{"report_id":"7b5ecfe8-f07f-4b2e-a15d-14f53379388f","version":0,"status":"done","tags":[],"date":"2026-10-15T01:28:32Z","url":{"schema":"http","addr":"mask-gift.com/","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":0,"asn":45102,"as":"Alibaba (US) Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"mask-gift.com/","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"title":"MetaMask Crypto Wallet","dom":{"size":12803,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5148)","md5":"2aa533c85a19dcc8ef6e45f8a3716ad4","sha1":"06776a2d09a676354b9978ad3dff42d6dd927cf3","sha256":"eff132ebccbdb0f6c4098e3b136ade64e8aa65eb9ba1793be32b1a0abd722961","sha512":"876608dc2377c4e624936953bd7805bf584ed5f2aafdad52515264a7071a5f1df03ac7ae10a1278374eddd546b3077b5ccacfab2d9ce8d394bae9d782647f73b","ssdeep":"384:hRpYxKHmu0qJZ3vED/8uxN/HC3y/Bcq0Kb4iEhV0fu1OANjCK:ffED/8uxN/HC3y/Bcq0Kb4iEhV0fu1Rz","tlshash":"f14200e28563145a5637f1e2226a5f6d61f48647f2438818bbfc035e4fcfcc476839aa","dom_hash":"domhashcd7f31fe8bbe55d89570ee73f6c99e5e","first_seen":"2026-10-15T01:28:35.163157Z","last_seen":"2026-10-15T01:28:35.163157Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"mask-gift.com/","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":0,"asn":45102,"as":"Alibaba (US) Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-19T01:28:32Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"mask-gift.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"mask-gift.com","ip":{"addr":"47.243.214.43","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"domain_registered":"2026-10-12","domain_rank":0,"first_seen":"2026-10-15T01:18:39.928217Z","last_seen":"2026-10-15T01:18:39.928217Z","alert_count":11,"request_count":11,"received_data":297609,"sent_data":5198,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"mask-gift.com/click-counter.js?v=2","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e7cbd3ede39e910d0c54f92fb53105f","sha1":"07a948c4ea38c4a20a05e11a9ea992f23643b29b","sha256":"a63bd0bb478cd18693f85b0748253d74c9f01b896fda66bcbf83f97b2cbf35bd","sha512":"88548850d90f4c816a98c762e11c7456484dc980d83dde121d83d5659eaa2745186467b4196dd753cf5d52d42515739a01250edc2ee778f7d61b25ef2cdff081","ssdeep":"","tlshash":"6011bd9e9ad716e309abb0fe135f964531354487584a9c607cce6b805f981fe19f07cc","size":1007,"data":"","first_seen":"2026-10-15T01:18:44.279113Z","last_seen":"2026-10-15T01:28:35.1747Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mask-gift.com/d/file/p/n1847.html","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"0bcc46d1200f9353067148f859ba99fe","sha1":"cbde96e38c2ebad71e0895089f7fed87fbeb3708","sha256":"7a3ade176812f07d85dec45ff91d8945f75498aa0d235d92204277071a217c19","sha512":"b0770bf54a8f61f729699fcd4992fb411d7718395bc704e007824cc213fb19aae1dc4da50d7313e623fbda5535ad943c07b9889ddd8a48eada039b5cefb04294","ssdeep":"","tlshash":"c501ab5d1e9702b0029216fd1aae922031bac017910dde4136dfdd58bf90e2a42bffec","size":844,"data":"","first_seen":"2026-10-15T01:18:44.287267Z","last_seen":"2026-10-15T01:28:35.177142Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mask-gift.com/d/file/p/runtime.js","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"43dac28dc20887793eef55ee01f1e612","sha1":"6a5d8f253f2bb875452e715058ca5ddead170ce9","sha256":"48aed0d3849523c8d9900eedfde5c6cd8df0c7ff6d85d9ff28342cb948ddb86f","sha512":"1675d95aaf7ad5a2b7308c0b3640e9c9c75d02edbf4465953a5dcd9c0782377a0d0ac793609e8a3dcb333d1d5959136c90b4c27d6c7ef2981d9456330ecc29cf","ssdeep":"192:YDj2lXvjMgyNQanuiDkyy5Tk1AJ1baGlbyRiy:wK6","tlshash":"61f14e6e4db308594663397d1b6f621837319017284cec28bf8dc3a05fe622d5ad2bac","size":7908,"data":"","first_seen":"2026-10-15T01:18:44.27289Z","last_seen":"2026-10-15T01:28:35.171141Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mask