{"report_id":"7a844b03-cfde-48a0-b4b8-7495d301edd4","version":6,"status":"done","tags":["malicious","clickfix"],"date":"2026-03-28T01:44:57Z","url":{"schema":"https","addr":"productionmaza.cyou/","fqdn":"productionmaza.cyou","domain":"productionmaza.cyou","tld":"cyou"},"ip":{"addr":"172.67.148.28","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"productionmaza.cyou/","fqdn":"productionmaza.cyou","domain":"productionmaza.cyou","tld":"cyou"},"title":"Just a moment...","dom":{"size":343303,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (56057)","md5":"09db164f964e2e3ed209d6161c560100","sha1":"59604d2a62affa6870f085765dfc2a0cda89d5dd","sha256":"b7cae0b92b381a553af1d94992ac83003df3d1ba9c4757dc6595bf14acc4239a","sha512":"6f00d7ce3ee927c420a6c2f3d9dced2a5645aef18d9a03b12f7eac3e566995f3a00e1c75870f7a661d1bb1a6c1e96cbc05eceb643427eda54a566dcc4837d549","ssdeep":"6144:zOt8uGgr23Ot8uGgr2TOt8uGgr2hOt8uGgr29:Ci/grZi/grpi/grfi/grs","tlshash":"4474e033921f2d8a76170d90e41427082de9bc9fba24da98fdcc0596d7fd620cd9d8b6","dom_hash":"domhash4000acdb198e1f93d61c182a1c8eac20","first_seen":"2026-03-28T01:44:59.154541Z","last_seen":"2026-03-28T01:44:59.154541Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"productionmaza.cyou/","fqdn":"productionmaza.cyou","domain":"productionmaza.cyou","tld":"cyou"},"ip":{"addr":"172.67.148.28","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-02T01:44:57Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":3,"urlquery":2,"analyzer":4}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-28T01:44:36Z","timestamp":1774662276,"ip_dst":{"addr":"20.105.41.175","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"Client IP","port":50522,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (1rpc .io)","source":"{\"timestamp\":\"2026-03-28T01:44:36.341437+0000\",\"flow_id\":1510815723436505,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.7\",\"src_port\":50522,\"dest_ip\":\"20.105.41.175\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058788,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (1rpc .io)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"1rpc.io\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"f4febc55ea12b31ae17cfb7e614afda8\",\"string\":\"771,4865,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":909,\"bytes_toclient\":1654,\"start\":\"2026-03-28T01:44:36.276953+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-28T01:44:36Z","timestamp":1774662276,"ip_dst":{"addr":"47.245.119.150","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"ip_src":{"addr":"Client IP","port":34556,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (api .zan .top)","source":"{\"timestamp\":\"2026-03-28T01:44:36.929744+0000\",\"flow_id\":951531524594183,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.7\",\"src_port\":34556,\"dest_ip\":\"47.245.119.150\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058789,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (api .zan .top)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"api.zan.top\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"27eabd2e03c903c0e38682b67d24b578\",\"string\":\"771,49199,65281-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":5,\"pkts_toclient\":4,\"bytes_toserver\":807,\"bytes_toclient\":1664,\"start\":\"2026-03-28T01:44:36.399879+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-28T01:44:37Z","timestamp":1774662277,"ip_dst":{"addr":"8.219.97.231","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"ip_src":{"addr":"Client IP","port":42208,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (api .zan .top)","source":"{\"timestamp\":\"2026-03-28T01:44:37.169388+0000\",\"flow_id\":315614371838064,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.7\",\"src_port\":42208,\"dest_ip\":\"8.219.97.231\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058789,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (api .zan .top)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"api.zan.top\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"27eabd2e03c903c0e38682b67d24b578\",\"string\":\"771,49199,65281-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":5,\"pkts_toclient\":6,\"bytes_toserver\":931,\"bytes_toclient\":3627,\"start\":\"2026-03-28T01:44:36.653424+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-28","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Malicious - Copy/Paste Social Engineering (ClickFix)","verdict":"malicious","severity":"medium","comment":"","tags":["malicious","clickfix"],"meta":null},{"sensor_name":"urlquery","alert":"Malicious - Copy/Paste Social Engineering (ClickFix)","verdict":"malicious","severity":"medium","comment":"","tags":["malicious","clickfix"],"meta":null}]},"summary":[{"fqdn":"gateway.tenderly.co","ip":{"addr":"35.227.193.242","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"domain_registered":"2020-05-11","domain_rank":1960624,"first_seen":"2022-05-12T13:13:46Z","last_seen":"2026-03-27T19:33:29.840648Z","alert_count":0,"request_count":1,"received_data":541,"sent_data":507,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}]},{"fqdn":"polygon.lava.build","ip":{"addr":"104.18.24.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-09-14","domain_rank":7157037,"first_seen":"2025-08-27T09:05:44.919474Z","last_seen":"2026-03-27T19:33:29.642884Z","alert_count":0,"request_count":1,"received_data":1351,"sent_data":492,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}]},{"fqdn":"polygon-public.nodies.app","ip":{"addr":"104.26.4.88","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-05-12","domain_rank":0,"first_seen":"2025-08-27T09:05:52.160676Z","last_seen":"2026-03-27T19:33:30.570149Z","alert_count":0,"request_count":1,"received_data":755,"sent_data":499,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"productionmaza.cyou","ip":{"addr":"104.21.55.125","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-03-23","domain_rank":0,"first_seen":"2026-03-27T19:33:28.801213Z","last_seen":"2026-03-27T19:33:28.801213Z","alert_count":30,"request_count":7,"received_data":443071,"sent_data":3263,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"polygon-bor-rpc.publicnode.com","ip":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-08-16","domain_rank":2163006,"first_seen":"2024-04-26T08:35:48Z","last_seen":"2026-03-27T19:33:30.576173Z","alert_count":0,"request_count":1,"received_data":741,"sent_data":504,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]},{"fqdn":"1rpc.io","ip":{"addr":"20.105.41.175","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Ireland","country_code":"IE"},"domain_registered":"2022-08-02","domain_rank":47066,"first_seen":"2022-08-18T07:06:26Z","last_seen":"2026-03-21T20:15:24.738259Z","alert_count":0,"request_count":1,"received_data":309,"sent_data":486,"comment":"","tags":null,"fingerprints":null},{"fqdn":"polygon.drpc.org","ip":{"addr":"104.18.10.