTHk9tKswrpWT8sCDm3k45To8FAWqe3LcFjhToh78C9M0rz0X4GIfBUM8UXnKzTzklO8VDr6UBIFqQ%2BIEw5QDSLz%2BMWv\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b94c20608a7c759-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":101496,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"04c70e8d35f76332d195739bf63abfa5","sha1":"9acd47ab03252dd81a2db6b03916b3845bf84555","sha256":"917e12af45df9b18258b7d947afc028432cea63ace444d6e90705066a5368c60","sha512":"754e2d922787538b70b1eee1cb4fa38e60ab7562ce65f8391028a0c9edd35efd4ce9babfcb43a48a980515fbe0b50843ee2c9ceae69e60d0091c7a22cde50a26","ssdeep":"1536:AjB7rxbGskoA+BMNHhXkO2vejdymNzG4n0mSyxtJym8vxnOuUS0r1p:wtrxbGskLBzVn0mSyx7ym8vxOuUX1p","tlshash":"bea3b6dfa7561e3146fb03eeeda91e4f8ba60d215661c17e80fe054b33a113cd226939","first_seen":"2026-01-05T17:40:40.623515Z","last_seen":"2026-01-05T17:40:40.623515Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1378,"timings":{"blocked":25,"dns":5,"connect":1,"send":0,"wait":1279,"receive":49,"ssl":16},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"app.nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"app.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/index.DGjU1x-A.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.841Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/index.DGjU1x-A.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/price.BpPWlJRd.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: \"1767634797\"\r\nlast-modified: Mon, 05 Jan 2026 17:39:57 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":18710,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (18709)","md5":"ba19524f18231ff06f2da36fba317154","sha1":"13de88c53c0fd006c07699a6a320d915ff19ea9c","sha256":"399014812810db3aa354c432e779cb18a3610a320ccd281d38799db898a1ad7c","sha512":"28873f43938b9e62fa572ed565ac179437c93cacfcf1b3479b57c01258aadab8495f82882fb09a7cd233c4c137850501076a14e4042389aff9f262e56f9733ac","ssdeep":"384:2jAB5gAAUyZRvBZ67dzYwY4qvuAyoSyY31yXwyKYSPZksFKG3tkN6:WAtyZR367dzYwY4zoSyY3YXwyKYSWsFT","tlshash":"4582094ef8a6a438f6b6e9d9c0750562230c3f4a6184c8f5b4ff1f132745d54a29cbba","first_seen":"2026-01-05T17:40:40.54553Z","last_seen":"2026-01-05T17:40:40.54553Z","times_seen":1,"resource_available":true,"data":null}},"time_used":229,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":229,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/vabNodata.Dq5gDTE3.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.847Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/vabNodata.Dq5gDTE3.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/price.BpPWlJRd.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: \"1767634797\"\r\nlast-modified: Mon, 05 Jan 2026 17:39:57 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 775\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1422,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1421)","md5":"aea1947a1048f1e93609d3ceb0d60224","sha1":"cd6c4b564d1907fd96d0f243327a89215e6e563c","sha256":"8a017dd189954ca989da42352adca70ac2e38dacb8aab1c618974766411c0d37","sha512":"01e8c4e492acceeca87270da226ab82cdb7a7f98af7578a3f80eb2eef01cab9f6fb6ef59308133e702da257489e1048d67c9bb1f8a05fee0641eaf4bbb5c9fd4","ssdeep":"","tlshash":"98211e5b79268a79c3b71cdad429204b310836cdef94de9695bc9e163b810b8f21e371","first_seen":"2026-01-05T17:40:40.6244Z","last_seen":"2026-01-05T17:40:40.6244Z","times_seen":1,"resource_available":true,"data":null}},"time_used":229,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":229,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"mxws.nivex0.one/?m=Z7nbRYiLbQG+ID4kOsOflbZU+y0klEw2VF3Q8rdZm89KMF4yea71PF2Hjt+Vei3rH8DDbGAwPvw6TWtHFUk5Q+apfdc=\u0026k=JIFHKFDJRJu0DV2V92me\u0026s=w","fqdn":"mxws.nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"104.21.41.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:02.181Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nivex0.one","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 21:49:45 GMT","end":"Mon, 30 Mar 2026 22:47:22 GMT"},"fingerprint":{"sha1":"F3:75:42:AC:F4:B1:7A:7C:E8:04:E5:D0:28:3D:F4:39:81:43:13:7F","sha256":"31:21:32:21:BD:A2:A7:26:01:57:E2:D2:82:7C:27:AA:B6:20:97:FE:42:7B:00:B3:42:B2:66:33:59:46:80:FA"}}},"request":{"raw":"GET /?m=Z7nbRYiLbQG+ID4kOsOflbZU+y0klEw2VF3Q8rdZm89KMF4yea71PF2Hjt+Vei3rH8DDbGAwPvw6TWtHFUk5Q+apfdc=\u0026k=JIFHKFDJRJu0DV2V92me\u0026s=w HTTP/1.1\r\nHost: mxws.nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://nivex0.one\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: G8lHDsfShvW0xPzclhthng==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nDate: Mon, 05 Jan 2026 17:40:02 GMT\r\nConnection: upgrade\r\nsec-websocket-accept: nWUVVhaNz+R9wW9/2bVspsAdFp0=\r\nsec-websocket-version: 13\r\nsec-websocket-extensions: permessage-deflate; client_no_context_takeover; server_no_context_takeover\r\nvia: 1.1 google\r\nUpgrade: websocket\r\ncf-cache-status: DYNAMIC\r\nReport-To: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=wk0tXTdPAb45DVNNqig946%2FjUOTiUtoGkf3mUhcJAWVvRv5pj9Jbk5ClI%2B8kJVjWHKm0Zxf1m4oU6x0fAYMt%2BwHmxjN9PdTM7S%2BDs6Gg3n%2BPPlETp4t5Dlwrr3ubywQxh%2BI%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nNEL: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nAccess-Control-Allow-Methods: GET,HEAD,POST,OPTIONS\r\nAccess-Control-Allow-Origin: *\r\nServer: cloudflare\r\nCF-RAY: 9b94c229ee6c5694-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=555\u0026min_rtt=526\u0026rtt_var=155\u0026sent=5\u0026recv=8\u0026lost=0\u0026retrans=0\u0026sent_bytes=3104\u0026recv_bytes=1273\u0026delivery_rate=7017770\u0026cwnd=252\u0026unsent_bytes=0\u0026cid=aaf2548de1ba27f7\u0026ts=351\u0026x=0\"\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-10T23:57:25.058416Z","times_seen":17827247,"resource_available":true,"data":null}},"time_used":400,"timings":{"blocked":0,"dns":23,"connect":23,"send":0,"wait":333,"receive":0,"ssl":43},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"mxws.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"mxws.nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"mxws.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"mxws.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"mxws.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"mxws.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20211022/gLaJ98707335319.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:03.957Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20211022/gLaJ98707335319.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxObpKMupVV6Nfs4_vRavJwA5nGSa-xcgRSUKqGTczgV8tOPNxuB1gGZwaf3cR2rbAm9A5OCWgo\r\nx-goog-generation: 1729754950964121\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 5186\r\nx-goog-hash: crc32c=FZxySg==, md5=kDRPeBO/yJSjiqqtK/ffBw==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 5186\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nexpires: Mon, 05 Jan 2026 18:40:05 GMT\r\ncache-control: public, max-age=3600\r\nlast-modified: Thu, 24 Oct 2024 07:29:10 GMT\r\netag: \"90344f7813bfc894a38aaaad2bf7df07\"\r\ncontent-type: image/png\r\nage: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":5186,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"90344f7813bfc894a38aaaad2bf7df07","sha1":"9ce5f989d44f74e8a4485530b07edebcf34454b1","sha256":"c18c35a1b7e21b621fe319c9766070f8d14dd143a7b966c73c6ae2d1805b33f3","sha512":"cc19bf0f5991fe685b92d0913e50f3dde9ac2af811c109a45c3fae23ca5569f7130a42e217cfa4d9aabefc642cb6c5fab41300d895ae9a5e5410277c8f799d12","ssdeep":"96:lPwxC5rJn7xG0N2Je8HNkpKF7Shnn2Iz9vSApj5DlTdCd28aaF3T+91n3:6iFnNMVk4FHIhvSA55Zd82qpT+91n3","tlshash":"dbb17e88d353f709f9264cf22a17633468a2807206a4f36d8edea816c3740a4403ab9b","first_seen":"2025-09-13T12:19:18.593496Z","last_seen":"2026-06-01T01:23:32.003336Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2452,"timings":{"blocked":1057,"dns":9,"connect":30,"send":0,"wait":311,"receive":1,"ssl":1036},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20210729/MXj706514450444.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.190Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20210729/MXj706514450444.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxPKqgSnjzY8u0pJft7p683c-8iRo9LWr16gw_8R4XOEgeHHrpUxbZXaijqS1R8ZBGPx\r\nx-goog-generation: 1729754903158154\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 5268\r\nx-goog-hash: crc32c=zlwKAQ==, md5=pSDv+w3+E7uE3Vqnr702Zw==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 5268\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:28:23 GMT\r\netag: \"a520effb0dfe13bb84dd5aa7afbd3667\"\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":5268,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"a520effb0dfe13bb84dd5aa7afbd3667","sha1":"335883989750308bd32b0396c6a8af945a0b5ad7","sha256":"26a1f80d9c31c282e55cda10a01988b3b6a6ef0d13f587510e09bfd09e2bd97b","sha512":"c32649899bdb7a2fe65b90b449e3369de6472120d78899a55bc7de86ebc1787425251b8ba6286eed85954ea2286976b15984c5f47f72ad8022a02804ceeeb99e","ssdeep":"96:lPwwjhtcGICDOD3lZSKIzJqDLqEvoaMwe3KmgkmdyS/uues5pnX:6wjoLlZqgqaTe3KTkSx/uur3nX","tlshash":"f5b1aec6f4d277a7e867e3b4ec679e4629042448bf80253b2809f0e3ac0696d42ba143","first_seen":"2025-09-13T12:19:18.489433Z","last_seen":"2026-06-01T01:23:32.070942Z","times_seen":5,"resource_available":false,"data":null}},"time_used":297,"timings":{"blocked":253,"dns":0,"connect":0,"send":0,"wait":43,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/is-buffer.DoLxFxiE.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.482Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/is-buffer.DoLxFxiE.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 403\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":403,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"1e14259fe55f1eca414026c860c1aaf3","sha1":"bc49a4fa9dd8e7efb12af1a9274ca7d4f9a3fb04","sha256":"5c14f02de63ccaa5a7cd3c99cdba8cacce55abbee714b949ef5597043f3f72a3","sha512":"f96c6774cc494a38567aa4f818ebe1eb87d67ad953933b3bde7d4f239cab5449b273c8f418d00307499b5100b699e5c198d10c56e83dd2731370011487bb221b","ssdeep":"","tlshash":"4de02b4a3a31b868427368b400ebc84ff729f49464cf4261950945b92cfb0ae4123e5d","first_seen":"2025-11-20T04:33:33.621202Z","last_seen":"2026-06-01T01:23:31.987959Z","times_seen":3,"resource_available":true,"data":null}},"time_used":230,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":229,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/tslib.BDyQ-Jie.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.716Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/tslib.BDyQ-Jie.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:29 GMT\r\netag: \"1767634589\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:29 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 714\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1275,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (547)","md5":"5bfa8a535e5030f7cb2aa8556f8425ed","sha1":"fdcfb96973b929749dfb2c62f54b7e2dd87f1db0","sha256":"5314f1531709467c338fff833b11ee3e15d94beb150ab36419842ba2919bc46c","sha512":"27c439b69e9d0124bf155733bf52d8c7fad4a305c6eda40fdb9519b7caca126edebfe3c3374ae747dd9688b2ffd9aa1898e1cd093c3434d800ddb93a51d32b53","ssdeep":"","tlshash":"51212189b470add564b76aa02d533cc9a3adb16af415ea541094f194cabf00f862fa08","first_seen":"2025-11-20T04:33:33.528092Z","last_seen":"2026-06-01T01:23:31.900056Z","times_seen":3,"resource_available":true,"data":null}},"time_used":1407,"timings":{"blocked":1176,"dns":0,"connect":0,"send":0,"wait":230,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/vabNodata.Dq5gDTE3.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.335Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/vabNodata.Dq5gDTE3.