-gift.com/255c4276-d3dd-41b0-a0c3-efc784e5a765","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"introduction_type":"","is_inline":false,"md5":"c9b571dca8fd1ad7c085b1456ea6c3be","sha1":"ec55775d4f9431fb60f95711c9c895b2f6fc10dd","sha256":"9da56f48d840633dabff7bbbfa5d8def37ae450fd206520b82a28b165e353698","sha512":"76492c8decae654703ee41ff67cc4d92808ac5a4334ab78b3a4fe497050b004c1088a3b186b9fb44da622d8414f027ced209c1311f61aae1b6d2a728ea1fcfa5","ssdeep":"768:5gWDbsgrV29ePPmdVyjPAvK42a5wgDzE6VUEDiAwom5FtnMDxWnT6qdzo6:dbsgrV29ePP0VyzAvKm5RVUEDiAwom5d","tlshash":"711385185eb706868333b26f9f5ff408257ab517b088e8587e4cd6205fca494e987f9c","size":45325,"data":"","first_seen":"2026-10-15T01:18:44.274744Z","last_seen":"2026-10-15T01:28:35.175625Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mask-gift.com/d/file/p/n1847.html","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"introduction_type":"eval","is_inline":false,"md5":"2de171c44830876f93b3d813c5e67303","sha1":"cb43f61bcd415ee2badd5ec6471295d0aad0d7d6","sha256":"3196034ef1196c9151395859019674e14e3c06e3fdbf230c7e0d0c5f6211824a","sha512":"60cb9c01b52310c3d3a18019e203e39fe4eaab0c549cd86888838e3e0fc9c06c122114913c2d9ae946b11044a80811e2c38b638725bf25ff8751f7fd3ca4e4a6","ssdeep":"1536:CW2hWh2G4sG4K/M9/hYIQwmQw3SKoSKypkApk9KzpXVTXVSTzTqoXoJe1ce1OefI:C/1MqYJxsJSsXao5XJzKYtoKh","tlshash":"040494205f091995c87ac4d63eb78c04c2e71b07d83a4573b43d8f0c1fbf696a9d6aa9","size":182339,"data":"","first_seen":"2026-10-06T14:51:54.893187Z","last_seen":"2026-10-15T01:28:35.17648Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mask-gift.com/8da13e56-297a-4868-9843-a22ff0181426","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"introduction_type":"","is_inline":false,"md5":"9b0d0b9120084da7bcdcb8bf23ef692d","sha1":"e15733576c4a273e6878e28ba8502d6bcd4f2ad8","sha256":"cf5fe85655a16e162a980acc4d6577155250cb2b4c3db9be35842d850109b561","sha512":"d14b852c4f537c36c5863ba77c2d3d3811eaf04e7d3379fcd83a419206eb3e950eeb69160aea0ace744541fda9dfedeb2850970a2ab5b79783348b10c32f8c44","ssdeep":"","tlshash":"59e0685473ada49ac98900d35c3c630b9032f1304c1ee0904506c04617ed16ae243b1c","size":360,"data":"","first_seen":"2026-10-15T01:18:44.28547Z","last_seen":"2026-10-15T01:28:35.177951Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mask-gift.com/local-lottery.js?v=37","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"d05afdea12b15a7d1101a8ff8c5a7079","sha1":"349174cf553a5e995b8bc54a91ada0ea3b56b7c3","sha256":"e2499ebd10a73e868cee57cb8d5e7278d9d7b0dd19e1117f96859bf9391da58e","sha512":"0eff1e5d43210df1087ed0715a9bbc7e4200bd36639f039a0c49503377f205ff4d1e176631dee9f2f4eab0d90986388e683aa466487f1736ad5f805689261b66","ssdeep":"384:cj97jwqNmMsjzieiZB1GohD7kmqUs5zpH87RHOM3hxB5B1Yn41:cxjwqNmMsyvZB1GohEmqUs4OEVs41","tlshash":"05c2611cade321b155bb607d67efa688307011034009ca203dadda892fe5d656abfbdd","size":26444,"data":"","first_seen":"2026-10-15T01:18:44.282184Z","last_seen":"2026-10-15T01:28:35.173925Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"mask-gift.com/local-lottery.css?v=33","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mask-gift.com/","date":"2026-10-15T01:27:57.818Z","timestamp":1792027677818,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mask-gift.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Oct 2026 15:46:11 GMT","end":"Sun, 10 Jan 2027 15:46:10 GMT"},"fingerprint":{"sha1":"8B:07:E3:1A:0B:71:44:EE:68:90:6C:7A:ED:D9:E9:50:5C:F7:34:B1","sha256":"5C:E7:79:26:45:2E:BF:CE:42:03:5E:A3:4B:C4:B1:54:2F:B9:82:4E:C3:3A:D5:C4:79:89:6D:3E:61:32:F3:2C"}}},"request":{"raw":"GET /local-lottery.css?v=33 HTTP/1.1\r\nHost: mask-gift.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mask-gift.