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2005-01-09","domain_rank":0,"first_seen":"2023-12-16T03:46:28Z","last_seen":"2026-03-27T19:33:30.714383Z","alert_count":0,"request_count":1,"received_data":750,"sent_data":490,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"polygon.rpc.subquery.network","ip":{"addr":"51.254.59.59","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"domain_registered":"2020-10-07","domain_rank":0,"first_seen":"2025-08-27T09:05:51.207004Z","last_seen":"2026-03-28T00:37:53.707666Z","alert_count":0,"request_count":1,"received_data":350,"sent_data":508,"comment":"","tags":null,"fingerprints":null},{"fqdn":"polygon-pokt.nodies.app","ip":{"addr":"104.26.5.88","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-05-12","domain_rank":0,"first_seen":"2025-08-27T09:07:26.238785Z","last_seen":"2026-03-27T19:33:29.616644Z","alert_count":0,"request_count":1,"received_data":741,"sent_data":497,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"polygon.gateway.tenderly.co","ip":{"addr":"35.227.193.242","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"domain_registered":"2020-05-11","domain_rank":0,"first_seen":"2025-08-03T10:23:07.273214Z","last_seen":"2026-03-27T19:33:29.668721Z","alert_count":0,"request_count":1,"received_data":541,"sent_data":501,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}]},{"fqdn":"api.zan.top","ip":{"addr":"47.245.119.150","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"domain_registered":"2023-03-24","domain_rank":1528343,"first_seen":"2023-08-02T00:13:55Z","last_seen":"2026-03-27T19:33:30.732987Z","alert_count":0,"request_count":1,"received_data":707,"sent_data":500,"comment":"","tags":null,"fingerprints":null},{"fqdn":"upload.wikimedia.org","ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"domain_registered":"2003-03-16","domain_rank":4329,"first_seen":"2012-05-21T09:39:45Z","last_seen":"2026-03-23T10:06:02.309414Z","alert_count":0,"request_count":1,"received_data":64600,"sent_data":476,"comment":"","tags":null,"fingerprints":[{"name":"Apache Traffic Server:9.2.11","description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","website":"https://trafficserver.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*","icon":"Apache Traffic Server.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Malicious - Copy/Paste Social Engineering (ClickFix)","verdict":"malicious","severity":"medium","comment":"","tags":["malicious","clickfix"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"productionmaza.cyou/","fqdn":"productionmaza.cyou","domain":"productionmaza.cyou","tld":"cyou"},"ip":{"addr":"104.21.55.125","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"2495f461fbd88e691060dc5b319d6b6f","sha1":"50598850849bbc802c2d8384fbabb87d2add8dc6","sha256":"282fceb3a57815bdd1154e7902a6625c0a7862a829c2139e8527c7cbffc046a6","sha512":"a1bc1d4bad6b9ad2e90c9431fb2a767b5a6722af179f68359c56c11f8b1facb91b40185bd859aee40d6973e212479d146288cba3d39682ac660916d0326b09ec","ssdeep":"384:u6TfIFI5tsrFtiCIjjItwKVdeMQW/KzayKnRvgsf9f+:u6TWIwPBCctWDYBTI","tlshash":"d3926ca27355ceaaacd63cae647fe6f4833ce58b74e2f4e53b7230b1818d508514c562","size":19850,"data":"","first_seen":"2026-03-27T19:33:35.470402Z","last_seen":"2026-04-17T19:59:30.932537Z","times_seen":121,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"productionmaza.cyou/","fqdn":"productionmaza.cyou","domain":"productionmaza.cyou","tld":"cyou"},"ip":{"addr":"104.21.55.125","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"c3b39dcbb783320fc6910144f995f682","sha1":"9bea7d484d1f70213d50247d10da36982df0077f","sha256":"92570c0182106dbe66a9885eca0e4a0e73b3eb236b06ac1aba888ede01cb6647","sha512":"a23270cfd325030d34a65a492b816aace0c0a444a9505ec678cb8d85cf5116921af60153372306fc37daca2a1b80861a9f28d1ced95cdeb706a770edeef68df5","ssdeep":"192:USSHiqabdqbbcNuXQKkw90mt74W8S7fcT9A7bFJ4B7dWkTC2qgMLdUeTlqcs34ws:hlbc190W84bn4B7dWk+2qgMC34RNYzdo","tlshash":"7b62c794356691f543e70ee0002e5504fd3bea023d8cc4a0b2ab4ec7179f6b6a1b7a7d","size":14567,"data":"","first_seen":"2026-03-27T19:33:35.469207Z","last_seen":"2026-04-17T19:59:30.941897Z","times_seen":121,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"productionmaza.cyou/cf.js?v=2","fqdn":"productionmaza.cyou","domain":"productionmaza.cyou","tld":"cyou"},"ip":{"addr":"104.21.55.125","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"89447f240dbedf42aaf80e8887167d7a","sha1":"bd6ea0e4ce62f0064d5665ebae4eec5a71b5c0ca","sha256":"36cc73c786f8ac5958267473dd92f377af2b15ae7e1e0d363378e88614c951af","sha512":"be857dc665df784e83e0dd62e49c5da178a361557938c639110013512ecb7a104ef9574cded7396cfd83cb6fea8e3805cf22c982a341bf40231b5a29b280de42","ssdeep":"6144:QXOt8uGgr25Ot8uGgr2QOt8uGgr2HOt8uGgr2pjFHco3qG:Q+i/grRi/grGi/grXi/grIjFHco5","tlshash":"7694d037196f6f4475175c45a0083b182ce938abfa14cae4bcdd48a66be8630dd3e6f4","size":415769,"data":"","first_seen":"2026-03-27T19:33:35.460662Z","last_seen":"2026-05-26T20:12:11.185349Z","times_seen":300,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"polygon-public.nodies.app/","fqdn":"polygon-public.nodies.app","domain":"nodies.app","tld":"app"},"ip":{"addr":"104.26.4.88","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://productionmaza.cyou/","date":"2026-03-28T01:44:36.265Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nodies.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 09 Feb 2026 19:18:13 GMT","end":"Sun, 10 May 2026 20:17:55 GMT"},"fingerprint":{"sha1":"AB:F8:8D:4A:92:81:5E:FE:4E:96:97:B1:98:F2:C5:E6:7A:6A:2E:AB","sha256":"1D:D4:55:F0:DC:75:C9:B5:3E:2A:65:4B:11:D6:80:71:EA:6D:C3:19:DE:0E:16:7F:72:3D:14:B4:5B:10:52:F0"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: polygon-public.nodies.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain\r\nContent-Length: 136\r\nOrigin: https://productionmaza.