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: W/\"695b1917-58e\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:19 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: UPDATING\r\ncontent-length: 775\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1422,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1421)","md5":"aea1947a1048f1e93609d3ceb0d60224","sha1":"cd6c4b564d1907fd96d0f243327a89215e6e563c","sha256":"8a017dd189954ca989da42352adca70ac2e38dacb8aab1c618974766411c0d37","sha512":"01e8c4e492acceeca87270da226ab82cdb7a7f98af7578a3f80eb2eef01cab9f6fb6ef59308133e702da257489e1048d67c9bb1f8a05fee0641eaf4bbb5c9fd4","ssdeep":"","tlshash":"98211e5b79268a79c3b71cdad429204b310836cdef94de9695bc9e163b810b8f21e371","first_seen":"2026-01-05T17:40:40.6244Z","last_seen":"2026-01-05T17:40:40.6244Z","times_seen":1,"resource_available":true,"data":null}},"time_used":239,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":239,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20211006/Lvri55361265565.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.051Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20211006/Lvri55361265565.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxONy1zfRmZ805L9o3pT3HGFlLE3hdydxte1oIGEM6OTcv0qD2_47OBDxBKqviQC2qndT0nGep4\r\nx-goog-generation: 1729754934296224\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 3779\r\nx-goog-hash: crc32c=4m2e0g==, md5=k0A5+0io9kDfabak6b4bzg==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 3779\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:28:54 GMT\r\netag: \"934039fb48a8f640df69b6a4e9be1bce\"\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":3779,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"934039fb48a8f640df69b6a4e9be1bce","sha1":"1cb6e68e4d47708921d1f13e2cb44efdaeaac38f","sha256":"9de332b7f7ba79b8e37a91a9ef604701d50914d8af537066fb37a1b5adf99f86","sha512":"21cac85c5d5373b955153eb3056c89852fa2f68a1b5761445785e066ef9b42d21797a8b87e123666e791e794c0f274b6ad63c1c35b1c6a708ee24268e0da29ad","ssdeep":"","tlshash":"3f717dd3fa027d6c4a3025bc43eae33ad5658167231917893f4321d9de3c2629c81883","first_seen":"2025-09-13T12:19:18.574337Z","last_seen":"2026-06-01T01:23:32.09863Z","times_seen":5,"resource_available":false,"data":null}},"time_used":417,"timings":{"blocked":391,"dns":0,"connect":0,"send":0,"wait":19,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-01-03/0e2d92080945d4e38ed25695c311454a20250103115157760.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.131Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-01-03/0e2d92080945d4e38ed25695c311454a20250103115157760.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":3710,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"87a7c7dd64c141405569af1eb512585a","sha1":"1c954ec3ba38045963ee7578a6bd4993cdab40a7","sha256":"33e6fdbec9cc2073c9c708282df337cbf3789f1e8f999407782788e424f965ff","sha512":"45607800932d2fc626c4d5c1742eb2bfc4c822d1d34373a2941f9d0a841e0f78269485dd8594c53d0d978cb6b1f6f4c52ec7db3e54a59c3ede9b47aa4279a07d","ssdeep":"","tlshash":"20716c533ae3900327911cc516f64666fc179a50ffe07da172b8102ddc30e79ddb222a","first_seen":"2025-09-13T12:19:18.570419Z","last_seen":"2026-01-05T17:40:40.627829Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1825,"timings":{"blocked":890,"dns":0,"connect":0,"send":0,"wait":935,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-11-21/3da000dd5a726ca23bda6cbdc93d43cf20251121194155233.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.165Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-11-21/3da000dd5a726ca23bda6cbdc93d43cf20251121194155233.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":34252,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"bb72ab14b20b6ad198d1830b793b4008","sha1":"2097e5b60e1b0aed855b67cc2b97f76eec936c14","sha256":"94e2b3886505a72ca4eff24a93057983ffff369ff11071d6bf8ca6aef040a2cd","sha512":"875b708e70dcb7b596827daac0bee4d7de645b7f4fc25c794fd79c9e7c0adf01ae28489ed25d4a91c127a0f9a3483abb1566ca604fce17ae4666ef8cf9121a74","ssdeep":"768:G+zvvDxlkq4dHpwEYYo7siQjdyBUduo8xkCapzelsjh:G+zHLp4ZpKadyuduomkdRj","tlshash":"fef2f1406a1339e90e08639e6cc7a922f7037fdf1a544cf7a7354767a41d3d01a2d729","first_seen":"2026-01-05T17:40:40.628563Z","last_seen":"2026-01-05T17:40:40.628563Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2050,"timings":{"blocked":858,"dns":0,"connect":0,"send":0,"wait":1192,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-12-09/02ea2323daf2365ec720ac5b9299eaff20251209140903267.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.176Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-12-09/02ea2323daf2365ec720ac5b9299eaff20251209140903267.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":6213,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"d639b2bd24ab88aacce54e2cecca23dc","sha1":"8c7344ea58bb1b062b3f5b09eca478cff5449277","sha256":"e9f90fdc527f5e1f5281945b4cd490c39bdc544912f5092f4d7db31c989342d6","sha512":"e2f45a652b13b522125b89a47cfcc184275917376bfc4f66fd172b29d81bcb7c0322c11925ac130f5286685458c610e3c7ad9c2244713ae1fd9278973516e07f","ssdeep":"192:WSv0OZLMuPLsg/2aXsyf641RGnMewLDVoyrMwF77hk:5v0ULM62aq41q6Zr/77G","tlshash":"e5d18e99b44b6d258a094873330a5b284dcf7ad751e83a9771d9f33ea21074e470b810","first_seen":"2026-01-05T17:40:40.629354Z","last_seen":"2026-01-05T17:40:40.629354Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1834,"timings":{"blocked":847,"dns":0,"connect":0,"send":0,"wait":987,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"wss","addr":"wsv3.nivex0.one/?m=8PPsMWHaflcMFwvZ4jGbw/1f5KgB5nHU/5kV6ABt9jILDGfvH6KoMw4y8gH1xTUdf7MUlS7hkyvxv8OqUQVl1SlNOf8=\u0026k=5RdkjLXEU3wVkjxf9EdG\u0026s=w","fqdn":"wsv3.nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"172.67.159.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.210Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nivex0.one","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 21:49:45 GMT","end":"Mon, 30 Mar 2026 22:47:22 GMT"},"fingerprint":{"sha1":"F3:75:42:AC:F4:B1:7A:7C:E8:04:E5:D0:28:3D:F4:39:81:43:13:7F","sha256":"31:21:32:21:BD:A2:A7:26:01:57:E2:D2:82:7C:27:AA:B6:20:97:FE:42:7B:00:B3:42:B2:66:33:59:46:80:FA"}}},"request":{"raw":"GET /?m=8PPsMWHaflcMFwvZ4jGbw/1f5KgB5nHU/5kV6ABt9jILDGfvH6KoMw4y8gH1xTUdf7MUlS7hkyvxv8OqUQVl1SlNOf8=\u0026k=5RdkjLXEU3wVkjxf9EdG\u0026s=w HTTP/1.1\r\nHost: wsv3.nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://nivex0.one\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: DhCX8hpXatdhqsz8pKoYSg==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nDate: Mon, 05 Jan 2026 17:40:06 GMT\r\nConnection: upgrade\r\nsec-websocket-accept: ++fxdiFJc4NhgERLhwHyen1/VhM=\r\nsec-websocket-version: 13\r\nsec-websocket-extensions: permessage-deflate; client_no_context_takeover; server_no_context_takeover\r\nvia: 1.1 google\r\nUpgrade: websocket\r\ncf-cache-status: DYNAMIC\r\nReport-To: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=3vAKPtUnApvy1LulESsD5Ydac1fCBki5MIKfAfjYQd%2BoS29tA2vuZLfyXOSaAxuqYQnDnvK9%2FWyDEM2gdhuggCy1MPuKHza7Xe%2Fbyx1piicw8t2fsdrxTwm%2F0YLrtHcltn4%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nNEL: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nAccess-Control-Allow-Methods: GET,HEAD,POST,OPTIONS\r\nAccess-Control-Allow-Origin: *\r\nServer: cloudflare\r\nCF-RAY: 9b94c23b889156c0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=599\u0026min_rtt=543\u0026rtt_var=202\u0026sent=5\u0026recv=8\u0026lost=0\u0026retrans=0\u0026sent_bytes=3180\u0026recv_bytes=1398\u0026delivery_rate=5958847\u0026cwnd=252\u0026unsent_bytes=0\u0026cid=5caa815a4f2904ed\u0026ts=2062\u0026x=0\"\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-10T23:57:25.058416Z","times_seen":17827247,"resource_available":true,"data":null}},"time_used":2070,"timings":{"blocked":3,"dns":0,"connect":1,"send":0,"wait":1234,"receive":0,"ssl":832},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"wsv3.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"wsv3.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"wsv3.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"wsv3.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"wsv3.nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"wsv3.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/async-validator.CRx4dHSJ.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.712Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/async-validator.CRx4dHSJ.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:32 GMT\r\netag: \"1767634592\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:32 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16927,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (16926)","md5":"5f9eecae1312c57a7a0f1284e3ad8c3f","sha1":"de8edccfc4b435345adb5a606f3f4eddb8a355db","sha256":"812fa20f5ea0132b7fa8343c5b1e31d99769d31df0a9ae316743b93d35d3ae6b","sha512":"a4d67e4b1e5a667ddebb60ae6b557e197147c01bda49591f5bb37e0ad99a4fdb270f2abf89add30fa280681d2368d40062cdac31e1d6fd9f8e97619bf78589e7","ssdeep":"384:vHO0Rvf5n5ta3W/YSrLQfqL3y/SAeePedHe2OedjedpedYedreShed9edveezeVU:bj5tEW/bi/DeePedHe2OedjedpedYedz","tlshash":"7d7272c836d9b41d86a360f5202ba056f22fb541586ddc45f3ede0fa6bf580e4213b7a","first_seen":"2026-01-05T17:40:40.59041Z","last_seen":"2026-01-05T17:40:40.59041Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1184,"timings":{"blocked":937,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/normalize-wheel-es.BQoi3Ox2.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.509Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/normalize-wheel-es.BQoi3Ox2.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:30 GMT\r\netag: \"1767634590\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:30 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 1457\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3103,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2616)","md5":"d683be5e2b15f2608fb0ea78f8d0435e","sha1":"477846374145623fa6bb0fa2ca792310513a8b37","sha256":"55cb7ec4e87f8f7165225884a2696f8fef524cb4428a4bb8f2d4f3710edab568","sha512":"f10db079fe4fd124e1af467b1d49f9e9ed3515ff5754637ecf857591e50cca228152a08a60d253b0bc042cbf13d0833296375774167f717410ba6ae0c0142391","ssdeep":"","tlshash":"0d5162fc7051b1b2511a3862283f560bbb7bf4f5292d6642ea288090bd34955c337fd9","first_seen":"2025-11-20T04:33:33.72042Z","last_seen":"2026-06-01T01:23:31.921688Z","times_seen":3,"resource_available":true,"data":null}},"time_used":419,"timings":{"blocked":188,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/css/index.-a00dYCq.css","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:56.464Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /css/index.-a00dYCq.css HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: text/css\r\ndate: Mon, 05 Jan 2026 17:37:06 GMT\r\netag: \"1767634626\"\r\nlast-modified: Mon, 05 Jan 2026 17:37:06 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 2309\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10267,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (10266)","md5":"4e08269e2beb20b6a862df5b07cd7d4f","sha1":"1168d5adbb03a3d0ce2fee57fec1e595d9636389","sha256":"5d3fb84315b23659dd64c3647d6d98250ab8a5c784af1d1708b634b0cba873c6","sha512":"dad73a4d63b95b39dee89f7038a34bf07de10a2fc7c4f0740c724a8b083caa3d3ea625e070f7be7222654b6f20e547034f601fcb86d73eafb69886ba17adc56f","ssdeep":"192:KI3XNjLGqt1gZaDQ+DdRJTUlud2UUaB8xqD96XhxhgMK3q:Ku9jtSCTq8zqo6hgMF","tlshash":"0322113f531551eee3b3fc8360c0bb48600ed143db5261bba95bee2b9aca191167b744","first_seen":"2026-01-05T17:40:40.630268Z","last_seen":"2026-01-05T17:40:40.630268Z","times_seen":1,"resource_available":false,"data":null}},"time_used":239,"timings":{"blocked":3,"dns":0,"connect":0,"send":0,"wait":231,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@zumer.CQXvgQnk.