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:27:57 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 12 Oct 2026 00:02:05 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6acc237d-3a59\"\r\nexpires: Thu, 15 Oct 2026 13:27:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14937,"size_decoded":4738,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"353e48935d11757753143ac509425194","sha1":"23429725b7dedcdabb683a3980e443d948940e16","sha256":"f69686111a0d82967044bc093c75843c2669eb32a0871fd0d76c6ec3f94199e8","sha512":"a62564cb20c7ef1b47d7f07e97b9c556404d3026b01c59080e4b4484b80e042fe08c07db477df98dd8303247126d7be738ccd0bcc955d3b34ab97344ae688974","ssdeep":"192:10g5H8YTLxDp7z2gTWxdD+2gTdxBaxxx7oYsOQIRdpYP8eD7OtcDaX21XkIB91ZO:GCLDYsOzxeetg7kAF29dJrixwnh","tlshash":"f362956499d30914306bc1cc78e3ca5cbf689406de0bdd7c77eb9418bf8d28ca966e19","first_seen":"2026-10-15T01:18:44.280908Z","last_seen":"2026-10-15T01:28:35.166521Z","times_seen":2,"resource_available":true,"data":null}},"time_used":269,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":269,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"mask-gift.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mask-gift.com/click-api.php","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"beacon","requested_by":"https://mask-gift.com/","date":"2026-10-15T01:27:58.121Z","timestamp":1792027678121,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mask-gift.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Oct 2026 15:46:11 GMT","end":"Sun, 10 Jan 2027 15:46:10 GMT"},"fingerprint":{"sha1":"8B:07:E3:1A:0B:71:44:EE:68:90:6C:7A:ED:D9:E9:50:5C:F7:34:B1","sha256":"5C:E7:79:26:45:2E:BF:CE:42:03:5E:A3:4B:C4:B1:54:2F:B9:82:4E:C3:3A:D5:C4:79:89:6D:3E:61:32:F3:2C"}}},"request":{"raw":"POST /click-api.php HTTP/1.1\r\nHost: mask-gift.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nContent-Length: 17\r\nOrigin: https://mask-gift.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mask-gift.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":17,"data":"{\"event\":\"visit\"}"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:27:58 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\ncache-control: no-store\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11,"size_decoded":483,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"82380d1e263b6093f3c7535690fcdd75","sha1":"022d91f218046ab2e61cac1eb13d6a718f75df2b","sha256":"4062edaf750fb8074e7e83e0c9028c94e32468a8b6f1614774328ef045150f93","sha512":"180ea3cf6e7a00cb12ecff7ce095b8cef1921621de681a64e5e53e3efc0cf6053e557205f2bdb9b9d5af4de3d54c79d1c9b1c474b83897590c647b1e92d9c93a","ssdeep":"","tlshash":"2a500003000c0030c00003000300ff30000300300000000c000c3000033000c0003c03","first_seen":"2023-04-05T15:24:10Z","last_seen":"2026-10-15T03:23:12.398428Z","times_seen":25278,"resource_available":true,"data":null}},"time_used":270,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":270,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"mask-gift.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mask-gift.com/d/file/p/n1847.html","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://mask-gift.com/","date":"2026-10-15T01:27:58.125Z","timestamp":1792027678125,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mask-gift.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Oct 2026 15:46:11 GMT","end":"Sun, 10 Jan 2027 15:46:10 GMT"},"fingerprint":{"sha1":"8B:07:E3:1A:0B:71:44:EE:68:90:6C:7A:ED:D9:E9:50:5C:F7:34:B1","sha256":"5C:E7:79:26:45:2E:BF:CE:42:03:5E:A3:4B:C4:B1:54:2F:B9:82:4E:C3:3A:D5:C4:79:89:6D:3E:61:32:F3:2C"}}},"request":{"raw":"GET /d/file/p/n1847.html HTTP/1.1\r\nHost: mask-gift.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mask-gift.