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://productionmaza.cyou/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":136,"data":"{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0x08207B087F61d7e95E441E15fd6d40BEfd6eD308\",\"data\":\"0x38bcdc1c\"},\"latest\"],\"id\":1}"}},"response":{"raw":"HTTP/2 415 Unsupported Media Type\r\ndate: Sat, 28 Mar 2026 01:44:36 GMT\r\ncontent-type: text/plain; charset=utf-8\r\ncontent-length: 79\r\nserver: cloudflare\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\nvary: Origin, accept-encoding\r\nx-content-type-options: nosniff\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n5FbE3WXKb3RkfQXOOa7vtXFVJh%2Bqkp4WL40MH8D0na%2BPw%2FBZ7zsdWZxqUvOVpnJuTcQy3hFfR5oqFwL42yHRDa%2BO7UYK1HAMId%2FSY2M%2FMEuX%2BcUjjG7oW6SpGxheIb3T%2FLbh%2FZXkT5HTJ4%3D\"}]}\r\ncf-ray: 9e32f35b0f7e568e-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"415","status_text":"Unsupported Media Type","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":57,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"a6b43ff666fdace2b8eba7f3588c37f2","sha1":"8a30f58cebc0554359b86837069efeac91730753","sha256":"47e603818bcb97881bda4879383d3174cd26cff43da5696a3ed6bf6f4fd9ac19","sha512":"1ed8602ef4bcdffd207288aa90c752d975316a9e96f6be26d91947fcc65bc2bf004014d596f56b24d49d0f8eda420c239adcc7656a143a7f6597b335e55d58ee","ssdeep":"","tlshash":"2f9022b0000000000bab02fb2c00bc822ba0803c0c80200c208800000cc00a88203300","first_seen":"2026-03-12T21:34:16.105445Z","last_seen":"2026-06-06T20:33:07.724052Z","times_seen":414,"resource_available":false,"data":null}},"time_used":247,"timings":{"blocked":61,"dns":33,"connect":4,"send":0,"wait":117,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.zan.top/polygon-mainnet","fqdn":"api.zan.top","domain":"zan.top","tld":"top"},"ip":{"addr":"47.245.119.150","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://productionmaza.cyou/","date":"2026-03-28T01:44:36.269Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.zan.top","organization":""},"issuer":{"commonName":"Alibaba Cloud GCC R3 AlphaSSL CA 2023","organization":"Alibaba Cloud Computing Ltd."},"validity":{"start":"Mon, 26 May 2025 02:31:24 GMT","end":"Sat, 27 Jun 2026 02:31:23 GMT"},"fingerprint":{"sha1":"C6:7B:1E:BE:79:E9:9E:E0:96:46:0A:3B:C3:33:7D:B2:5F:32:01:E4","sha256":"ED:66:F7:BE:9F:8D:4E:5E:E5:C9:D0:8B:96:E4:09:6C:08:33:35:99:F8:A6:71:6F:6A:F1:A3:1C:88:91:6D:B5"}}},"request":{"raw":"POST /polygon-mainnet HTTP/1.1\r\nHost: api.zan.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain\r\nContent-Length: 136\r\nOrigin: https://productionmaza.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://productionmaza.cyou/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":136,"data":"{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0x08207B087F61d7e95E441E15fd6d40BEfd6eD308\",\"data\":\"0x38bcdc1c\"},\"latest\"],\"id\":1}"}},"response":{"raw":"HTTP/2 400 Bad Request\r\ndate: Sat, 28 Mar 2026 01:44:37 GMT\r\ncontent-type: application/json\r\ncontent-length: 142\r\nset-cookie: acw_tc=0a009b0217746622774925563e41b358278b96ee3d8125ad4603bb83a1d558;path=/;HttpOnly;Max-Age=1800\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-allow-origin: https://productionmaza.cyou\r\naccess-control-max-age: 600\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nzan-trace-id: 19d321d5974a580d\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"Bad Request","fingerprints":null,"data":{"size":142,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"fd9fc578c88ed10c68d89943af87fe0a","sha1":"6d180730b57bdbfbb1455dbf169461c0d5f840eb","sha256":"a967f31f4a55570af8a88c5e166802865241110f9ab32469ab91529093aeb912","sha512":"85b5613237dbc6a7ab8c7e75c5984866d88f9a8963fe29d6585d259ee2b2c4ad74a7bef5af82fac94d69ab219d6cb1cdd2ed084eb3a47f659c5d88834c278b14","ssdeep":"","tlshash":"b2c02bc25cd72f15866748119d49bf00e6fcac4650850e72446c085c10ce52d4c17320","first_seen":"2026-03-12T21:34:16.080688Z","last_seen":"2026-06-06T20:33:07.733459Z","times_seen":408,"resource_available":false,"data":null}},"time_used":1410,"timings":{"blocked":-1,"dns":141,"connect":259,"send":0,"wait":264,"receive":0,"ssl":746},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"productionmaza.cyou/api/index.php?q=hTgt2ZVETE1D-CuLK1I","fqdn":"productionmaza.cyou","domain":"productionmaza.cyou","tld":"cyou"},"ip":{"addr":"104.21.55.125","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://productionmaza.cyou/","date":"2026-03-28T01:44:36.886Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"productionmaza.cyou","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Mar 2026 14:10:35 GMT","end":"Sun, 21 Jun 2026 14:10:34 GMT"},"fingerprint":{"sha1":"48:84:F5:A4:4E:3C:10:6C:B5:4C:35:6C:54:BD:5D:F8:A6:E8:C2:21","sha256":"93:E8:5B:79:16:F6:1B:07:A6:0C:0F:EB:6C:DB:25:32:2D:3D:DB:A6:B0:4A:54:D9:85:BF:7C:6E:18:7A:A3:63"}}},"request":{"raw":"GET /api/index.php?q=hTgt2ZVETE1D-CuLK1I HTTP/1.1\r\nHost: productionmaza.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://productionmaza.cyou/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 28 Mar 2026 01:44:36 GMT\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, User-Agent\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=q%2F3k2ocXfkFlmiZaUWeZquPS%2FUe2tlTfrxrnOCt8tP5DUPSqr2V%2BovO5mM5wXx2jbk94AbLAuf2CNQxeIKeZJ6c7CZ5C8Qd6Woz1zoz%2F%2FFSx3qpb1VQW96j7n7N%2FmmGiujJQgoLI\"}]}\r\ncontent-encoding: br\r\ncontent-type: application/json\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e32f35e88e756ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2045,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"192f9ec684bce7317b01389a37569deb","sha1":"e05418c2eb9f5f3211e650769bf96bb81fd01d6e","sha256":"7dc038d8f163ecd595a20a8350459993c3a9fe5d3ee9f3d1c2b88deabc540ab5","sha512":"965ecb237ca2af16f4a9e585ee6548327d3e36c789e255d376cf49f71302381ebaf5a2fc547e53516e20f7be390f2d03f49a6011759b587b85f8ff234417d53f","ssdeep":"","tlshash":"9041d504b4a8a4d852dfc4e3d321fd9bb13602fbcd5b0318077dd2a22f41ba46b0489b","first_seen":"2026-03-28T01:44:59.159866Z","last_seen":"2026-03-28T01:44:59.159866Z","times_seen":1,"resource_available":false,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-28","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upload.wikimedia.org/wikipedia/commons/9/94/Cloudflare_Logo.png","fqdn":"upload.wikimedia.org","domain":"wikimedia.org","tld":"org"},"ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://productionmaza.cyou/","date":"2026-03-28T01:44:36.870Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.wikimedia.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Feb 2026 06:44:51 GMT","end":"Wed, 13 May 2026 06:44:50 GMT"},"fingerprint":{"sha1":"88:E4:43:3F:CC:87:1D:73:6E:F1:49:80:44:76:A9:8C:17:D8:DC:40","sha256":"59:E3:D6:A8:2D:49:87:A7:F3:1E:35:0E:3A:0F:77:A1:0B:7D:32:09:4C:1F:9F:2D:5D:0F:42:89:16:CB:BF:08"}}},"request":{"raw":"GET /wikipedia/commons/9/94/Cloudflare_Logo.png HTTP/1.1\r\nHost: upload.wikimedia.