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.441Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/@zumer.CQXvgQnk.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:27 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":102707,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65534), with no line terminators","md5":"4247956666256a3b63c183f3ff06c02a","sha1":"e9aedb07e926d7bbca69321b01960cc9777f6362","sha256":"4c7e9dc9554affb3af9c63eadce63ba420e7b2f7efb202c0d6963bc815b47c24","sha512":"8a171c3c412ffe689b78c04045f14c44bf3c797ab722a9087d9a0789b96a52b4c56dd82f8f4d9c65a1d984ac8317130892d1b10c98769415855d58884aab5ab8","ssdeep":"3072:b6vRvK/GcTqOnFWUi06FgEezsiQ+E3n2qlp:bcRi/G2qOoUi06F3Wsiwn2qX","tlshash":"0da34a7433763137a3dd009a90ba4205f26c992949074c99e27e9c7b3979c86b2f7f78","first_seen":"2026-01-05T17:40:40.612346Z","last_seen":"2026-01-05T17:40:40.612346Z","times_seen":1,"resource_available":true,"data":null}},"time_used":230,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/css/element-plus.Btzusq17.css","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.146Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /css/element-plus.Btzusq17.css HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: text/css\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":153964,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65528), with no line terminators","md5":"db291ed5e7f535e2612e4c53640f5395","sha1":"9d295c26d7fba084af7094563d064a1bd25d3393","sha256":"07b936f05700cf54c284349cce939bae0ec9bd98ab465658517f69917c3ab66c","sha512":"cb919459d2db55a97b763a1e8859eab4fe41b00ec60e5b73a2067337925f202637285112f61cf7ef18944619188090e28ae67c8b9d3a9979ee1756125d58b8cd","ssdeep":"1536:1Ew75hWIchoFahmJoPQGFhaE6jhYD8dGCiTekJnw4OPYigeh9Tqzc5:rFawjTTqzW","tlshash":"87e37265e753a93b180be67c6ec4de996f04dfa1ca010771f644b00896c69b523e3e3e","first_seen":"2025-11-20T04:33:33.642578Z","last_seen":"2026-01-05T17:40:40.631114Z","times_seen":2,"resource_available":false,"data":null}},"time_used":334,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/css/driver.BXjlMtfo.css","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.147Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /css/driver.BXjlMtfo.css HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: text/css\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 1105\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3947,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (3946)","md5":"0eb18681dc15333ebc925bb22119ba13","sha1":"cf70e7ebd8bc6d87dadbb142abe950c859ea4484","sha256":"3bae4345076907e81b15f3f81040ebf85fa4194229a88c4dd69de877aa03dfe6","sha512":"4c68e222e6f5a3e3736534f59224cc3c9b47cd2bfdc67a8e9bd019a3cb944930113abbd74a285328cb963338a706dd0177fcf0feace350f1a82496ea30359cb4","ssdeep":"","tlshash":"b481326aa1441a10e13be7026c43eac533179f91f2f35b87b5175883c5c70dddeaba89","first_seen":"2025-09-13T12:19:18.542452Z","last_seen":"2026-08-08T02:55:11.801746Z","times_seen":14,"resource_available":false,"data":null}},"time_used":472,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":458,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/echarts.zwp60nWF.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.703Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/echarts.zwp60nWF.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:30 GMT\r\netag: \"1767634590\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:30 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":823843,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"9b4da79ed17dfb8f289faf2b51551708","sha1":"bb922a73f344ea36ab8be14c7bc93f5da55a8da6","sha256":"d44e8c097c359b31a10e86f880324a5747a10bdb20821318491193378b194931","sha512":"a05e698c3a1321ae6630da3a3d657d32a06b4a9fe45270a388edf81c8a6b986c58d9dabd1a0a24adaeb2a7825ff1fa393c646240d611b7b627a5e8493c33622a","ssdeep":"24576:tc/7E84kwVkXcxhPUMRm1Kps7zo5a51yWTTOP3:C7E84kwVicxhPUMUcps7zo5a/yWT6P3","tlshash":"8d05199c7a14742183a331b4157f050f9336280de98a8568fa99d4ea6dfd48a273ff7c","first_seen":"2026-01-05T17:40:40.530442Z","last_seen":"2026-01-05T17:40:40.530442Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1105,"timings":{"blocked":664,"dns":0,"connect":0,"send":0,"wait":441,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@ctrl.r5W6hzzQ.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.711Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/@ctrl.r5W6hzzQ.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:32 GMT\r\netag: \"1767634592\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:32 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14133,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (14132)","md5":"6c6404beb1aae34ea6704b981f8cee7d","sha1":"0c744e22fddbbf00c26abf9c8b1524de4afe002f","sha256":"6d58b80875bd909efc50174e828c6aea22d61a2c23283ae548ed40cad5c0f721","sha512":"835f85aa933de967a14aa2d48caf3991a2e22c94d65aa204f1028a64047dac6f0f9dbfd467d171a7e58a1323df6642bb7cee8238a27a188b8378dd1acfd6de09","ssdeep":"384:RS4TjiiMTnctos+tSc+kGG49Q94cZ+e4A:04Xi5n3G29p+G","tlshash":"0252749435d73069931a49b4130b0586b31fbcbe685e4578f4afc0f23cb9a58867af78","first_seen":"2025-11-20T04:33:33.75075Z","last_seen":"2026-01-05T17:40:40.550747Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1183,"timings":{"blocked":695,"dns":0,"connect":0,"send":0,"wait":488,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/node-forge.CDxHW0a1.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.677Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/node-forge.CDxHW0a1.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":282038,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"da91b632d15a2000c026aaf4b28ac4e7","sha1":"f784d108a7827dcae17df6178c6b1936e1ae0050","sha256":"82c1c8ccb1e189a2f841081ac5ade2e60f7aa83743c4df7a1626b94bd60b1e5a","sha512":"9bee5f2b3452fc1368d562d808e93a4f5ec2971a2d8a4877b5781ed600b09ac79b91ed47d67895684e783d7d4526bfe9e3531c4d0908f406e5b94b0a303e9c22","ssdeep":"3072:hUkElpRjQRnFR3OkKXUZXuuEyL6AUaBlnpew5FQhO5GG:hUkElpRjWnFR3AMEyLp5npew5+hmGG","tlshash":"3354398436b078f043b352f7182f814bb135a519a42e4925f964d8dab9bcf9cd13eb78","first_seen":"2026-01-05T17:40:40.557932Z","last_seen":"2026-01-05T17:40:40.557932Z","times_seen":1,"resource_available":true,"data":null}},"time_used":460,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":460,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/element-plus.vfrBwH7m.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.689Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/element-plus.vfrBwH7m.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:30 GMT\r\netag: \"1767634590\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:30 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":364707,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"5ef31429c432e416c001faac78287ac7","sha1":"70095f9cb4fd76c37b749fd486c7a33bf1e721a1","sha256":"a3ed356556baa3b1ede8048be459737be43be4aa7840e8cde203c96b0d56cddd","sha512":"ab3736383d75ee3c3eeece1aa9515301f46490923be3686a0441e0479b665178d73fc8b02276b256d8117e9b488ce1fb4948047cc8530f9cd6bcf7ce3a2483f8","ssdeep":"6144:VvO7nkE6rFnoyHXAkWe+E35WiO7SJP3ulduHUVhY:VvO7k6y3pd353R3ulcChY","tlshash":"f5744cc9b6a57836a2f964c4d0b9050975181f09f010d8f1b9ff8a1923aad4062fffbd","first_seen":"2026-01-05T17:40:40.632763Z","last_seen":"2026-01-05T17:40:40.632763Z","times_seen":1,"resource_available":true,"data":null}},"time_used":536,"timings":{"blocked":32,"dns":0,"connect":0,"send":0,"wait":504,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/svg-icons.BOKYaZuS.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.699Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/svg-icons.BOKYaZuS.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:31 GMT\r\netag: \"1767634591\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:31 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":1756479,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"179bac31789bce5c48d6d31a06e27593","sha1":"9eb2012d87ae868d159cb6f5049124646ccaae11","sha256":"744fe8e3fc730cf6c54940c075a15d446bce0918a2675ee62d39c999883735bc","sha512":"34680d613088ddced218b7ab0be66ae9ca7aca828a11327fd72040cd479a4427a7b4493befb56def18d7b5d9359adf1cc12468de59bbe381f245cc59ad1a6f2c","ssdeep":"12288:0uAkFkVT4QMcnr8cbeTBl9PgpjhmwFmri:0uAjTKe4TOOi","tlshash":"a0250bd76734939c99cbd99eef26a4e4231f50faba7b84c0499f8b6850478c8f607c50","first_seen":"2026-01-05T17:40:40.598045Z","last_seen":"2026-01-05T17:40:40.598045Z","times_seen":1,"resource_available":false,"data":null}},"time_used":751,"timings":{"blocked":522,"dns":0,"connect":0,"send":0,"wait":229,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/CommonTable.u-6JAKnR.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.848Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/CommonTable.u-6JAKnR.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/price.BpPWlJRd.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: \"1767634797\"\r\nlast-modified: Mon, 05 Jan 2026 17:39:57 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 2453\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5847,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (5846)","md5":"7eeb2f23bfc453036cce671ddd71cb0d","sha1":"39b41bd0de886fd13e5e9ed1caba5596e74ecf9f","sha256":"90c0aba5c57539aeb255a33503c1ef903554f00a928de56ba6c5f5f9ebb32f32","sha512":"da141f8f4f7f6ddd11bc0ff70b0ba4e1e3f5c2a192f92cbdb5c3834cf7e7378fb20667ec3ce73f911c787dc3fb978c7d7db5418a64b0caa2c11213a43ff836fc","ssdeep":"96:UZvCLlM4Y98LweVc5AZ7/P85EspMQ3fAGHUmBc6QGdI/UFce9pwwWDgS:UQLlMvEc5AZ7/PmtZ3IGteYfFBpwsS","tlshash":"0dc1e668b8badcb963ebc1b830194420a51d3b9ed010a4f1a1ff1e1617ced54838fb39","first_seen":"2026-01-05T17:40:40.585424Z","last_seen":"2026-01-05T17:40:40.585424Z","times_seen":1,"resource_available":true,"data":null}},"time_used":229,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":229,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2024-10-04/30fdd5632f40e854c8cca712a693adf220241004171826147.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.066Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2024-10-04/30fdd5632f40e854c8cca712a693adf220241004171826147.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":27327,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"17c9708d02f6ad0cd18b4e07ae2c39d1","sha1":"a01b5cd8fe1982a9370dd0de5d08c12b490f87e7","sha256":"f843aee4c6d41869770190e0c74c3c8c6c9108a3c154b1aeb42d60efcff6b31a","sha512":"222659270713d840dd741711866db8afacdc6aca8e6b79ab24d7a1725fce37ce7706b8984bc03d4de2c5b5e14b9e467ffe1755625b164610f9ec1e698d69d3c8","ssdeep":"768:qE0gfWXbi0ZBKoAlch520Yu79fWOMBCGxsR0Jcs76GZQ:qifN0ZBvdhNP9JisRmcFGG","tlshash":"55c2e1a3a685ad78a3b0fd491c8f9ae550ceafc9a1d952cc084217270b5dec379170f7","first_seen":"2025-09-13T12:19:18.506962Z","last_seen":"2026-06-01T01:23:32.110032Z","times_seen":5,"resource_available":false,"data":null}},"time_used":3043,"timings":{"blocked":1014,"dns":12,"connect":20,"send":0,"wait":964,"receive":0,"ssl":1025},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2024-12-31/f7e115e58707c5e35d0d80bacf1a91ad20241231153332657.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.127Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2024-12-31/f7e115e58707c5e35d0d80bacf1a91ad20241231153332657.