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:27:58 GMT\r\ncontent-type: text/html\r\ncontent-length: 973\r\nlast-modified: Mon, 12 Oct 2026 16:38:01 GMT\r\netag: \"6acd0ce9-3cd\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":973,"size_decoded":1409,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"f3e87adc361b633d73cad2b42ebeb250","sha1":"2df1edd2c734d09c6b44c020ddda2793475afa4c","sha256":"e97b2b77966ceab4cfdaf3a2d3c1babc19e286fd8f6942e97712f2c6481fa77c","sha512":"15c54faf6dc1e453c5da2f020a3e23fecfdedaa6517bf0aadaa2fca4a1abe0f16c2a44b0e9f5e3e6745cd506ff55e200dcc1cdf7e7cf6cad3c9ad2312034a03b","ssdeep":"","tlshash":"a411144e1e970160019116ed1aaed22431fad157910ddd4036dfe868bf90f1a86bffec","first_seen":"2026-10-15T01:18:44.284075Z","last_seen":"2026-10-15T01:28:35.168369Z","times_seen":2,"resource_available":true,"data":null}},"time_used":269,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":269,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"mask-gift.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mask-gift.com/favicon.ico","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mask-gift.com/","date":"2026-10-15T01:27:58.126Z","timestamp":1792027678126,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mask-gift.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Oct 2026 15:46:11 GMT","end":"Sun, 10 Jan 2027 15:46:10 GMT"},"fingerprint":{"sha1":"8B:07:E3:1A:0B:71:44:EE:68:90:6C:7A:ED:D9:E9:50:5C:F7:34:B1","sha256":"5C:E7:79:26:45:2E:BF:CE:42:03:5E:A3:4B:C4:B1:54:2F:B9:82:4E:C3:3A:D5:C4:79:89:6D:3E:61:32:F3:2C"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: mask-gift.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mask-gift.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:27:58 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":279,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-10-15T03:33:58.732068Z","times_seen":568054,"resource_available":true,"data":null}},"time_used":269,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":269,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"mask-gift.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mask-gift.com/local-logo.png","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mask-gift.com/","date":"2026-10-15T01:27:58.129Z","timestamp":1792027678129,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mask-gift.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Oct 2026 15:46:11 GMT","end":"Sun, 10 Jan 2027 15:46:10 GMT"},"fingerprint":{"sha1":"8B:07:E3:1A:0B:71:44:EE:68:90:6C:7A:ED:D9:E9:50:5C:F7:34:B1","sha256":"5C:E7:79:26:45:2E:BF:CE:42:03:5E:A3:4B:C4:B1:54:2F:B9:82:4E:C3:3A:D5:C4:79:89:6D:3E:61:32:F3:2C"}}},"request":{"raw":"GET /local-logo.png HTTP/1.1\r\nHost: mask-gift.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mask-gift.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:27:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Sun, 11 Oct 2026 21:58:21 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6acc067d-1f0e\"\r\nexpires: Sat, 14 Nov 2026 01:27:58 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7950,"size_decoded":8488,"mime_type":"image/png","magic":"PNG image data, 300 x 149, 8-bit/color RGBA, non-interlaced","md5":"cf7d40bede37106e65de9181e25e0852","sha1":"557c56e3a8a2046ff600ce58c89c1d331d60d278","sha256":"8199e1502134aee2dce09c2951c4c800ebc31f3074594aa68351d7f78b4fdca3","sha512":"02c55d6f2e9a5a261e6768a920511aed40d5348adda5b77b7b7b2a8c66317a100cbe3e05efc4360a2ca56d1868ef860f71a589795a1f02e8be00a969c21562ea","ssdeep":"192:96nCtyoo3jsWOvFi3Ux+NlLTcyP6m6BmCURvqV:o2yoo3jPy6NtcyPPSmCG+","tlshash":"d2f19fe71b38c84bc3535856f0d60a88e5f6e917e76f5702e140f1ac1d8e1aa44e3763","first_seen":"2026-10-15T01:18:44.271343Z","last_seen":"2026-10-15T01:28:35.170179Z","times_seen":2,"resource_available":false,"data":null}},"time_used":270,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":270,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"mask-gift.