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://productionmaza.cyou/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 27 Mar 2026 13:19:46 GMT\r\netag: 05982e81981f0f4d317c59d3008727fc\r\nserver: ATS/9.2.11\r\ncontent-type: image/png\r\nx-object-meta-sha1base36: tqzc3404i3b6qqllzyx20sg0c8awofx\r\nlast-modified: Thu, 25 Nov 2021 22:52:08 GMT\r\ncontent-length: 63290\r\nage: 44690\r\naccept-ranges: bytes\r\nx-cache: cp3076 hit, cp3076 hit/278\r\nx-cache-status: hit-front\r\nserver-timing: cache;desc=\"hit-front\", host;desc=\"cp3076\"\r\nstrict-transport-security: max-age=106384710; includeSubDomains; preload\r\nreport-to: { \"group\": \"wm_nel\", \"max_age\": 604800, \"endpoints\": [{ \"url\": \"https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error\u0026schema_uri=/w3c/reportingapi/network_error/1.0.0\" }] }\r\nnel: { \"report_to\": \"wm_nel\", \"max_age\": 604800, \"failure_fraction\": 0.05, \"success_fraction\": 0.0}\r\nx-client-ip: 91.90.42.154\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache\r\ntiming-allow-origin: *\r\nset-cookie: WMF-Uniq=-oBJqSa1-NxEUqJ7c4u1YwMxAAAAAFvdAR4hJqVaX37DZc4c2v5W_HSW3EX8ymEC;Domain=upload.wikimedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Sun, 28 Mar 2027 00:00:00 GMT\r\nx-request-id: 345c6987-52d6-455c-be1e-03cb3a11f44c\r\nx-analytics: \r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache Traffic Server:9.2.11","description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","website":"https://trafficserver.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*","icon":"Apache Traffic Server.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":63290,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1368 x 1368, 8-bit/color RGBA, non-interlaced","md5":"05982e81981f0f4d317c59d3008727fc","sha1":"feae211bf6d65d064a33c7a87d46ee0b7c616dbd","sha256":"c3916862cfead3af678d0fe7cfcc90cdf69713c1d95bdb988320ffba20a57f0e","sha512":"3c7372405356ad6835968c2c227614a45cc3bc2f7296ff7dd8db5b979babb119aded114cb97a3a55774e05754ae22c7a2df03ce1eb71b65cb6261059388dced1","ssdeep":"768:k2L/oWPZzSgt4YwA0GUHz+sCoFEjzPQYclFK0flKkVFHoJfs/Ryo:km/LPc0wA07HZFEHPQYCFK14HoJq","tlshash":"9353be4acb59227bb5510019b7a3689398b12c733001de1e5bc7b46f5b07fb0ee72d92","first_seen":"2025-03-07T13:54:30.635821Z","last_seen":"2026-08-17T13:25:07.512004Z","times_seen":689,"resource_available":false,"data":null}},"time_used":303,"timings":{"blocked":123,"dns":69,"connect":22,"send":0,"wait":34,"receive":24,"ssl":28},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"productionmaza.cyou/favicon.ico","fqdn":"productionmaza.cyou","domain":"productionmaza.cyou","tld":"cyou"},"ip":{"addr":"104.21.55.125","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://productionmaza.cyou/","date":"2026-03-28T01:44:37.153Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"productionmaza.cyou","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Mar 2026 14:10:35 GMT","end":"Sun, 21 Jun 2026 14:10:34 GMT"},"fingerprint":{"sha1":"48:84:F5:A4:4E:3C:10:6C:B5:4C:35:6C:54:BD:5D:F8:A6:E8:C2:21","sha256":"93:E8:5B:79:16:F6:1B:07:A6:0C:0F:EB:6C:DB:25:32:2D:3D:DB:A6:B0:4A:54:D9:85:BF:7C:6E:18:7A:A3:63"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: productionmaza.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://productionmaza.cyou/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Sat, 28 Mar 2026 01:44:37 GMT\r\nserver: cloudflare\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dhpJRPxPHhd76Os%2FWSbrwGJwgGH25vEYrPUBBwq%2F9LmwnOTqrSK%2Fi%2FR5LXTQqrqEcMAZjm11KOWb%2FdMKIWFxrFVmTxohh8ZBMLoeoWqJ%2F1T5e96MLrMKPG0k2DZ%2FocqDy2v8p7Ur\"}]}\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=iso-8859-1\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e32f36038ec56ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":281,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"841292046c6bd63a24faa95275a17f66","sha1":"9ffa235029248e0c780b516479183c962198d482","sha256":"5bc5e65c88d4192e6ab8b6a4f00e44b592ec9fc184d66294ac065ad492fdcc9b","sha512":"c2fab6bf3407686b97f191a7a869abe1c5092e753f265c7a8a44d7767e8f553d4b92fe84d11e1c8840ed531f34ce4eedb55be2d2e81ab74c1b713627cd6ffa61","ssdeep":"","tlshash":"bfd02bde906372874812146039d215c2264d22faa4ba45a82d86e48752b853ecf9b98c","first_seen":"2026-03-27T19:33:35.462929Z","last_seen":"2026-03-28T01:44:59.163763Z","times_seen":3,"resource_available":false,"data":null}},"time_used":136,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":136,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-28","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"productionmaza.cyou/log.php?t=pageview\u0026src=\u0026dv=desktop\u0026r=\u0026_=1774662276229","fqdn":"productionmaza.cyou","domain":"productionmaza.cyou","tld":"cyou"},"ip":{"addr":"104.21.55.125","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://productionmaza.cyou/","date":"2026-03-28T01:44:36.259Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"productionmaza.cyou","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Mar 2026 14:10:35 GMT","end":"Sun, 21 Jun 2026 14:10:34 GMT"},"fingerprint":{"sha1":"48:84:F5:A4:4E:3C:10:6C:B5:4C:35:6C:54:BD:5D:F8:A6:E8:C2:21","sha256":"93:E8:5B:79:16:F6:1B:07:A6:0C:0F:EB:6C:DB:25:32:2D:3D:DB:A6:B0:4A:54:D9:85:BF:7C:6E:18:7A:A3:63"}}},"request":{"raw":"GET /log.php?t=pageview\u0026src=\u0026dv=desktop\u0026r=\u0026_=1774662276229 HTTP/1.1\r\nHost: productionmaza.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://productionmaza.cyou/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 28 Mar 2026 01:44:36 GMT\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\npriority: u=4,i=?0\r\ncontent-length: 42\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/gif\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WQu1pbk7hPxbbYt5JVTgLqUFKANPnmj2aLRtK%2FwXZrTIlOQj9IkmdWWzJI1CxMb0neo%2F5ZHTy3QUptiYNn8F4VPCrynQaCzB%2FWW6e89%2B33j6%2BKSKmEPsAXA6QQSaonCXHVHtjGxL\"}]}\r\ncf-ray: 9e32f35a98de56ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"d89746888da2d9510b64a9f031eaecd5","sha1":"d5fceb6532643d0d84ffe09c40c481ecdf59e15a","sha256":"ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629","sha512":"d5da26b5d496edb0221df1a4057a8b0285d15592a8f8dc7016a294df37ed335f3fde6a2252962e0df38b62847f8b771463a0124ef3f84299f262ed9d9d3cee4c","ssdeep":"","tlshash":"c4900023fa808000c3a8c2300a0b238a2b8c80200a28030b80ae208cec3a3a22c03020","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-08-17T13:42:16.885213Z","times_seen":1034368,"resource_available":true,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":70,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-28","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"polygon-bor-rpc.publicnode.com/","fqdn":"polygon-bor-rpc.publicnode.com","domain":"publicnode.com","tld":"com"},"ip":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://productionmaza.cyou/","date":"2026-03-28T01:44:36.262Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"publicnode.