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":3814,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"0adba51c94536194c4b5bd65c21a2af1","sha1":"b701ee68cd82df89650c7b3496ab864b14998800","sha256":"c3823836867d214311e16db5a6e8b1cf2da1d497d898a9bfc35595ad9ec0d7f5","sha512":"4f1de1fbf7ef74c875bdd39751b4eb2bb9a414c48e0fbfe46dcf97df84fe519819027f2ab1e123b3a2968e3bd0a6a6cd8a00514c13da1472026fbedb98bb82aa","ssdeep":"","tlshash":"32717dc0c61d6bae788753949612b99c041e1d2022065b7acef2b93b860ffdd49aa744","first_seen":"2025-09-13T12:19:18.561724Z","last_seen":"2026-01-05T17:40:40.634494Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1750,"timings":{"blocked":894,"dns":0,"connect":0,"send":0,"wait":856,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-01-03/4c9987ed5e85a13f4ee764d678f0e43c20250103103052933.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.136Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-01-03/4c9987ed5e85a13f4ee764d678f0e43c20250103103052933.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":6525,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"64f8efc66004bb4ee919e9acc72d4f14","sha1":"6557863ba41d886666b6bb639df211d3eb1a1d4b","sha256":"07a98b9e26e3735fda5cee729e4c6e9c6b2319262eb03620fa4c54224c52657e","sha512":"b228c4d25af48eb1b734a9695d2dcf251ead134c5a210b40cbaa1197903755c3990a33ee48f8f6f717679fc178586f8e6402ce3fa66637f0b3069816fe32a1e4","ssdeep":"96:WST1VKCn0StgU8HTv0DSTucUfcyyKlphuMxNSbVsMLF370dbr9koHOSsQY+3+HB:WST1AnPzu4tUjKfnJ7M9koHybB","tlshash":"9dd18d9f821ea07ee6e814bb86a5924e72c67f6f0cf90a4d49016250678e89103e76a0","first_seen":"2025-09-13T12:19:18.510717Z","last_seen":"2026-01-05T17:40:40.635385Z","times_seen":4,"resource_available":false,"data":null}},"time_used":2076,"timings":{"blocked":885,"dns":0,"connect":0,"send":0,"wait":1191,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20211023/UCtS87944479843.jpg","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.152Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20211023/UCtS87944479843.jpg HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxNPRpf6nsqCAFQ-3oaKy4O3i-7v36QTUUuBdqhs3CFURrUyDT0aZbuQDldJlVt8O7ZE\r\nx-goog-generation: 1729754943881434\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 4898\r\nx-goog-hash: crc32c=/YbqrA==, md5=dk8wKVpQlDnFTXELBu0pNg==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 4898\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:29:03 GMT\r\netag: \"764f30295a509439c54d710b06ed2936\"\r\ncontent-type: image/jpeg\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":4898,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"764f30295a509439c54d710b06ed2936","sha1":"d48ed4a1aed27892467e3259d15c00e336107426","sha256":"2cf1137e72e02d29c313029dca55326fffc0e9dd7d20b60b43c023f049f9cb45","sha512":"3dc7cde15fbcb4c165fb27cf5922fdfe66d8c46f248d37240f28966984bf6226bf62a30e7d56aba1f8eba0cd075f3a6b0c1f5de250a2c5c193f58c3c4d741faf","ssdeep":"96:lPwS8n5CuOi9ZxH0HL0wcThzSISTUCBQiSR3QhI3wKtgqfRCtf2JIV:65x9Zx+0rh1SpB1h6w8UcJM","tlshash":"aba17d6b7b62fa558d8039f66048f313fa71ec7b76716d181ccf27650a8034d9a8e864","first_seen":"2025-09-13T12:19:18.581748Z","last_seen":"2026-06-01T01:23:32.05986Z","times_seen":5,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":290,"dns":0,"connect":0,"send":0,"wait":36,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/deep-pick-omit.CegYQlcN.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.710Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/deep-pick-omit.CegYQlcN.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 488\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1115,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1114)","md5":"a4cc76d93ad7c139918ef0aa35694ebb","sha1":"ccd84f6a6816906f3db230344b9db2927fefb8ac","sha256":"95bed3fc3d3efe7f365ac84ae15d3b75e7febe9f3ced0e36eac59421f1cf6781","sha512":"89291e9c53df46b0634f892781031e188991f36ac836e25e0ef9b42dd28ae38558daa1551d327415e5706687fe33c240eefbd38463e00b758728095f97866733","ssdeep":"","tlshash":"782130e2bbea9074837218f4180e819ef33c580d299d5480e218e8a132f7861e7a392d","first_seen":"2025-11-20T04:33:33.648908Z","last_seen":"2026-01-05T17:40:40.543392Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1183,"timings":{"blocked":695,"dns":0,"connect":0,"send":0,"wait":488,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@popperjs.DB1lLFnh.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.508Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/@popperjs.DB1lLFnh.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:30 GMT\r\netag: \"1767634590\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:30 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":19729,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (19728)","md5":"002dd210431845bbe306a8b1160f44c9","sha1":"eb81ca291df0ffbcc66aff752bdf7112d75fc61f","sha256":"5a5df9e8a4943e3172c56c17450c73bcac992464e16ae775c2364520884eda64","sha512":"ef73243fdd2633cf62132fd57f8d07e33e51fcda2e1f1fd910e7b8f131fe9c6c4d628e8765094ead939e073cf974c0cb4ea94943917d466a9f8911ea5c81d8c3","ssdeep":"384:yrwANx/2ItpItrwnAF8dbvgWklk5R97jzfZ/q6rHoQ4AydetatMiCWtgV:yrHNx/2ItpUrwnAOdbYC97jV/q6rHEA5","tlshash":"a092c5883654f0b6072b82fa807f510eb2336560524fe510b155e6de3c79eba622bd7f","first_seen":"2025-11-20T04:33:33.768516Z","last_seen":"2026-01-05T17:40:40.621203Z","times_seen":2,"resource_available":true,"data":null}},"time_used":415,"timings":{"blocked":185,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/driver.js.DwQe8DM_.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.518Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/driver.js.DwQe8DM_.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:32 GMT\r\netag: \"1767634592\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:32 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21381,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (21380)","md5":"62568581f5f4d7d014ac2f6d36d5bf52","sha1":"4749d411e76e5fd86eb4747135928fae2879e95e","sha256":"fa3ec02b5fc44a795848eba155c7678f0cc8ab5b8f8a6106d5df6d302d00d04d","sha512":"2c44aecf390af1f5877140a1b509640031bcf4bb06920da50a2aebd7c751c5bfd5a72e2ed956162d36b1300062faf0aa194d9353c8c00342d489949a16df988f","ssdeep":"384:iD5RhuDbV8isIuPLUZUiNu9GWZ2AyeJQXjy3byX0EqdIWIAyXcGoR3HW/ugjbr0b:iDnhuHDnuPoZUiNusWYveJ5OX1X0BW/Q","tlshash":"93a2d95834103936927f7c5ed57783457b342374f9038a91707f882a271adcae27aabe","first_seen":"2026-01-05T17:40:40.596445Z","last_seen":"2026-01-05T17:40:40.596445Z","times_seen":1,"resource_available":true,"data":null}},"time_used":624,"timings":{"blocked":393,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/css/vabNodata.CGATU3GY.css","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.001Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /css/vabNodata.CGATU3GY.css HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-type: text/css\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: \"695b1917-1eb\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:19 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: UPDATING\r\ncontent-length: 491\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":491,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (490)","md5":"019c7369e42960f82d3f68cad4e3a556","sha1":"e46266c7528253134f5bda4d5828e9ebbba63119","sha256":"d09bb651abf8d230f95c980238d85937c1cab558a386387aa61722fc17e736e7","sha512":"17b842180be619f94e49fd7c563e00b725c8628907b9309424251eb869560afaa00e3f95c62de86d9ce495c8d2158b0043437409c6da17b0acf84920a2936d50","ssdeep":"","tlshash":"bff0b42f3171aab6f99f7df71518a5892040b9028f43cba6d457dd21d9d20f33379604","first_seen":"2026-01-05T17:40:40.637193Z","last_seen":"2026-06-01T01:23:31.907517Z","times_seen":2,"resource_available":false,"data":null}},"time_used":236,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":236,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/css/index.EvRQB-66.css","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.008Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /css/index.EvRQB-66.css HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: text/css\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: W/\"695b1917-fca\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:19 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: UPDATING\r\ncontent-length: 1133\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4042,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4041)","md5":"2081d340e9d99c2b69b66f2f3ad32f20","sha1":"5fdf428d40f0bb25bb85a1716af61a677d12059b","sha256":"ebbb9bc2e2b712495721bb3b75a58650c24be274488a750d568d047be85f510e","sha512":"8789a84e67401874e0b3f8db3e3aa314708a1fb8b6c57d1f5033e235ef9b4d60893af137c9f12899f8f5d9dfe0776af0658e8b5f1b4cbf26b59c50ad31f36622","ssdeep":"","tlshash":"ee8100623b1738b7e876e4bed46c6adc1a003f23579787f2d6406c098886966633de58","first_seen":"2026-01-05T17:40:40.638097Z","last_seen":"2026-06-01T01:23:31.861994Z","times_seen":2,"resource_available":false,"data":null}},"time_used":241,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":241,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20210717/kOo518630632878.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.183Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20210717/kOo518630632878.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxN-aMoNFsFfwwWzmrj-3qW9VVTgsB0btDdGK8Y3007dRuEGKfa6ja2LeUlT_0ZGBy4f\r\nx-goog-generation: 1729754913771655\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 3271\r\nx-goog-hash: crc32c=NVH/Aw==, md5=xNpiklYM485CRgX/lvQoPQ==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 3271\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:55 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:55 GMT\r\ncache-control: public, max-age=3600\r\nage: 1149\r\nlast-modified: Thu, 24 Oct 2024 07:28:33 GMT\r\netag: \"c4da6292560ce3ce424605ff96f4283d\"\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":3271,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"c4da6292560ce3ce424605ff96f4283d","sha1":"e1307c2f65dae3ff0aa1233a278c4beecf8bd915","sha256":"e53336e39d46a1dcd49990fc8f0f27cdcd2520ab155bfc3665f17622d6b54909","sha512":"ab696fbf1ec053559d04eb1aa0640136fee8e32fd9cd45f1e378b909e3b1053227d4087a189ad5cd7bdb87e37801d52e7a0f45b5693634a7873e7e69c782f2d7","ssdeep":"","tlshash":"aa613bfe029e57ffdb7340366e07a0247e58418092f3e5e437cda5d26522a683e26d49","first_seen":"2025-09-13T12:19:18.571391Z","last_seen":"2026-06-01T01:23:32.006746Z","times_seen":5,"resource_available":false,"data":null}},"time_used":298,"timings":{"blocked":260,"dns":0,"connect":0,"send":0,"wait":38,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20210717/6qd918551610729.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.190Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20210717/6qd918551610729.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxPWyf8__Hf7xTEYF0akZdDPnESqMAgqYj9JzZNnLELsK3x6KnUA-bQtqbmsOZCNxFFT\r\nx-goog-generation: 1729754914122837\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 6611\r\nx-goog-hash: crc32c=NUiAmg==, md5=WAwmn2SbRVbUNno2eEwJMg==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 6611\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:28:34 GMT\r\netag: \"580c269f649b4556d4367a36784c0932\"\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":6611,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"580c269f649b4556d4367a36784c0932","sha1":"c607b0c89634dc2daadc6d8dd9ac71d7386d3af1","sha256":"631158eba073edc5ebd6cc1a06b9993012f8605ae55af1fd6fe9954d6a7254f8","sha512":"3b286a249626b2b9183507d86da864c7d6addc84f6b48c15ad7da629d596c03439d5051c5f4719af7ffca8788dbb81d8ddbda9b82b9098109946f7668e8e3ce5","ssdeep":"96:lPwXB9agjuLWQfI+tqfTh2PhtCMLYPM3cg0UI7eK/ZV1QkFaOxMxttCuVFt:6XB4zfIWOTh2ZEMLDm/b6OJxS7","tlshash":"97d1af89a1b0d0a5fb813ffe65c97e72d331dddc491e92e1b01deba2ac48a86841d543","first_seen":"2025-09-13T12:19:18.573313Z","last_seen":"2026-06-01T01:23:32.081026Z","times_seen":5,"resource_available":false,"data":null}},"time_used":296,"timings":{"blocked":254,"dns":0,"connect":0,"send":0,"wait":41,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-09-30/4d26b166bd5ae6bce9ea1eb51ccc138720250930195844557.