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mask-gift.com/d/file/p/runtime.js","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mask-gift.com/d/file/p/n1847.html","date":"2026-10-15T01:27:58.408Z","timestamp":1792027678408,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mask-gift.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Oct 2026 15:46:11 GMT","end":"Sun, 10 Jan 2027 15:46:10 GMT"},"fingerprint":{"sha1":"8B:07:E3:1A:0B:71:44:EE:68:90:6C:7A:ED:D9:E9:50:5C:F7:34:B1","sha256":"5C:E7:79:26:45:2E:BF:CE:42:03:5E:A3:4B:C4:B1:54:2F:B9:82:4E:C3:3A:D5:C4:79:89:6D:3E:61:32:F3:2C"}}},"request":{"raw":"GET /d/file/p/runtime.js HTTP/1.1\r\nHost: mask-gift.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mask-gift.com/d/file/p/n1847.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:27:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 12 Oct 2026 16:38:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6acd0ce9-1ee4\"\r\nexpires: Thu, 15 Oct 2026 13:27:58 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7908,"size_decoded":2927,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"43dac28dc20887793eef55ee01f1e612","sha1":"6a5d8f253f2bb875452e715058ca5ddead170ce9","sha256":"48aed0d3849523c8d9900eedfde5c6cd8df0c7ff6d85d9ff28342cb948ddb86f","sha512":"1675d95aaf7ad5a2b7308c0b3640e9c9c75d02edbf4465953a5dcd9c0782377a0d0ac793609e8a3dcb333d1d5959136c90b4c27d6c7ef2981d9456330ecc29cf","ssdeep":"192:YDj2lXvjMgyNQanuiDkyy5Tk1AJ1baGlbyRiy:wK6","tlshash":"61f14e6e4db308594663397d1b6f621837319017284cec28bf8dc3a05fe622d5ad2bac","first_seen":"2026-10-15T01:18:44.27289Z","last_seen":"2026-10-15T01:28:35.171141Z","times_seen":2,"resource_available":true,"data":null}},"time_used":270,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":270,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"mask-gift.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mask-gift.com/","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-15T01:27:56.772Z","timestamp":1792027676772,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mask-gift.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Oct 2026 15:46:11 GMT","end":"Sun, 10 Jan 2027 15:46:10 GMT"},"fingerprint":{"sha1":"8B:07:E3:1A:0B:71:44:EE:68:90:6C:7A:ED:D9:E9:50:5C:F7:34:B1","sha256":"5C:E7:79:26:45:2E:BF:CE:42:03:5E:A3:4B:C4:B1:54:2F:B9:82:4E:C3:3A:D5:C4:79:89:6D:3E:61:32:F3:2C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: mask-gift.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:27:57 GMT\r\ncontent-type: text/html\r\nlast-modified: Mon, 12 Oct 2026 18:30:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6acd274c-154d\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5453,"size_decoded":2471,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"31ba92636aad8c640697854de258b82e","sha1":"2914bedad16fd9e165beffd48943a4491001a1ec","sha256":"d2cdd54acd62dd95cdbbcb6323b5562a80700d27caff59524de761587c4d5cb4","sha512":"e2ccccee2bb7270f5c0819a9aad1486f05357ef57292e9d2f6bcaf93b9a4b1f49605910645f73aae78f1db4fb1d566ae85d192aa9b7ee2c01c2584b422ffff01","ssdeep":"96:/v9STSS55uA3q0qaIPcw5xYqw5v/DYxrGlDjDTxc8nBGl8ObVI77P+dKEJNhvpej:/v9STSSHuA3zL2cw5lov/DYxrGlDjDT/","tlshash":"b7b15097aa632185f523d4d92fa35b6c0264d007e10acc297fdc268e8f9b1cd65d378e","first_seen":"2026-10-15T01:18:44.277083Z","last_seen":"2026-10-15T01:28:35.172049Z","times_seen":2,"resource_available":true,"data":null}},"time_used":816,"timings":{"blocked":-1,"dns":4,"connect":269,"send":0,"wait":269,"receive":0,"ssl":273},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"mask-gift.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mask-gift.com/local-lottery.js?v=37","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mask-gift.com/","date":"2026-10-15T01:27:57.820Z","timestamp":1792027677820,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mask-gift.