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Feb 2026 20:40:15 GMT","end":"Mon, 11 May 2026 21:40:09 GMT"},"fingerprint":{"sha1":"02:33:4E:80:56:8A:88:B0:A0:32:C7:FD:BB:EA:AD:56:66:32:7F:9E","sha256":"25:6C:D0:C9:8E:E0:89:64:BF:49:7D:80:0C:31:46:0A:5B:1D:05:0B:79:60:DB:A7:27:2E:C9:40:85:64:DA:1E"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: polygon-bor-rpc.publicnode.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain\r\nContent-Length: 136\r\nOrigin: https://productionmaza.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://productionmaza.cyou/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":136,"data":"{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0x08207B087F61d7e95E441E15fd6d40BEfd6eD308\",\"data\":\"0x38bcdc1c\"},\"latest\"],\"id\":1}"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 28 Mar 2026 01:44:36 GMT\r\ncontent-type: application/json\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 1728000\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Origin, accept-encoding\r\nx-envoy-upstream-service-time: 0\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\ncf-ray: 9e32f35afa7a5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":231,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"94488802e892b9bad49599727018dcb0","sha1":"acd8cfab9f4a9315683d3b657418aa1c3ff68224","sha256":"dd22ac9da541d07558590bc2dc2534b8928fdc66acb4e60fb80cc87b2226303f","sha512":"5bb28c6c29c2fa7d4a9f2f1d3e881ed9ddb5ea73721773ff97832510e00c68c2ef5dcfbfac366cf476ea0f007759500d901ed32cb71fbf9e38ae9f387d2d2c4e","ssdeep":"","tlshash":"a3d012d001068321c12c4a01924434043231365654d41d308f0c8080d61c1073620294","first_seen":"2026-03-27T19:33:35.457108Z","last_seen":"2026-03-28T01:44:59.167142Z","times_seen":2,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":53,"dns":33,"connect":1,"send":0,"wait":38,"receive":0,"ssl":23},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"productionmaza.cyou/api/index.php?q=4r-gpKpTJW8hTxqGcQ","fqdn":"productionmaza.cyou","domain":"productionmaza.cyou","tld":"cyou"},"ip":{"addr":"104.21.55.125","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://productionmaza.cyou/","date":"2026-03-28T01:44:36.884Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"productionmaza.cyou","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Mar 2026 14:10:35 GMT","end":"Sun, 21 Jun 2026 14:10:34 GMT"},"fingerprint":{"sha1":"48:84:F5:A4:4E:3C:10:6C:B5:4C:35:6C:54:BD:5D:F8:A6:E8:C2:21","sha256":"93:E8:5B:79:16:F6:1B:07:A6:0C:0F:EB:6C:DB:25:32:2D:3D:DB:A6:B0:4A:54:D9:85:BF:7C:6E:18:7A:A3:63"}}},"request":{"raw":"POST /api/index.php?q=4r-gpKpTJW8hTxqGcQ HTTP/1.1\r\nHost: productionmaza.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nContent-Length: 186\r\nOrigin: https://productionmaza.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://productionmaza.cyou/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":186,"data":"{\"eventType\":\"view\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"language\":\"en-US\",\"screen\":\"1280x1024\",\"domain\":\"productionmaza.cyou\"}"}},"response":{"raw":"HTTP/3 204 No Content\r\ndate: Sat, 28 Mar 2026 01:44:36 GMT\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, User-Agent\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NGJRtOu%2FdbxEnUK9wjZj9cpLunsSImh18GjBda5cCLa2mb0bRI%2FxvChPRsE8EvHofa05dXpT3sBkSTzn7us6d6UYIAqB%2BLqFNcpF%2F0wBLMGqdPb6JvxPCzCiScEIYfxLUEWcGDgL\"}]}\r\npriority: u=3,i=?0\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e32f35e88e656ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T13:43:00.958144Z","times_seen":17937759,"resource_available":true,"data":null}},"time_used":65,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":65,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-28","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gateway.tenderly.co/public/polygon","fqdn":"gateway.tenderly.co","domain":"tenderly.co","tld":"co"},"ip":{"addr":"35.227.193.242","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://productionmaza.cyou/","date":"2026-03-28T01:44:36.268Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gateway.tenderly.co","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 15 Feb 2026 19:54:10 GMT","end":"Sat, 16 May 2026 19:54:09 GMT"},"fingerprint":{"sha1":"74:34:7F:6A:E5:04:AE:05:FB:EC:54:79:AE:11:49:CE:8D:41:8F:B2","sha256":"C3:08:57:AE:89:C0:8C:3E:0E:63:A4:2B:D7:C7:BC:DE:92:A1:A1:2B:EE:B3:24:71:42:72:65:63:D0:DF:E8:C6"}}},"request":{"raw":"POST /public/polygon HTTP/1.1\r\nHost: gateway.tenderly.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain\r\nContent-Length: 136\r\nOrigin: https://productionmaza.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://productionmaza.cyou/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":136,"data":"{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0x08207B087F61d7e95E441E15fd6d40BEfd6eD308\",\"data\":\"0x38bcdc1c\"},\"latest\"],\"id\":1}"}},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\ncontent-type: application/json; charset=utf-8\r\nvary: Origin\r\ndate: Sat, 28 Mar 2026 01:44:36 GMT\r\ncontent-length: 230\r\nx-envoy-upstream-service-time: 1\r\nserver: envoy\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":230,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"fcb572c37ee3a02bff44e67c8ae334e0","sha1":"0fca85691d823e4b9f9af3445fc4291a7adb5d0f","sha256":"91801dd24d0946d97194a79f984f50190b0b8dbbce4751cf38522cf0b185eabe","sha512":"d1d870b2dba92688cdfa136b430be9b3561b7fa2bec7571503d03e1323631abd20c735abf70192684001b333bc682233e31d99b77f989c871278057caa76cb66","ssdeep":"","tlshash":"47d012d001068361c51c8a00914434153135335658d41e31cf0c8080d51c1073621144","first_seen":"2026-03-27T19:33:35.462111Z","last_seen":"2026-03-28T01:44:59.172441Z","times_seen":3,"resource_available":false,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":27,"connect":15,"send":0,"wait":45,"receive":0,"ssl":22},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1rpc.io/matic","fqdn":"1rpc.io","domain":"1rpc.io","tld":"io"},"ip":{"addr":"20.105.41.175","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://productionmaza.cyou/","date":"2026-03-28T01:44:36.270Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1rpc.io","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Mar 2026 01:15:39 GMT","end":"Mon, 01 Jun 2026 01:15:38 GMT"},"fingerprint":{"sha1":"08:EC:EA:C8:BD:B4:2E:DA:4C:A1:5D:BD:94:99:DE:34:43:E8:A6:FD","sha256":"14:BA:5E:86:C9:2C:CA:B9:CA:48:DF:28:7C:D6:F3:59:7E:D9:C0:59:36:85:8E:7D:9D:76:AB:5A:7E:C9:D3:FD"}}},"request":{"raw":"POST /matic HTTP/1.1\r\nHost: 1rpc.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain\r\nContent-Length: 136\r\nOrigin: https://productionmaza.