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.202Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-09-30/4d26b166bd5ae6bce9ea1eb51ccc138720250930195844557.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":12903,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"d2d2feee0b2d9426191da779fab1ccd1","sha1":"2c9e6e880b0ec69175fc97a6099d797101c3339a","sha256":"c119b0e0a79dd932d2ab1aeb5c3e62c3609771bf4a43eb5a0276e9366128a339","sha512":"64aa44b11029400dbc1accaea8806e1ef00421cb38afcba8d27440e7c74311569701ff31e2021f17c58f2c6a9654f5f90c7e5f70c01961e527411419af8ccde6","ssdeep":"384:5002kMjQcntOF1oGcb0svcsrBOGdMvZkO5L:JMjQc4oGy3rBLdMvKOB","tlshash":"4c42d08fac8d202b20a015fb655c91a98b645af45b28531ee276fd1f57325fc704e431","first_seen":"2025-10-18T06:45:34.883619Z","last_seen":"2026-01-05T17:40:40.641245Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1917,"timings":{"blocked":826,"dns":0,"connect":0,"send":0,"wait":1091,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/element-plus.vfrBwH7m.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.510Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/element-plus.vfrBwH7m.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:30 GMT\r\netag: \"1767634590\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:30 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":364707,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"5ef31429c432e416c001faac78287ac7","sha1":"70095f9cb4fd76c37b749fd486c7a33bf1e721a1","sha256":"a3ed356556baa3b1ede8048be459737be43be4aa7840e8cde203c96b0d56cddd","sha512":"ab3736383d75ee3c3eeece1aa9515301f46490923be3686a0441e0479b665178d73fc8b02276b256d8117e9b488ce1fb4948047cc8530f9cd6bcf7ce3a2483f8","ssdeep":"6144:VvO7nkE6rFnoyHXAkWe+E35WiO7SJP3ulduHUVhY:VvO7k6y3pd353R3ulcChY","tlshash":"f5744cc9b6a57836a2f964c4d0b9050975181f09f010d8f1b9ff8a1923aad4062fffbd","first_seen":"2026-01-05T17:40:40.632763Z","last_seen":"2026-01-05T17:40:40.632763Z","times_seen":1,"resource_available":true,"data":null}},"time_used":428,"timings":{"blocked":197,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/woff2/ping-fang-sc-semibold.BvGeR4Sy.woff2","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.462Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /woff2/ping-fang-sc-semibold.BvGeR4Sy.woff2 HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/css/index.D6p3pYi2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-type: font/woff2\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: \"695b1916-c6528\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:18 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: UPDATING\r\ncontent-length: 812328\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":812328,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 812328, version 1.0","md5":"8f29e56a6fb7408bd689b970cea92d34","sha1":"a7c2deb7c37712bb44906ad8cb7aa2d8369a9c8d","sha256":"5381837ef63a8db6c588a62fddd73177d0c0d8da239a0905aba6e71844900550","sha512":"0b7bbd76598cea2c8dfce13071a9635bed3cf621a199d9d6268dad8ef3bfb3032fc6fe50a64301a3e0427c010032052f4e611edfb3b4c55d24ae5441a20cfc42","ssdeep":"24576:P6FA0CL3QRBgFRrbbsRdS+oFbPF9RcA67:QA0CL3QRBgFBbbsq+6JcAu","tlshash":"650523224b66bd4cd6f935351bc43b60e4f098aeeeb173f90df610a450bb8d64b912c6","first_seen":"2025-11-20T04:33:33.783371Z","last_seen":"2026-01-05T17:40:40.642139Z","times_seen":2,"resource_available":false,"data":null}},"time_used":519,"timings":{"blocked":104,"dns":0,"connect":0,"send":0,"wait":235,"receive":180,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20211117/J5vL46776864863.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.186Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20211117/J5vL46776864863.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxPF0Xt8OPpp_wxORK1P4gb-lxPjoFRJEDJFwG0my6gCPCmnyIBzBhLP0GDaDLMW8DNCmzaS3Fg\r\nx-goog-generation: 1729754978313895\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 5168\r\nx-goog-hash: crc32c=ZqffsA==, md5=KR+8UJkCj1wwdJa9ACZzpA==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 5168\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:55 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:55 GMT\r\ncache-control: public, max-age=3600\r\nage: 1149\r\nlast-modified: Thu, 24 Oct 2024 07:29:38 GMT\r\netag: \"291fbc5099028f5c307496bd002673a4\"\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":5168,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"291fbc5099028f5c307496bd002673a4","sha1":"0a77003e6871dd3d9928f0952aa00c3b3d8fd614","sha256":"81a188ff0ea3bd5a90029d400e01eef6f6725b93b8812d8f689df9c231eb6f01","sha512":"f69d03e1333b6e56a6362d053575585c20e2e6e19d8e601d3d9b351a6ee1666906560a5ac09495da85eebeb85c34c4700e527a17bf0ee5c0a80a58e64483d806","ssdeep":"96:lPw3ivez2k7dYNNk46CeQprNhOxUbBnBFu0nzqt9hu6m9pxzhZi:6S2NJ43eQDh0eu0na5MxtZi","tlshash":"d0b18ecb62c4b72ee52e203a4d733314e4ee13e4a119b13976560756487ce83bd64d3b","first_seen":"2025-09-13T12:19:18.572262Z","last_seen":"2026-01-05T17:40:40.643078Z","times_seen":4,"resource_available":false,"data":null}},"time_used":297,"timings":{"blocked":257,"dns":0,"connect":0,"send":0,"wait":39,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/css/index.D6p3pYi2.css","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.149Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /css/index.D6p3pYi2.css HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: text/css\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":100408,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"0fbad66ec611547b27fb00caee2a9a37","sha1":"89cbc0b79af9383f0da06707452f0e6bf620e153","sha256":"4bd9343c78d5bdccbe114eb4a963c6bc62bcb5b429a1dee6c5da7d1ee70cfe56","sha512":"cd48cec1f63630ba603fd18a33e60fad63f54c2e70522091951e9e90993d1bce422bce4c40a671626150ded0ba08bd0556455c848a2f222a7e62a46382af0e34","ssdeep":"1536:1k22BO94RLPZWvBxqVr8+UjW1HyoLLS8LhHI:1vXQZWE1HyoLL9pI","tlshash":"36a3d66ab21ad57aee37fcfb625cfa1c1918b103cf1117a5f5427d1099c66f3023aa18","first_seen":"2026-01-05T17:40:40.644494Z","last_seen":"2026-01-05T17:40:40.644494Z","times_seen":1,"resource_available":false,"data":null}},"time_used":471,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":471,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/CryptoJS.CZ6NzDv9.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.690Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/CryptoJS.CZ6NzDv9.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:30 GMT\r\netag: \"1767634590\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:30 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 3449\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":5469,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (5468)","md5":"a538e2a71ea76e17d6f0aca8cc8a40c3","sha1":"959f52f2a521a87d5105493248c5cfd160edd925","sha256":"771218d31c64a5c41252be6fa4c2fb9806fd83c23994c688cd86d69250b36a1e","sha512":"71d40c6b646db6f452c5080d5d8c06f5f4d638ff39de3e2cb0730a82968107861d554479d7f2796f2bfb7b4d3952cc20552ad23fab9c679db26f3d68c2f68520","ssdeep":"96:4ZRf9tjAoJoQJbaGTJtgZ5rxtm14bUMVtumNWZek3E8+3sk7okTFFes0WvbZdmj9:sf9JGiTJtgZlq1bM3NWZe/8CT7okhFel","tlshash":"bdb14c9ef4e1a09143c51a1194ffe01af27f76b9264e8751fc4a0b963d1d462e336b0c","first_seen":"2026-01-05T17:40:40.591251Z","last_seen":"2026-01-05T17:40:40.591251Z","times_seen":1,"resource_available":true,"data":null}},"time_used":677,"timings":{"blocked":220,"dns":0,"connect":0,"send":0,"wait":455,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/crypto-js.BH2pn90r.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.476Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/crypto-js.BH2pn90r.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":69877,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (30402)","md5":"db0597f008285a2a858f0b7fe15b2d19","sha1":"27c621d9cd3d793df519c651c1168f32b3ceff88","sha256":"98efa226698a1d9bf8682d4ae907802fa30e67f6c86817a0d63b420f83d70e76","sha512":"1029b202b5070647cdcb9f82fdc136318d7648fc45c5990e281e8c41993499651ea70473e6fe5e855cfee1ab4db06cd4c02545a57698b84f062278a3b9a21e76","ssdeep":"1536:dQtqIbmLNBJuZ2prjJJXEPtNPU9ArHMhnt:d8KnoZiZnt","tlshash":"9d6349c636d871c1a3a734e0093f204fb1773462095c99a8e565fade6cac5dd807ad3d","first_seen":"2025-11-20T04:33:33.565087Z","last_seen":"2026-01-05T17:40:40.566065Z","times_seen":2,"resource_available":true,"data":null}},"time_used":229,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":229,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/crypt.cVg_o3mt.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.479Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/crypt.cVg_o3mt.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 665\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1322,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1321)","md5":"d27fd807f99b497419ce55c51be4cddb","sha1":"bf82e7387d8b65978d6dd5a5bf2197b113882ebe","sha256":"e58c06f4ec67f2d067ac3d6ebf7c57dec9a85efc5633e447c7bc3f36287ea582","sha512":"31ea6c8793ec7934ae99f2747c8eebbdb3385fd3d4705eb877431fcb4eb7b92b454f68a71345b2a7ce14935176537fee2b9288bc2a58cfd7b324ed15032d1aeb","ssdeep":"","tlshash":"2821b3a235c5acea531399680c2f5103e07aae938d5f4581db20c5c5dce4eadd06ad58","first_seen":"2025-11-20T04:33:33.749134Z","last_seen":"2026-06-01T01:23:32.077736Z","times_seen":3,"resource_available":true,"data":null}},"time_used":230,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/js-base64.BbY-I90a.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.490Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/js-base64.BbY-I90a.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 1654\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3770,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3769)","md5":"d977b6abdc9dfa895ba2908444bc1a4c","sha1":"c927a78b94191e33082e93268d76328889ef28aa","sha256":"1d9533f0a528208faf28cf35da9b3f329d884fb4b03b55e17aeabf56b7ff2e65","sha512":"5780e3b033c076ccd1fb6ba001afa991886fc73212178eb117021ce7a3c1426ee54eea49805d3be85163b081ac0db732987fc6690e176f7203b54598725e6df9","ssdeep":"","tlshash":"b47185493d52b15b46fbb24634cb488afebcafac188d40d4f6051c6e31b2dc810a7f68","first_seen":"2025-06-24T03:29:59.818674Z","last_seen":"2026-05-19T07:58:02.670902Z","times_seen":4,"resource_available":true,"data":null}},"time_used":239,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":236,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/firsr-home.3rw-CFnS.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.315Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/firsr-home.3rw-CFnS.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: W/\"695b1917-3409\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:19 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: UPDATING\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13321,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (13320)","md5":"b15d9d858c782daff9a351aa61686912","sha1":"219e7271626d3f817c8aa557a92aa5b0faa359b8","sha256":"6e37f71bdde4d3f6140087662c86da6bbf0f01b93b20ca54ae5f46c96b1b1846","sha512":"7cdf8c40f39da26eafac76e501e082c9a5e592a4338109a38891bf9300975db21474279f60140f11491c7bd2f351312bb00a70ec3e1a9bcfa699d32d554009df","ssdeep":"192:uZZLidJEUN0/nb+BFwTF2jIY61J4aiL4uwYyIJ0rS0xhbgfVjRO5s/mPtVKhR9cF:uPYw/nb+BFwTF2jI8XMlEjRO5yjhRI9n","tlshash":"ad5219e9b091c4754ba7d5df882a030013362297689c826dfaed4cf26648d5ed2b8f76","first_seen":"2026-01-05T17:40:40.536904Z","last_seen":"2026-01-05T17:40:40.536904Z","times_seen":1,"resource_available":true,"data":null}},"time_used":238,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":238,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"contract.nivex0.one/pub/ticker","fqdn":"contract.nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"104.21.41.