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Oct 2026 15:46:11 GMT","end":"Sun, 10 Jan 2027 15:46:10 GMT"},"fingerprint":{"sha1":"8B:07:E3:1A:0B:71:44:EE:68:90:6C:7A:ED:D9:E9:50:5C:F7:34:B1","sha256":"5C:E7:79:26:45:2E:BF:CE:42:03:5E:A3:4B:C4:B1:54:2F:B9:82:4E:C3:3A:D5:C4:79:89:6D:3E:61:32:F3:2C"}}},"request":{"raw":"GET /local-lottery.js?v=37 HTTP/1.1\r\nHost: mask-gift.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mask-gift.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:27:57 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 12 Oct 2026 16:18:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6acd083e-674c\"\r\nexpires: Thu, 15 Oct 2026 13:27:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26444,"size_decoded":7785,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"d05afdea12b15a7d1101a8ff8c5a7079","sha1":"349174cf553a5e995b8bc54a91ada0ea3b56b7c3","sha256":"e2499ebd10a73e868cee57cb8d5e7278d9d7b0dd19e1117f96859bf9391da58e","sha512":"0eff1e5d43210df1087ed0715a9bbc7e4200bd36639f039a0c49503377f205ff4d1e176631dee9f2f4eab0d90986388e683aa466487f1736ad5f805689261b66","ssdeep":"384:cj97jwqNmMsjzieiZB1GohD7kmqUs5zpH87RHOM3hxB5B1Yn41:cxjwqNmMsyvZB1GohEmqUs4OEVs41","tlshash":"05c2611cade321b155bb607d67efa688307011034009ca203dadda892fe5d656abfbdd","first_seen":"2026-10-15T01:18:44.282184Z","last_seen":"2026-10-15T01:28:35.173925Z","times_seen":2,"resource_available":true,"data":null}},"time_used":270,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":270,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"mask-gift.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mask-gift.com/click-counter.js?v=2","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mask-gift.com/","date":"2026-10-15T01:27:57.822Z","timestamp":1792027677822,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mask-gift.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Oct 2026 15:46:11 GMT","end":"Sun, 10 Jan 2027 15:46:10 GMT"},"fingerprint":{"sha1":"8B:07:E3:1A:0B:71:44:EE:68:90:6C:7A:ED:D9:E9:50:5C:F7:34:B1","sha256":"5C:E7:79:26:45:2E:BF:CE:42:03:5E:A3:4B:C4:B1:54:2F:B9:82:4E:C3:3A:D5:C4:79:89:6D:3E:61:32:F3:2C"}}},"request":{"raw":"GET /click-counter.js?v=2 HTTP/1.1\r\nHost: mask-gift.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mask-gift.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:27:57 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 1007\r\nlast-modified: Mon, 12 Oct 2026 18:30:27 GMT\r\netag: \"6acd2743-3ef\"\r\nexpires: Thu, 15 Oct 2026 13:27:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1007,"size_decoded":1527,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"9e7cbd3ede39e910d0c54f92fb53105f","sha1":"07a948c4ea38c4a20a05e11a9ea992f23643b29b","sha256":"a63bd0bb478cd18693f85b0748253d74c9f01b896fda66bcbf83f97b2cbf35bd","sha512":"88548850d90f4c816a98c762e11c7456484dc980d83dde121d83d5659eaa2745186467b4196dd753cf5d52d42515739a01250edc2ee778f7d61b25ef2cdff081","ssdeep":"","tlshash":"6011bd9e9ad716e309abb0fe135f964531354487584a9c607cce6b805f981fe19f07cc","first_seen":"2026-10-15T01:18:44.279113Z","last_seen":"2026-10-15T01:28:35.1747Z","times_seen":2,"resource_available":true,"data":null}},"time_used":269,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":269,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"mask-gift.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mask-gift.com/d/file/p/chunk-w84.js?1792027678683","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://mask-gift.com/d/file/p/n1847.html","date":"2026-10-15T01:27:58.685Z","timestamp":1792027678685,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mask-gift.