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://productionmaza.cyou/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":136,"data":"{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0x08207B087F61d7e95E441E15fd6d40BEfd6eD308\",\"data\":\"0x38bcdc1c\"},\"latest\"],\"id\":1}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\naccess-control-allow-origin: *\r\nContent-Length: 144\r\nDate: Sat, 28 Mar 2026 01:44:36 GMT\r\nConnection: keep-alive\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":144,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"c9527cf4b65b955dd3331afb8f054ac9","sha1":"08731596ff100efdff0a2d68bf080730474e1c2a","sha256":"5fb9480e8f21925a902c3006422cdfc3daeea608681574b15fbf23273b8db489","sha512":"34f5f3dad2b79f7b6e6e531d5f301242b498fa7a6f355e92fa5e3866b388508d3e95e3a3a38d40c288b2ad049c1d533cbb2bc7a90add06b62ec0d66634f23307","ssdeep":"","tlshash":"79c02be413ce193127070463250b320077d1dcc6c4433f046c1c00bc40c0245c213374","first_seen":"2026-03-21T20:15:30.727439Z","last_seen":"2026-08-01T11:31:58.521199Z","times_seen":512,"resource_available":true,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":17,"connect":32,"send":0,"wait":28,"receive":0,"ssl":35},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"productionmaza.cyou/api/index.php?q=5fBqAz0j7Hy7U18MAQ","fqdn":"productionmaza.cyou","domain":"productionmaza.cyou","tld":"cyou"},"ip":{"addr":"104.21.55.125","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://productionmaza.cyou/","date":"2026-03-28T01:44:36.443Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"productionmaza.cyou","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Mar 2026 14:10:35 GMT","end":"Sun, 21 Jun 2026 14:10:34 GMT"},"fingerprint":{"sha1":"48:84:F5:A4:4E:3C:10:6C:B5:4C:35:6C:54:BD:5D:F8:A6:E8:C2:21","sha256":"93:E8:5B:79:16:F6:1B:07:A6:0C:0F:EB:6C:DB:25:32:2D:3D:DB:A6:B0:4A:54:D9:85:BF:7C:6E:18:7A:A3:63"}}},"request":{"raw":"GET /api/index.php?q=5fBqAz0j7Hy7U18MAQ HTTP/1.1\r\nHost: productionmaza.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://productionmaza.cyou/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 28 Mar 2026 01:44:36 GMT\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, User-Agent\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mdqJBGUPVI1e3x3owi2o5BlbLwnhIK%2BWx1f7ZtnKVilbfM7zT7ew3k9fN1tHOUnG6XRWxyo4%2FfYb28UhoujtDovEBcsh6i12clXOWUscfQUZcdALcbDupy8CyZ1k16xrhA1QbZFt\"}]}\r\ncontent-encoding: br\r\ncontent-type: application/json\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e32f35bc8df56ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":97,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"385656f50c6e160201e46c143ed6d2f2","sha1":"479c5c08e8f20ceac8726900eadb7736e605439f","sha256":"f2c72bd0059806efef01aa666957921ccade2a9553f2674869ebd74a718189c8","sha512":"9e633f6214c25239b2bcc14e5a62af5fcbd27cdc3357f3e1b3f06a82832e3898a68649b163a5635e93c1348c88f0706f1071dc38deee8e8f0b34e597cf45d364","ssdeep":"","tlshash":"f2b012000688a5432c1a81d29aaa3b352010743eb4d63a5e029c506b06f99c000802a9","first_seen":"2026-03-28T01:44:59.177553Z","last_seen":"2026-03-28T01:44:59.177553Z","times_seen":1,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-28","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"productionmaza.cyou/","fqdn":"productionmaza.cyou","domain":"productionmaza.cyou","tld":"cyou"},"ip":{"addr":"104.21.55.125","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-28T01:44:35.919Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"productionmaza.cyou","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Mar 2026 14:10:35 GMT","end":"Sun, 21 Jun 2026 14:10:34 GMT"},"fingerprint":{"sha1":"48:84:F5:A4:4E:3C:10:6C:B5:4C:35:6C:54:BD:5D:F8:A6:E8:C2:21","sha256":"93:E8:5B:79:16:F6:1B:07:A6:0C:0F:EB:6C:DB:25:32:2D:3D:DB:A6:B0:4A:54:D9:85:BF:7C:6E:18:7A:A3:63"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: productionmaza.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 28 Mar 2026 01:44:36 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Wed, 25 Mar 2026 22:53:16 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GZUdESDvt4tWo9wy%2Bf8eef6EoGdimBBpuLYwkVxVsbr%2FyqSIumTkSfBoltYYXfdcu943iSzIgWCleXc4I3zefuvL09N%2Fg4GtqFZcKneDXYzmkOC4ShAD6j395%2BvD5GQoQCTpLq4m\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9e32f358acb05696-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19984,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (19848)","md5":"250613bedc68af23910389d6482c925f","sha1":"acae3c1b15f1b1c7908bcaeae23ffedf7028751f","sha256":"93cdb9af8a790a17e42541990b588b7c611b640c81db374ea75ba4888c728152","sha512":"a97d1ac4f4ec9d6fbddedd1b374eb64152bba1c5d4e9a2a15b84a58afc6d70a61066f04fc6fbb4916c75495ca110e0bd3d0822621b23b5a941d5c903f1bb028a","ssdeep":"384:C6TfIFI5tsrFtiCIjjItwKVdeMQW/KzayKnRvgsf9f1:C6TWIwPBCctWDYBT3","tlshash":"ce926ca27355ceaaacd63dad647fe6f4832ce58b74e2f4e43b7230b1c18d508514c562","first_seen":"2026-03-27T19:33:35.465189Z","last_seen":"2026-04-17T19:59:30.894219Z","times_seen":121,"resource_available":false,"data":null}},"time_used":197,"timings":{"blocked":29,"dns":35,"connect":1,"send":0,"wait":116,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-28","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Malicious - Copy/Paste Social Engineering (ClickFix)","verdict":"malicious","severity":"medium","comment":"","tags":["malicious","clickfix"],"meta":null}]}},{"url":{"schema":"https","addr":"polygon.drpc.org/","fqdn":"polygon.drpc.org","domain":"drpc.org","tld":"org"},"ip":{"addr":"104.18.10.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://productionmaza.cyou/","date":"2026-03-28T01:44:36.261Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"drpc.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 16 Feb 2026 16:14:00 GMT","end":"Sun, 17 May 2026 17:13:51 GMT"},"fingerprint":{"sha1":"6E:2D:5A:72:A1:75:4A:F0:C7:96:F2:E8:26:78:F5:FC:54:0C:73:93","sha256":"18:E9:96:29:98:D2:5D:4E:19:CD:75:98:36:ED:EB:40:40:C4:23:2C:76:E1:95:F1:4C:85:59:D2:48:CB:AF:4A"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: polygon.drpc.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain\r\nContent-Length: 136\r\nOrigin: https://productionmaza.