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:00.848Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nivex0.one","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 21:49:45 GMT","end":"Mon, 30 Mar 2026 22:47:22 GMT"},"fingerprint":{"sha1":"F3:75:42:AC:F4:B1:7A:7C:E8:04:E5:D0:28:3D:F4:39:81:43:13:7F","sha256":"31:21:32:21:BD:A2:A7:26:01:57:E2:D2:82:7C:27:AA:B6:20:97:FE:42:7B:00:B3:42:B2:66:33:59:46:80:FA"}}},"request":{"raw":"POST /pub/ticker HTTP/1.1\r\nHost: contract.nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 195\r\nOrigin: https://nivex0.one\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":195,"data":"app_id=glqM63yrAri7JojgtRePgFl3\u0026device_id=8c414030-ea5d-11f0-b736-f91c6883da20\u0026lang=en\u0026__channel=15\u0026__platform=3\u0026__timestamp=1767634800844\u0026__version=5.0.8\u0026_CDCODE=1cb7c40402d166593d9d3b6941754d32"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Mon, 05 Jan 2026 17:40:02 GMT\r\ncontent-type: application/json\r\ncontent-length: 13887\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: content-type,token,sign,Source\r\naccess-control-request-method: GET,POST\r\ncontent-encoding: gzip\r\nvia: 1.1 google, 1.1 google\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-methods: GET,HEAD,POST,OPTIONS\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WdyDpZJNVxabD6DMDtltXfexUyakNTGEn2VtVQrNVJb3OSj4w%2B36fUQpE%2FKZ7Z0KAC7UN1BAkfFTWosnzwb5czQEdv58bm4%2BAvD%2BSCT3ExX7\"}]}\r\ncf-ray: 9b94c2215e8c712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":39243,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"df3df04189b7e89051605343b3e84136","sha1":"4a6ae6239efdb5bcb7a714290c18dedc258f774c","sha256":"e448faa9d0d0f0f760a09dd7609b2aa2d658e923e151f3fb9970ce2d1ed33cb3","sha512":"e7e5c93f23c3dd44c06082ba533e707a70f6c61e900260c6148a1b2e7e909e42fec4b00f9929f1f3420cb4798f1069030d6526a87033c505b9089de4673fe508","ssdeep":"768:vJO6T3TjIo6o/KRMoWAmmNIkOvQmmWGJuv0Qk:/3gMKpsRQ4vBk","tlshash":"bc0367420ebc298dce304f480b83f5f4a52f325adad28b91676ddd1520c9bcb7745ada","first_seen":"2026-01-05T17:40:40.645374Z","last_seen":"2026-01-05T17:40:40.645374Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1317,"timings":{"blocked":8,"dns":0,"connect":0,"send":0,"wait":1300,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"contract.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"contract.nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"contract.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"contract.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"contract.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"contract.nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-12-09/2b154b6cf3171c53e2369e1447c1eddd20251209152253250.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.106Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-12-09/2b154b6cf3171c53e2369e1447c1eddd20251209152253250.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":6375,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"1527984d80dbdb7d6e56e2d2d77715f2","sha1":"ecb5fc76658464a38dc3e2d5fd5f87808b4a8bd6","sha256":"8f8474e9323aa79994cbd5b85173d718d08028d1f9468188ed80dff2e9d75aca","sha512":"8795542f1025df655c586ccf38b8cf8bb02bf2c1a9f76e00c803fd70dd7f82541d10d107cbd88e1796c0e459400c6421a5c2eaec042769d4078555de74f9f245","ssdeep":"192:WSMZY+/EFXiWprhHx0e6FFScbkPGisBwYGe:5MZY+/EFyW5TL6/xgPGisFGe","tlshash":"80d1ae8a4f4e1fe242752912223f5ab63b4f2f9836a94808225138dc752f404fe2d19b","first_seen":"2026-01-05T17:40:40.646565Z","last_seen":"2026-01-05T17:40:40.646565Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1684,"timings":{"blocked":915,"dns":0,"connect":0,"send":0,"wait":769,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/pinia.Bp2oHvSE.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.665Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/pinia.Bp2oHvSE.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 2004\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3898,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3668)","md5":"8d133b0628c08dd038e0305ed548736c","sha1":"5f5e2dd9d7880e89d06cc4c9c527c299f72fbffb","sha256":"6606918a952f7ff6ab668de0c9f55e446fb4f39d5d8a27f3788fcfa7a18e2d96","sha512":"5e6ed5e2ece297d04a8efbdb2f0dfd7d72b3961d6b5f10d8abd33c3bd54b978c3b4138be343b0489cfdcb087e9010bb235983be52e4dc98c2b9c99901c89824d","ssdeep":"","tlshash":"4581b6ad36e1b43c5bba04e8013f6829e3776148305b98d1b25daaf5383204d665bf6e","first_seen":"2026-01-05T17:40:40.559551Z","last_seen":"2026-01-05T17:40:40.559551Z","times_seen":1,"resource_available":true,"data":null}},"time_used":403,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":400,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/pinia-plugin-persistedstate.Cat8D07D.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.686Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/pinia-plugin-persistedstate.Cat8D07D.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:31 GMT\r\netag: \"1767634591\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:31 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 790\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1522,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1521)","md5":"e44341588f7509c4a04f35785816764e","sha1":"8ac440a8f1bdb71f8679d37c5945f1510e82533b","sha256":"57d71e73e2860fd8db96652f840a7d3589e034ec0549cfd0ef8269cf986040c1","sha512":"f6433abd4f1fa9a294e09bd6622324a118dd61e4ef310f2dce79fe7f52d0ab0753e05b7e5c19d3aa1ddb4de2af82c6efddc9dfdd9c872bc16a2c6c74fd2ce1a2","ssdeep":"","tlshash":"5131758c11260d3151b634dc58eba5535131815f1f1ccba0e4aa5fe47b5458acf1fcce","first_seen":"2026-01-05T17:40:40.576323Z","last_seen":"2026-01-05T17:40:40.576323Z","times_seen":1,"resource_available":true,"data":null}},"time_used":571,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":569,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/pako.DwGzBETv.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.459Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/pako.DwGzBETv.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:27 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":47570,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (47569)","md5":"223df3d75a8ca0911b0cd3b206353372","sha1":"b49f3161f11b56d1bcf9bfbdd37a14b7f9bd2799","sha256":"81607342b01f22641ebf3b71a73ed3d141172c305efdf9058a98d334bbff8b33","sha512":"a8010373cc31d31a4c12ccabc2e9d8bc9efa3fb0fd70791ea67da55e66ce39291d1b27ed77963502315e916bad8a23e322bbf2866445ed80c6918ec912abfa22","ssdeep":"768:KSPqQg09Gl6rmN8NOzsgn975TMjhriYWfo/WoPnDQLcO8TX3/5/EX30MaBdrgB+D:6ujhusxdrM+3ZPvn6+G0SPgn","tlshash":"fd231ae321e315491be41cdc86870aa2577495311c0225b8f27ddde538b0adbe2bbb7d","first_seen":"2025-11-20T04:33:33.606775Z","last_seen":"2026-01-05T17:40:40.558726Z","times_seen":2,"resource_available":true,"data":null}},"time_used":230,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@intlify.DQ3eNPiO.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.515Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/@intlify.DQ3eNPiO.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:29 GMT\r\netag: \"1767634589\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:29 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33175,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (16526)","md5":"005af302e0c3705dc44c301881704210","sha1":"20e332509cf5c119d014e523c94126fac30af0c3","sha256":"50664993d9774d6d8e5ed9b3f415ef22df80a3270f2b6a52fbaf21c3b7ff2d65","sha512":"215c8f1f9e01301e0d250363fb633bec84e11df2478364a3748a700a70c0d912e5d7be17c37b7494559364a07aab00e40f5ea9297d5f28d7e62afcac731dd704","ssdeep":"768:LqPoopQXc4uKdyGkldzvnv3q5P6+7IYoSJlaG1JeBDfoRasYLrz2f+k0i5WVlIO0:A6rf0BDk5kDaD","tlshash":"b3e2d7ac34927426d3a69ae954b70055a63e3d14740cd851f1aef9473e32c2f87e3f89","first_seen":"2026-01-05T17:40:40.647483Z","last_seen":"2026-01-05T17:40:40.647483Z","times_seen":1,"resource_available":true,"data":null}},"time_used":616,"timings":{"blocked":387,"dns":0,"connect":0,"send":0,"wait":229,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/process.DzrMeI0r.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.525Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/process.DzrMeI0r.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:31 GMT\r\netag: \"1767634591\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:31 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 733\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1725,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1724)","md5":"57241a8c1b06047c1ef26173656dc0eb","sha1":"c61bf230f048129e928d008992cbcd0afde7eeda","sha256":"8934fae2fc4c1e83a8c28a087ceb4a35208456f1c54aaa3550c0d3d575458d66","sha512":"198d0951e96ac0082610dc185192d5922da246141ceea5607cec50476b1212013120f72f073930c1922847ab53a2c6e7a022ebe5ad28ee795e10126ba12bf562","ssdeep":"","tlshash":"af31349cb79eb5b763e223b0553f8503e07657b21c4d80a47122e5e038309797717dd8","first_seen":"2025-11-20T04:33:33.524994Z","last_seen":"2026-01-05T17:40:40.597212Z","times_seen":2,"resource_available":true,"data":null}},"time_used":710,"timings":{"blocked":404,"dns":0,"connect":0,"send":0,"wait":305,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2024-10-05/8616b5999e0bfda5f1ad6308e08785f720241005124411738.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.171Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2024-10-05/8616b5999e0bfda5f1ad6308e08785f720241005124411738.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:06 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":287289,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"51d924830db79ceb6f18255341b7c990","sha1":"aae4e86c168daae6cecfd407b2fbab0890680ead","sha256":"f8b61dfd5639ebd6b88f47bdc907e40c5918b1f2cc01a7df46763d01d278ef12","sha512":"119077aeea1af5829d001086896bfcb43e155800d7b201f3e1bb73c733055a92cf22dbbe9717ba4827cda25515581c21203b702cab04fe0b1b5047325c0a9a23","ssdeep":"6144:f6PxZE1bVUvM/E+3rhSfrnqft0DwCKBE8KRFEZ4SXTMUUbft:a/IMwb3rhSfrnybCKyPRFEZPXQRF","tlshash":"eb5423e6e017ad92df0113ffdc5722423c2320c47f5692d2aaf5a4673a73086abe7615","first_seen":"2025-09-13T12:19:18.58267Z","last_seen":"2026-01-05T17:40:40.648534Z","times_seen":4,"resource_available":false,"data":null}},"time_used":2140,"timings":{"blocked":852,"dns":0,"connect":0,"send":0,"wait":1288,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-12-09/ba9bf8ffb7e6bbaa99cb3a5be965339120251209143613555.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.173Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-12-09/ba9bf8ffb7e6bbaa99cb3a5be965339120251209143613555.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":6278,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"c2e06ee19c8bbdfcf45a53c3b79c30ef","sha1":"7803fc2bd4c0b3464f8dc5097a2151d0928f283a","sha256":"15da9c38b562c541d68b1c708eb2cf93396706b18cc4bdab11f2c55901cf0fbf","sha512":"d31b0f81d3e96f1abb5a2624002fb177573da6111d7f3569f6528f20049a331b218571a9702f72985062cf13581601f0e1f75eb69d1aae0ce0ef737dac9291e5","ssdeep":"96:WSjFTY8S+sZtgdv2F773jsUSEBZxsRlDQuZHsOqIMVnsKIh+VvGoJIkaJRr0neol:WSjFTY2mgd+FHjszYfGtQudweyJIkaHI","tlshash":"1ed1affd079b46ef78208392773391293c9b3197eb01157440aa7d1eebc44aa03d28c8","first_seen":"2026-01-05T17:40:40.649507Z","last_seen":"2026-01-05T17:40:40.649507Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2006,"timings":{"blocked":850,"dns":0,"connect":0,"send":0,"wait":1156,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2024-10-05/279f5eeef6bee82e7313bf780e16d91f20241005124352935.