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Oct 2026 15:46:11 GMT","end":"Sun, 10 Jan 2027 15:46:10 GMT"},"fingerprint":{"sha1":"8B:07:E3:1A:0B:71:44:EE:68:90:6C:7A:ED:D9:E9:50:5C:F7:34:B1","sha256":"5C:E7:79:26:45:2E:BF:CE:42:03:5E:A3:4B:C4:B1:54:2F:B9:82:4E:C3:3A:D5:C4:79:89:6D:3E:61:32:F3:2C"}}},"request":{"raw":"GET /d/file/p/chunk-w84.js?1792027678683 HTTP/1.1\r\nHost: mask-gift.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mask-gift.com/d/file/p/n1847.html\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:27:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 12 Oct 2026 16:38:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6acd0ce9-b10d\"\r\nexpires: Thu, 15 Oct 2026 13:27:58 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":45325,"size_decoded":10972,"mime_type":"application/javascript","magic":"C++ source, Unicode text, UTF-8 text","md5":"c9b571dca8fd1ad7c085b1456ea6c3be","sha1":"ec55775d4f9431fb60f95711c9c895b2f6fc10dd","sha256":"9da56f48d840633dabff7bbbfa5d8def37ae450fd206520b82a28b165e353698","sha512":"76492c8decae654703ee41ff67cc4d92808ac5a4334ab78b3a4fe497050b004c1088a3b186b9fb44da622d8414f027ced209c1311f61aae1b6d2a728ea1fcfa5","ssdeep":"768:5gWDbsgrV29ePPmdVyjPAvK42a5wgDzE6VUEDiAwom5FtnMDxWnT6qdzo6:dbsgrV29ePP0VyzAvKm5RVUEDiAwom5d","tlshash":"711385185eb706868333b26f9f5ff408257ab517b088e8587e4cd6205fca494e987f9c","first_seen":"2026-10-15T01:18:44.274744Z","last_seen":"2026-10-15T01:28:35.175625Z","times_seen":2,"resource_available":true,"data":null}},"time_used":539,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":539,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"mask-gift.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mask-gift.com/d/file/p/chunk-m.js?1792027679233","fqdn":"mask-gift.com","domain":"mask-gift.com","tld":"com"},"ip":{"addr":"47.243.214.43","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://mask-gift.com/d/file/p/n1847.html","date":"2026-10-15T01:27:59.235Z","timestamp":1792027679235,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mask-gift.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Oct 2026 15:46:11 GMT","end":"Sun, 10 Jan 2027 15:46:10 GMT"},"fingerprint":{"sha1":"8B:07:E3:1A:0B:71:44:EE:68:90:6C:7A:ED:D9:E9:50:5C:F7:34:B1","sha256":"5C:E7:79:26:45:2E:BF:CE:42:03:5E:A3:4B:C4:B1:54:2F:B9:82:4E:C3:3A:D5:C4:79:89:6D:3E:61:32:F3:2C"}}},"request":{"raw":"GET /d/file/p/chunk-m.js?1792027679233 HTTP/1.1\r\nHost: mask-gift.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mask-gift.com/d/file/p/n1847.html\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:27:59 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 12 Oct 2026 16:38:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6acd0ce9-2c843\"\r\nexpires: Thu, 15 Oct 2026 13:27:59 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":182339,"size_decoded":18431,"mime_type":"application/javascript","magic":"ASCII text, with CRLF line terminators","md5":"2de171c44830876f93b3d813c5e67303","sha1":"cb43f61bcd415ee2badd5ec6471295d0aad0d7d6","sha256":"3196034ef1196c9151395859019674e14e3c06e3fdbf230c7e0d0c5f6211824a","sha512":"60cb9c01b52310c3d3a18019e203e39fe4eaab0c549cd86888838e3e0fc9c06c122114913c2d9ae946b11044a80811e2c38b638725bf25ff8751f7fd3ca4e4a6","ssdeep":"1536:CW2hWh2G4sG4K/M9/hYIQwmQw3SKoSKypkApk9KzpXVTXVSTzTqoXoJe1ce1OefI:C/1MqYJxsJSsXao5XJzKYtoKh","tlshash":"040494205f091995c87ac4d63eb78c04c2e71b07d83a4573b43d8f0c1fbf696a9d6aa9","first_seen":"2026-10-06T14:51:54.893187Z","last_seen":"2026-10-15T01:28:35.17648Z","times_seen":7,"resource_available":true,"data":null}},"time_used":271,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":271,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"mask-gift.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}