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://productionmaza.cyou/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":136,"data":"{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0x08207B087F61d7e95E441E15fd6d40BEfd6eD308\",\"data\":\"0x38bcdc1c\"},\"latest\"],\"id\":1}"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 28 Mar 2026 01:44:36 GMT\r\ncontent-type: application/json\r\naccess-control-allow-origin: *\r\nvary: Accept-Encoding\r\nx-drpc-owner-id: cb501251-31a8-4028-8b0a-54679f15c385\r\nx-drpc-owner-tier: free\r\nx-drpc-provider-id: drpc-core-free\r\nx-drpc-trace-id: 407ea5e7ccb3fd0d4289e3e90f479ef9\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9e32f35ad8efb503-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":230,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"fcb572c37ee3a02bff44e67c8ae334e0","sha1":"0fca85691d823e4b9f9af3445fc4291a7adb5d0f","sha256":"91801dd24d0946d97194a79f984f50190b0b8dbbce4751cf38522cf0b185eabe","sha512":"d1d870b2dba92688cdfa136b430be9b3561b7fa2bec7571503d03e1323631abd20c735abf70192684001b333bc682233e31d99b77f989c871278057caa76cb66","ssdeep":"","tlshash":"47d012d001068361c51c8a00914434153135335658d41e31cf0c8080d51c1073621144","first_seen":"2026-03-27T19:33:35.462111Z","last_seen":"2026-03-28T01:44:59.172441Z","times_seen":3,"resource_available":false,"data":null}},"time_used":301,"timings":{"blocked":40,"dns":20,"connect":1,"send":0,"wait":213,"receive":0,"ssl":23},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"polygon.rpc.subquery.network/public","fqdn":"polygon.rpc.subquery.network","domain":"subquery.network","tld":"network"},"ip":{"addr":"51.254.59.59","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://productionmaza.cyou/","date":"2026-03-28T01:44:36.264Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"polygon.rpc.subquery.network","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Feb 2026 23:58:09 GMT","end":"Wed, 27 May 2026 23:58:08 GMT"},"fingerprint":{"sha1":"72:39:64:32:F5:C1:5D:5D:E1:87:13:D3:A1:7A:52:1A:25:2C:50:73","sha256":"1C:81:3E:83:0C:FC:C9:6F:45:17:A0:F3:29:A4:6E:1E:0E:10:C7:3F:EC:5A:94:AE:E9:3B:9E:8C:08:58:26:9D"}}},"request":{"raw":"POST /public HTTP/1.1\r\nHost: polygon.rpc.subquery.network\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain\r\nContent-Length: 136\r\nOrigin: https://productionmaza.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://productionmaza.cyou/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":136,"data":"{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0x08207B087F61d7e95E441E15fd6d40BEfd6eD308\",\"data\":\"0x38bcdc1c\"},\"latest\"],\"id\":1}"}},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/plain; charset=utf-8\r\ncontent-length: 44\r\ndate: Sat, 28 Mar 2026 01:44:36 GMT\r\naccess-control-allow-origin: *\r\nx-continent: EU\r\nx-cluster: eu\r\nx-kong-upstream-latency: 35\r\nx-kong-proxy-latency: 0\r\nx-kong-request-id: e8f1c8353b5930329772997a99317c43\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":44,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"c3c5b52a71f5a756fc74dc8743902eb5","sha1":"371993c677a0ba32e2b0814fa48576d8e7fbbb23","sha256":"0b4a71802fb7edde266a7b554d4ffba50ba16d072fd646a0429615444075f127","sha512":"7f9bd01aa5d0d2e8ed9071e99f6939fcd52ac87f3a807bdfa111fcd3c29b24a21be2f6bfc1949d303186d524668d3e83f102e830dacfe0f89e4f9bd2da89fbb0","ssdeep":"","tlshash":"98900405f50040c1df35510113335d174f4d1c1d10335c3075c51d5c50d4045540cc14","first_seen":"2026-03-12T21:34:16.078888Z","last_seen":"2026-05-17T09:04:35.582086Z","times_seen":27,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":130,"dns":87,"connect":22,"send":0,"wait":58,"receive":0,"ssl":27},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"polygon.lava.build/","fqdn":"polygon.lava.build","domain":"lava.build","tld":"build"},"ip":{"addr":"104.18.24.75","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://productionmaza.cyou/","date":"2026-03-28T01:44:36.263Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"lava.build","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Feb 2026 16:10:31 GMT","end":"Wed, 27 May 2026 16:10:30 GMT"},"fingerprint":{"sha1":"F3:73:B6:71:8A:7E:34:77:DA:D7:B8:78:B8:46:B3:A2:95:DA:11:01","sha256":"BF:40:CA:25:B3:FB:B1:BA:9F:47:78:51:B7:73:2A:66:37:BB:28:C9:72:27:0F:E2:B6:32:C1:64:D7:3F:84:E5"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: polygon.lava.build\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain\r\nContent-Length: 136\r\nOrigin: https://productionmaza.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://productionmaza.cyou/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":136,"data":"{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0x08207B087F61d7e95E441E15fd6d40BEfd6eD308\",\"data\":\"0x38bcdc1c\"},\"latest\"],\"id\":1}"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 28 Mar 2026 01:44:36 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 156\r\nserver: cloudflare\r\ncontent-encoding: br\r\nlava-provider-address: lava@144lcz84eryhpqs3vzvcgtvwhkevhsyd8a6a7u5\r\nprovider-latest-block: 84771120\r\nlava-guid: 15366339476941934680\r\nlava-user-request-type: eth_call\r\nvary: Accept-Encoding\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-origin: *\r\nlava-origin: mainnet-iprpc-eu-1\r\ncf-cache-status: DYNAMIC\r\nset-cookie: __cf_bm=.EobhKaAg3yGXIeaa.27WElDTEmXn5ez9EgnCpcFNL4-1774662276.2941823-1.0.1.1-eAYsc6zFzaRDcTNTPcSEuvGIXHFUK7XMM5jGVc9rTYapV8TJMuRX4wcM3j7v5I.vN2o3vazHoT7pyLWRnrlTEHMLxtr2wCWK99pv9WLp5s1ofgYf.SiGcHvRTyhdNHE.; HttpOnly; Secure; Path=/; Domain=lava.build; Expires=Sat, 28 Mar 2026 02:14:36 GMT\n_cfuvid=cFcpWkv.c1ZyYJmTzweQlTbnMUV4kYR0ZVgsDTpvECw-1774662276.2941823-1.0.1.1-Q53IVULE.BRf472AGzR5HnqQnkv309D2fVT1BKYoxLs; HttpOnly; SameSite=None; Secure; Path=/; Domain=lava.build\r\ncf-ray: 9e32f35adf6b568e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":230,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9541c4940e522e96014c0a8b9a1edf3f","sha1":"b58dfc5cb44a4e796012759380f3b50a99edb384","sha256":"32a460064774186601da61e74e6ad0bc4f75facb8d25a90cc808fa80acb29e38","sha512":"741554eb42488b220509c583273ee5edbd20bb7f8b19bda2d0a76c02467efdb9e5994dd0a6a38de87bf725e31241753b9c38326ba79a2756e7cd9db3fa228756","ssdeep":"","tlshash":"21d012d0010a8321c01c8a00914434053231369658d41e718f0c8480d61c1073621150","first_seen":"2026-03-27T19:33:35.464333Z","last_seen":"2026-03-28T01:44:59.182606Z","times_seen":3,"resource_available":false,"data":null}},"time_used":421,"timings":{"blocked":31,"dns":23,"connect":1,"send":0,"wait":349,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"polygon-pokt.nodies.app/","fqdn":"polygon-pokt.nodies.app","domain":"nodies.app","tld":"app"},"ip":{"addr":"104.26.5.88","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://productionmaza.cyou/","date":"2026-03-28T01:44:36.266Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nodies.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 09 Feb 2026 19:18:13 GMT","end":"Sun, 10 May 2026 20:17:55 GMT"},"fingerprint":{"sha1":"AB:F8:8D:4A:92:81:5E:FE:4E:96:97:B1:98:F2:C5:E6:7A:6A:2E:AB","sha256":"1D:D4:55:F0:DC:75:C9:B5:3E:2A:65:4B:11:D6:80:71:EA:6D:C3:19:DE:0E:16:7F:72:3D:14:B4:5B:10:52:F0"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: polygon-pokt.nodies.