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.205Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2024-10-05/279f5eeef6bee82e7313bf780e16d91f20241005124352935.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":9328,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"29e53d689d67fd56dca14c67fc795cb7","sha1":"dd53bf0414a12a61110791ce872ef63d30f6b406","sha256":"9ae258a8c87b4a7b15c2f2c1313ae0fa9587a890c1ec5ffe492ce688e2fcfc28","sha512":"57719c7d1988b357366959754d97215d988f7d42e8a5e126086f11a504133921621de64c06d699a34f1b928ee3acf9c0353688ac44b57d894bbca8413c1541b9","ssdeep":"192:nSr+LAV95sShmoN4QPGZKoG6E28ILMmjIpnnEZ4kNznQTQE2LLY:Sr+k35sShm+4aGZKoA2xqE5z22LU","tlshash":"d712beba05d04cff70ab727ea21b684432efed58122377136098552d21c9c9963ce2e6","first_seen":"2025-09-13T12:19:18.580794Z","last_seen":"2026-01-05T17:40:40.650349Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1831,"timings":{"blocked":833,"dns":0,"connect":0,"send":0,"wait":998,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/secure-ls.DPBbppFk.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.694Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/secure-ls.DPBbppFk.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:29 GMT\r\netag: \"1767634589\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:29 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":49578,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (48049)","md5":"90e3af036437f0c8711de29de3d4cee9","sha1":"b983b25089315fc3348e06cf63b4cbc1e1209e85","sha256":"0dc025c5d0449949dc52588fed0fc338a495eb528e3b71e0c7ca6cb0becca5cf","sha512":"8b1c426c374de21a0f76b61cad1ad0a677c7e43ff5bd0a48340f501ea8ba3495f2564dc1e2b2c4904a00a98b3b47b51e84e674ecf78a4be0c8d119f8e2ac40a1","ssdeep":"768:MX2qTNUGWmob3cDer5ueWfsloSNIPGIU3g6+gb/1pEK3VyRn/LM9OT81LFODpi+b:YZRTomPGIUQ2b/1prFyRuUdi+cc+cFyY","tlshash":"3e233bd670adb44143fb79a42c7fb08ba0b76a59451c9668f308d5cdadac5c8803ee7c","first_seen":"2026-01-05T17:40:40.651139Z","last_seen":"2026-01-05T17:40:40.651139Z","times_seen":1,"resource_available":true,"data":null}},"time_used":684,"timings":{"blocked":350,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/lodash-es.DjvwQNwl.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.506Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/lodash-es.DjvwQNwl.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:32 GMT\r\netag: \"1767634592\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:32 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26056,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (26055)","md5":"914cd6b15467109d952e5e8758bc6d5a","sha1":"27b6464b7ae83a587a8e5b20c001257eaa0f6473","sha256":"16b6b5b2d1ce3c72c3a847d9a45e3f583457919e9294d8e46e80957a368a164c","sha512":"80225a56d72e41db61c83b0de3429495637f12f61e7b98efd0e7963bb2aabee2460d67d967f1cc72fee80e9d995aebe0799e26fd05347c80e89399de82d5537b","ssdeep":"768:lIPKQJhAOwwe+geEXlrT8AFyZ2crpgJRpRTe5koU5qn7iqNf:lHQLAp8geE1rT832cdgTeCoU4n1Nf","tlshash":"8fc285c875d3f06143a6687480af180bf23c7c64948fe450e1e6d4dabd7916ad673e3a","first_seen":"2025-11-20T04:33:33.689794Z","last_seen":"2026-01-05T17:40:40.566939Z","times_seen":2,"resource_available":true,"data":null}},"time_used":413,"timings":{"blocked":182,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/secure-ls.DPBbppFk.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:55.514Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/secure-ls.DPBbppFk.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://nivex0.one/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:29 GMT\r\netag: \"1767634589\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:29 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":49578,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (48049)","md5":"90e3af036437f0c8711de29de3d4cee9","sha1":"b983b25089315fc3348e06cf63b4cbc1e1209e85","sha256":"0dc025c5d0449949dc52588fed0fc338a495eb528e3b71e0c7ca6cb0becca5cf","sha512":"8b1c426c374de21a0f76b61cad1ad0a677c7e43ff5bd0a48340f501ea8ba3495f2564dc1e2b2c4904a00a98b3b47b51e84e674ecf78a4be0c8d119f8e2ac40a1","ssdeep":"768:MX2qTNUGWmob3cDer5ueWfsloSNIPGIU3g6+gb/1pEK3VyRn/LM9OT81LFODpi+b:YZRTomPGIUQ2b/1prFyRuUdi+cc+cFyY","tlshash":"3e233bd670adb44143fb79a42c7fb08ba0b76a59451c9668f308d5cdadac5c8803ee7c","first_seen":"2026-01-05T17:40:40.651139Z","last_seen":"2026-01-05T17:40:40.651139Z","times_seen":1,"resource_available":true,"data":null}},"time_used":617,"timings":{"blocked":387,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/spotTrading.Bnxepb0p.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.835Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/spotTrading.Bnxepb0p.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/price.BpPWlJRd.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: \"1767634797\"\r\nlast-modified: Mon, 05 Jan 2026 17:39:57 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 381\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1050,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1049)","md5":"d9df8363be320fa8cb4e9f545ee19834","sha1":"ec857134ed486942a1491bf2d21e1452f412f796","sha256":"dbdb8c04c7e32c16bcd717ddc098fa93910ea91e96c3c837b2ac973ccba5c763","sha512":"f35a48142ba6a8c0db806cfca41bdcce0af36e2c7df6a6274b6478698bcd9f70b0587375f0a0ab2a0398d4c6a24bfc5bc4acdac1a4e552fc9e6ad505d9325f8f","ssdeep":"","tlshash":"761127eeb046e2a1428da35ab95f331e736fef50f9e75c221c016d9d3642a0cb429b15","first_seen":"2026-01-05T17:40:40.605437Z","last_seen":"2026-01-05T17:40:40.605437Z","times_seen":1,"resource_available":true,"data":null}},"time_used":230,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":229,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hkex-dev.hkxhkx.com/admin/20220210/ZGCH74353507311.png","fqdn":"hkex-dev.hkxhkx.com","domain":"hkxhkx.com","tld":"com"},"ip":{"addr":"34.8.147.106","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.091Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hkex-dev.hkxhkx.com","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Dec 2025 05:39:14 GMT","end":"Sat, 07 Mar 2026 06:33:48 GMT"},"fingerprint":{"sha1":"51:D6:84:AD:C0:A7:44:F3:36:2D:22:52:6E:D2:B1:EA:3F:11:43:91","sha256":"02:5D:E9:61:53:F2:1B:ED:7C:3A:47:A1:C2:66:06:FF:FB:34:E0:20:F4:41:96:5A:47:7E:BB:FF:2B:3A:1C:1C"}}},"request":{"raw":"GET /admin/20220210/ZGCH74353507311.png HTTP/1.1\r\nHost: hkex-dev.hkxhkx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-guploader-uploadid: AHVrFxN5H-ZR4bx5rRzrD2HOge2_oHPxsj0WDIQO3Ngtc4VQtzxhm2x6Em9jGBeiB0Ww0IRF\r\nx-goog-generation: 1729754963870597\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 11807\r\nx-goog-hash: crc32c=YUNgGA==, md5=E0dWWQPOhDhDXtwf7UfvdA==\r\nx-goog-storage-class: STANDARD\r\naccept-ranges: bytes\r\ncontent-length: 11807\r\nserver: UploadServer\r\ndate: Mon, 05 Jan 2026 17:20:54 GMT\r\nexpires: Mon, 05 Jan 2026 18:20:54 GMT\r\ncache-control: public, max-age=3600\r\nage: 1150\r\nlast-modified: Thu, 24 Oct 2024 07:29:23 GMT\r\netag: \"1347565903ce8438435edc1fed47ef74\"\r\ncontent-type: image/png\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]}],"data":{"size":11807,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"1347565903ce8438435edc1fed47ef74","sha1":"47e16d6d63fae26ff87303a0a8048f181abc5cda","sha256":"d30e027b776fe052c5d7fff1f91de1fe6de4caab9287b31282892a23886f0505","sha512":"9dd19d27f13ecd4495a8c1bae447974db5a1fb2612739a95a78082c05449b8c138251355271ab1e3a895588be1b0673830a8acc41a25aec73a6226cbec540f0a","ssdeep":"192:6V3HAmmlpH+3JvtmiLf+5eYVLHPEAPfMzgJPV+vv06lI9SL5OnLwyRorDYDP4Cu8:iwmm7+1tmiieYhEuEzUPUvvd6S9OsyiI","tlshash":"7b32bf6a99e17a35cc33d1385fd6f70849221538ec293380a80d57a87adf5ed2ba274d","first_seen":"2025-09-13T12:19:18.523378Z","last_seen":"2026-01-05T17:40:40.652024Z","times_seen":4,"resource_available":false,"data":null}},"time_used":380,"timings":{"blocked":351,"dns":0,"connect":0,"send":0,"wait":27,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/index.x8n5eXUS.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.144Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/index.x8n5eXUS.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:30 GMT\r\netag: \"1767634590\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:30 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":109091,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (61068)","md5":"d2339cf025bb538377f46ce3ae3ec234","sha1":"e6473a14867f3143bc7c1d2a7de3b5f6c2104c57","sha256":"bb76072b9c669a0c4ba895b3cc883acea6b5bdc04b575b33af40c8a77ba0b36b","sha512":"37064612e513b6118b1e5ac4ad2e103a50881df22eb9c77ba42c764285cb1e59102834d5e51dc1a976d5657df4c12f31046a5915e5a05ebc48c8a99aa351b949","ssdeep":"1536:ZM/CFaSJOCYw2IqUdIvjH7Ckr+GYpN1iA6h9VEDGJIuGJJGUkYpeoNVz848lvLh3:WrSJiw2/AziA6h9VEDGJIuGhU/rbJys","tlshash":"8eb33bca326242bca3896ad8ec36220d9374df44e519c476bf2d7dcbb185d48d276b18","first_seen":"2026-01-05T17:40:40.615076Z","last_seen":"2026-01-05T17:40:40.615076Z","times_seen":1,"resource_available":true,"data":null}},"time_used":230,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/vue-echarts.Bd6UsEJu.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.704Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/vue-echarts.Bd6UsEJu.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:30 GMT\r\netag: \"1767634590\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:30 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 2066\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4187,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4186)","md5":"eb3f411eb42c9ce5f83fd46666bbc0d1","sha1":"6f9d138afc965dea3fd15b86cdb7e3dd627f3e26","sha256":"c2a0f0c708d565fb1eb9fc3eebbd6635a9ebbb6daac01723168f28b9fc9e11b7","sha512":"95bda3cd8e7c44ddbcbfbe9b86cb4a08233a11cedda9fbdfd348abb77081b075dc559c84dd97ce317da784bf515519dfd78e6aa0553f7347e650bf7c891e952f","ssdeep":"96:zFkk63MMQmQ2FojQRtv/WpMWRSNdf0x8zvrmQ5weqh5T/qe0p7nNMBuWkYS:Ck6c+QAIQRtv+KWINdf0WzDmEjqh5T/m","tlshash":"ff81c6eeb491b27823f708cd80671946b77d8b95b008d0e5e498ede51a39b50e233da9","first_seen":"2026-01-05T17:40:40.607135Z","last_seen":"2026-01-05T17:40:40.607135Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1175,"timings":{"blocked":664,"dns":0,"connect":0,"send":0,"wait":507,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/charenc.3b3Gq7bi.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.705Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/charenc.3b3Gq7bi.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:28 GMT\r\netag: \"1767634588\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:28 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\ncontent-length: 544\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":1102,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1101)","md5":"f99cedee990d3d53b9111ead4b758c5e","sha1":"92422d8844605fbdde92d28b4d17a99c78f5b72d","sha256":"de2b1aee769eb7a7fcad13c1629aa1f54c539ea396f62e6bfc4b438f8819d26a","sha512":"ba4a2faef30a8ab083fcd715da43ea0e1a9d5197821cc6596b55f764726473158ff20e6cecb781551060179726182414d17fdaa08f81c35f9faa12f1c85ccf05","ssdeep":"","tlshash":"bb11605970a0e0e4c3eb04290a3b300bf16949b502be98c0ebaac5f05ef824e5136f69","first_seen":"2025-11-20T04:33:33.582521Z","last_seen":"2026-01-05T17:40:40.565285Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1187,"timings":{"blocked":673,"dns":0,"connect":0,"send":0,"wait":514,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/css/firsr-home.C4a8T7vo.css","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:56.987Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /css/firsr-home.C4a8T7vo.css HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: text/css\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: W/\"695b1917-ea5\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:19 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: UPDATING\r\ncontent-length: 1173\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3749,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (3748)","md5":"8ea4108bcc5521b49a95a0c09a797bb5","sha1":"fc50ee17f7711e5cf614234d3c99d1cfae510322","sha256":"7ba187093cabd3c0e3edadbd326468a4b3f059e3fac18deca7e1fa3f6e6690c1","sha512":"b1691dba41112ae133b9063c5cc1bfb33622fb2f58c7c5aba0ebe78b34a08b9256a6dc09a533455674574f96b3784adc64c113dd6746d40c4b3c8b647b7b4884","ssdeep":"","tlshash":"9771fb3bf64ca388e17be46220c4369a701cd613da8b3564524215e74bdb0ee23be6cd","first_seen":"2026-01-05T17:40:40.652996Z","last_seen":"2026-01-05T17:40:40.652996Z","times_seen":1,"resource_available":false,"data":null}},"time_used":240,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":240,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-01-03/345be9961732f7e940c6bf1ccb9b8a8120250103132747958.