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain\r\nContent-Length: 136\r\nOrigin: https://productionmaza.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://productionmaza.cyou/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":136,"data":"{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0x08207B087F61d7e95E441E15fd6d40BEfd6eD308\",\"data\":\"0x38bcdc1c\"},\"latest\"],\"id\":1}"}},"response":{"raw":"HTTP/2 415 Unsupported Media Type\r\ndate: Sat, 28 Mar 2026 01:44:36 GMT\r\ncontent-type: text/plain; charset=utf-8\r\ncontent-length: 79\r\nserver: cloudflare\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\nvary: Origin, accept-encoding\r\nx-content-type-options: nosniff\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sd4XWXyhcDXLjo0rgqHSzHXeviTpqG5w%2BWhvHAkTsXrRLg8bCEJ8C0VAoASvmTq3ei0d%2BwkW%2BdpgYx9zKQFlg1cvdvGcmgn2KH%2BMvmGqOPsorp4MfNoSESz3rAjQgZ%2FGZw7AtNPpp0Mp\"}]}\r\ncf-ray: 9e32f35b0f7d568e-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"415","status_text":"Unsupported Media Type","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":57,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"a6b43ff666fdace2b8eba7f3588c37f2","sha1":"8a30f58cebc0554359b86837069efeac91730753","sha256":"47e603818bcb97881bda4879383d3174cd26cff43da5696a3ed6bf6f4fd9ac19","sha512":"1ed8602ef4bcdffd207288aa90c752d975316a9e96f6be26d91947fcc65bc2bf004014d596f56b24d49d0f8eda420c239adcc7656a143a7f6597b335e55d58ee","ssdeep":"","tlshash":"2f9022b0000000000bab02fb2c00bc822ba0803c0c80200c208800000cc00a88203300","first_seen":"2026-03-12T21:34:16.105445Z","last_seen":"2026-06-06T20:33:07.724052Z","times_seen":414,"resource_available":false,"data":null}},"time_used":245,"timings":{"blocked":58,"dns":33,"connect":3,"send":0,"wait":121,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"polygon.gateway.tenderly.co/","fqdn":"polygon.gateway.tenderly.co","domain":"tenderly.co","tld":"co"},"ip":{"addr":"35.227.193.242","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://productionmaza.cyou/","date":"2026-03-28T01:44:36.267Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gateway.tenderly.co","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 15 Feb 2026 19:54:10 GMT","end":"Sat, 16 May 2026 19:54:09 GMT"},"fingerprint":{"sha1":"74:34:7F:6A:E5:04:AE:05:FB:EC:54:79:AE:11:49:CE:8D:41:8F:B2","sha256":"C3:08:57:AE:89:C0:8C:3E:0E:63:A4:2B:D7:C7:BC:DE:92:A1:A1:2B:EE:B3:24:71:42:72:65:63:D0:DF:E8:C6"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: polygon.gateway.tenderly.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain\r\nContent-Length: 136\r\nOrigin: https://productionmaza.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://productionmaza.cyou/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":136,"data":"{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0x08207B087F61d7e95E441E15fd6d40BEfd6eD308\",\"data\":\"0x38bcdc1c\"},\"latest\"],\"id\":1}"}},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\ncontent-type: application/json; charset=utf-8\r\nvary: Origin\r\ndate: Sat, 28 Mar 2026 01:44:36 GMT\r\ncontent-length: 230\r\nx-envoy-upstream-service-time: 1\r\nserver: envoy\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":230,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"fcb572c37ee3a02bff44e67c8ae334e0","sha1":"0fca85691d823e4b9f9af3445fc4291a7adb5d0f","sha256":"91801dd24d0946d97194a79f984f50190b0b8dbbce4751cf38522cf0b185eabe","sha512":"d1d870b2dba92688cdfa136b430be9b3561b7fa2bec7571503d03e1323631abd20c735abf70192684001b333bc682233e31d99b77f989c871278057caa76cb66","ssdeep":"","tlshash":"47d012d001068361c51c8a00914434153135335658d41e31cf0c8080d51c1073621144","first_seen":"2026-03-27T19:33:35.462111Z","last_seen":"2026-03-28T01:44:59.172441Z","times_seen":3,"resource_available":false,"data":null}},"time_used":137,"timings":{"blocked":-1,"dns":27,"connect":30,"send":0,"wait":44,"receive":1,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"productionmaza.cyou/cf.js?v=2","fqdn":"productionmaza.cyou","domain":"productionmaza.cyou","tld":"cyou"},"ip":{"addr":"104.21.55.125","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://productionmaza.cyou/","date":"2026-03-28T01:44:36.510Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"productionmaza.cyou","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Mar 2026 14:10:35 GMT","end":"Sun, 21 Jun 2026 14:10:34 GMT"},"fingerprint":{"sha1":"48:84:F5:A4:4E:3C:10:6C:B5:4C:35:6C:54:BD:5D:F8:A6:E8:C2:21","sha256":"93:E8:5B:79:16:F6:1B:07:A6:0C:0F:EB:6C:DB:25:32:2D:3D:DB:A6:B0:4A:54:D9:85:BF:7C:6E:18:7A:A3:63"}}},"request":{"raw":"GET /cf.js?v=2 HTTP/1.1\r\nHost: productionmaza.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://productionmaza.cyou/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 28 Mar 2026 01:44:36 GMT\r\nserver: cloudflare\r\nlast-modified: Wed, 25 Mar 2026 19:55:24 GMT\r\netag: \"6581b-64ddea60cb040-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400, must-revalidate\r\npragma: no-cache\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pUZZfWoQXrmnmbryhzZzPNFn4mwe0iad2%2BcE61kW3k2voGaksoWU5sT7S6XSULLklKH7ZUjQ5v1DW0jx7lvxHi%2BwoUtX1MmbDVBBmH%2Bw2cPnjWY94HGlAF3rKAOjB72e5WYl%2FLYG\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncontent-type: text/javascript\r\ncf-cache-status: EXPIRED\r\ncf-ray: 9e32f35c28e156ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":415771,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (55100)","md5":"89447f240dbedf42aaf80e8887167d7a","sha1":"bd6ea0e4ce62f0064d5665ebae4eec5a71b5c0ca","sha256":"36cc73c786f8ac5958267473dd92f377af2b15ae7e1e0d363378e88614c951af","sha512":"be857dc665df784e83e0dd62e49c5da178a361557938c639110013512ecb7a104ef9574cded7396cfd83cb6fea8e3805cf22c982a341bf40231b5a29b280de42","ssdeep":"6144:QXOt8uGgr25Ot8uGgr2QOt8uGgr2HOt8uGgr2pjFHco3qG:Q+i/grRi/grGi/grXi/grIjFHco5","tlshash":"7694d037196f6f4475175c45a0083b182ce938abfa14cae4bcdd48a66be8630dd3e6f4","first_seen":"2026-03-27T19:33:35.460662Z","last_seen":"2026-05-26T20:12:11.185349Z","times_seen":300,"resource_available":true,"data":null}},"time_used":339,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":118,"receive":221,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-28","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-27","alert":"Sinkholed","trigger":"productionmaza.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Malicious - Copy/Paste Social Engineering (ClickFix)","verdict":"malicious","severity":"medium","comment":"","tags":["malicious","clickfix"],"meta":null}]}}]}