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.141Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-01-03/345be9961732f7e940c6bf1ccb9b8a8120250103132747958.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":7104,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"a84bb8bcd21d8e9ec69b8d6209a81490","sha1":"0523f2ddad64bc724770d7535517d018a91d8e88","sha256":"f6510a965da880468968ad56302966461b0035ac0eed3aaec8247d0f39553252","sha512":"a38ddb9065137aeac1c0bba059290ab11e61d89bfb42ef794f78ca3ac222c6e95d916dc219c795de99068aa16590f08ac776b12eb42e97a9fb78ca7305c8eb53","ssdeep":"192:WS/X+kpb9rWrjfcFb3wf/3nDxtq5N0wwqIURh/pTbyd:5v9Bracd8vD7qb0KIURjTM","tlshash":"f6e1affcbd0338ed46d1c462286b3af53ad6b90ce218465c623b99ac87474205f85a5b","first_seen":"2025-09-13T12:19:18.56751Z","last_seen":"2026-01-05T17:40:40.653847Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1848,"timings":{"blocked":881,"dns":0,"connect":0,"send":0,"wait":967,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-01-03/aa72936a423437785d6319739485356020250103110607559.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.177Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-01-03/aa72936a423437785d6319739485356020250103110607559.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:05 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":4924,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"252e3934c5ca5aefab1077dc1e85acf3","sha1":"0cc8a848d16b7c18334d3230e336e9d9ca1d0dde","sha256":"78534aa765c6ad5e411af0b38589c1ef1b1079114ba3fa66008e48b9923a02ba","sha512":"b9383e22d3c18ff2e91487a213a1fffe44a24d0291c0704558864f26c64a0474889cedb0bdb1658d1f0b94bc1381c2b86fef675fd95a7d2f0ffe7337697189b5","ssdeep":"96:WSRWXWGcRh5Ew9uRrCu3zrfRLK+ZhkGkQ59muAIqK/PYC:WSRWXWzX6+8zjRO+DkTQ5cuA/gd","tlshash":"29a16cc7defdd33a19b30cd6ba72523110a9231b5e8415ebd505f75a4c9b258d0d211f","first_seen":"2025-09-13T12:19:18.59136Z","last_seen":"2026-06-01T01:23:31.969369Z","times_seen":5,"resource_available":false,"data":null}},"time_used":1882,"timings":{"blocked":846,"dns":0,"connect":0,"send":0,"wait":1036,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.xxxxapi.com/api/basic/file?path=basic/PUBLICS/2025-01-18/787aafb359dfaf61650c0f48e9966fc120250118191951304.png\u0026type=PUBLICS","fqdn":"api.xxxxapi.com","domain":"xxxxapi.com","tld":"com"},"ip":{"addr":"34.117.42.24","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nivex0.one/","date":"2026-01-05T17:40:04.204Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.xxxxapi.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 18 Aug 2025 00:00:00 GMT","end":"Thu, 27 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E1:EE:F6:F0:3F:80:07:53:1E:95:8F:44:E4:F5:3F:CE:7E:BD:DE:1F","sha256":"E7:69:20:5F:C1:56:B8:4F:72:07:27:19:21:E7:FF:25:5B:13:D5:66:F0:76:6B:51:78:6B:EC:29:AF:FD:44:92"}}},"request":{"raw":"GET /api/basic/file?path=basic/PUBLICS/2025-01-18/787aafb359dfaf61650c0f48e9966fc120250118191951304.png\u0026type=PUBLICS HTTP/1.1\r\nHost: api.xxxxapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\ncontent-type: image/png\r\ndate: Mon, 05 Jan 2026 17:40:06 GMT\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":18497,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"df7644212350429d6f5e5328134a5e29","sha1":"ccd8b3d20662592231775387d9ed5df0a317d8c2","sha256":"ac233011358a79abbdbd45ebee72813835493ee2a5d71df94a7796ccc0a1868a","sha512":"bce7c853af7f991042217d1f5cf2f493456ad463c77789bd0d1dae27c155e3f525fe36fc0ea09ad7ecf3d80e1dc1b01418653fff4ef14ad16478e1387e6c83ff","ssdeep":"384:5CyPt7TzT1RVtaJGvG1pSN6YghE1Y0kJwKpio:wy1P1RVkIvG1pZFe1Y0kxIo","tlshash":"6a82d0e357deb4c6724ca5ae8ff1171260c25d7bdb26d1988f36fa4c13985ea0870c29","first_seen":"2025-09-13T12:19:18.575306Z","last_seen":"2026-06-01T01:23:32.057528Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2082,"timings":{"blocked":831,"dns":0,"connect":0,"send":0,"wait":1251,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/@intlify.DQ3eNPiO.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.714Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/@intlify.DQ3eNPiO.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:36:29 GMT\r\netag: \"1767634589\"\r\nlast-modified: Mon, 05 Jan 2026 17:36:29 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33175,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (16526)","md5":"005af302e0c3705dc44c301881704210","sha1":"20e332509cf5c119d014e523c94126fac30af0c3","sha256":"50664993d9774d6d8e5ed9b3f415ef22df80a3270f2b6a52fbaf21c3b7ff2d65","sha512":"215c8f1f9e01301e0d250363fb633bec84e11df2478364a3748a700a70c0d912e5d7be17c37b7494559364a07aab00e40f5ea9297d5f28d7e62afcac731dd704","ssdeep":"768:LqPoopQXc4uKdyGkldzvnv3q5P6+7IYoSJlaG1JeBDfoRasYLrz2f+k0i5WVlIO0:A6rf0BDk5kDaD","tlshash":"b3e2d7ac34927426d3a69ae954b70055a63e3d14740cd851f1aef9473e32c2f87e3f89","first_seen":"2026-01-05T17:40:40.647483Z","last_seen":"2026-01-05T17:40:40.647483Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1396,"timings":{"blocked":1165,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"static.geetest.com/v4/gt4.js","fqdn":"static.geetest.com","domain":"geetest.com","tld":"com"},"ip":{"addr":"104.17.5.193","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:53.142Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.geetest.com","organization":"Wuhan Jiyi Network Technology Co., Ltd."},"issuer":{"commonName":"GeoTrust G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Fri, 19 Dec 2025 00:00:00 GMT","end":"Fri, 18 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"CA:8B:31:34:03:03:4F:25:DE:AF:F1:76:9E:25:19:08:18:0C:04:EA","sha256":"F3:25:0F:0B:68:0B:B5:E2:F6:2A:F2:FE:E9:AA:10:6C:61:1C:7D:A6:FA:3F:D9:45:0F:E6:58:6D:71:F9:2E:2E"}}},"request":{"raw":"GET /v4/gt4.js HTTP/1.1\r\nHost: static.geetest.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 05 Jan 2026 17:39:53 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\ncf-ray: 9b94c1f1792a5688-OSL\r\ncf-cache-status: HIT\r\nage: 1505573\r\ncache-control: public, max-age=86400\r\ncontent-encoding: gzip\r\nexpires: Tue, 06 Jan 2026 17:39:53 GMT\r\nlast-modified: Mon, 28 Jul 2025 15:58:23 GMT\r\nvary: Accept-Encoding\r\ncontent-md5: PhD0vEfy/NYw7YQ+kGHPRA==\r\nx-oss-hash-crc64ecma: 8068022385750826956\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 689429A0D3D7CB3136B86001\r\nx-oss-server-time: 13\r\nx-oss-storage-class: Standard\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15364,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"3e10f4bc47f2fcd630ed843e9061cf44","sha1":"35b9e07ec532b978d2f92adcdb3d31a9f706383e","sha256":"d16f159d776bfadf27a75099cd3a16e3de499a39d26e7587d0831322f767cc4d","sha512":"8953dcdc7bf40d7c7d849719a6663c66f21fbee4460f2b7ee73d9ce2ee202a9ca68ccae586fd05b1bfa0768cddbdf4c99ce77819f8d2ec03f77ddf412fae8621","ssdeep":"384:0BDAKWacAauzIuUMYVbFX7YoUBXdwNRGjv:0BEKRa2c0","tlshash":"5b62538e68a6a05349b3b778cb5fa514fe694b7340248141bd5ce3586fb043487abfdc","first_seen":"2024-12-27T01:11:33.480297Z","last_seen":"2026-07-27T05:50:08.067067Z","times_seen":1600,"resource_available":true,"data":null}},"time_used":137,"timings":{"blocked":51,"dns":38,"connect":1,"send":0,"wait":30,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/js/index.D3030Mjq.js","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:56.710Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /js/index.D3030Mjq.js HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/js/index.x8n5eXUS.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Mon, 05 Jan 2026 17:37:06 GMT\r\netag: \"1767634626\"\r\nlast-modified: Mon, 05 Jan 2026 17:37:06 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":18854,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (17148)","md5":"472e44861cdd5db465efe3514460c7c6","sha1":"65d5ad9c03224bcb6e69f355eadfb6a279ccc370","sha256":"a0d47c366fda8dda5dbaa69bc5273e42c3f9f848a80a4e3dbdf72e8ccc8ab877","sha512":"8bcd1dd60d43c5d29cae5c89b466c261e0f8287166e820125b8ad54a4d0d36f9eb470512e64e182d787fad75fafe6dcdb17572f62f7a6b7aa1802e170a94dbf0","ssdeep":"384:S4+Ie3MM5Y1b4MN5lbW+vlpP+wP9LieafhjvOwe0rg8DUdY/dh+sGqx7M1eTb/o:Sqe38TlbTvlhPP9L3UhjvRe0rg8DJH+1","tlshash":"e482e89fb58445388773dcfa9ce9530820de4f51cec9caa6e7ec4e0a03a1d78869c719","first_seen":"2026-01-05T17:40:40.544332Z","last_seen":"2026-01-05T17:40:40.544332Z","times_seen":1,"resource_available":true,"data":null}},"time_used":231,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nivex0.one/woff2/ping-fang-sc-regular.DoqDn88G.woff2","fqdn":"nivex0.one","domain":"nivex0.one","tld":"one"},"ip":{"addr":"103.231.15.148","port":443,"asn":55933,"as":"Cloudie Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nivex0.one/","date":"2026-01-05T17:39:57.461Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nivex0.one","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 11 Oct 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C7:3E:16:B8:25:6C:E9:F2:AF:4F:95:86:51:D6:97:0C:15:9E:81:77","sha256":"E0:93:B2:0B:3A:64:6A:7F:16:DA:7F:F1:0A:68:27:87:E9:0B:52:4A:E6:E6:E0:BF:FB:D0:B9:91:86:66:49:5E"}}},"request":{"raw":"GET /woff2/ping-fang-sc-regular.DoqDn88G.woff2 HTTP/1.1\r\nHost: nivex0.one\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nivex0.one/css/index.D6p3pYi2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-type: font/woff2\r\ndate: Mon, 05 Jan 2026 17:39:57 GMT\r\netag: \"695b1916-c57f4\"\r\nlast-modified: Mon, 05 Jan 2026 01:51:18 GMT\r\nserver: nginx/1.20.1\r\nstrict-transport-security: max-age=31536000\r\nvia: 1.1 google\r\nx-cache: UPDATING\r\ncontent-length: 808948\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808948,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 808948, version 1.0","md5":"00e261c0df756857b6c8122ad72c2e51","sha1":"3603595c3ef21fb7b3666f0509006e972409ce2f","sha256":"858925599188762e79b3162f566843708f873e3b3d69b9a370904f43126ea5c0","sha512":"2a5493638b2b362744f42aa174a5a8b953d4c72c5041c2e04c185cff757bdefbcedcee2d56352d62bfc2b42f519eff831a87a54537307a1b5758a37781efb6d5","ssdeep":"12288:OyktqTWhJpwaYzHHg9RIi6AV8RKDWX0+SZjst1Gp06Lc/12Sf+gAaADHCZuMEat:O1tqcfQAMR9E+SFQYp06LK1kpaaCZxf","tlshash":"7f053348930f692caa9dd1c243c7e8607b903d0dfeea4b26e2d50f0571cf989767a752","first_seen":"2025-11-20T04:33:33.823373Z","last_seen":"2026-01-05T17:40:40.657597Z","times_seen":2,"resource_available":false,"data":null}},"time_used":484,"timings":{"blocked":104,"dns":0,"connect":0,"send":0,"wait":237,"receive":143,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"nivex0.one","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"nivex0.one","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}