{"report_id":"7d727d80-cbe8-4285-885e-c20b12b549a5","version":0,"status":"done","tags":[],"date":"2026-06-27T16:10:41Z","url":{"schema":"http","addr":"ys904.top","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"ys904.top/","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"title":"ys904.top/","dom":{"size":18901,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (422)","md5":"1fa2be3e234a95419eadd1286ae47b57","sha1":"76c77ee11a72d123a6e71a6f5ed22475c2cd2bd5","sha256":"56b2cdcbbcc802b96f84754c6752d260ef9750bb5cd15ba5371661a908468428","sha512":"56729853b76e1e6b2a8068a39f72daeff7b069b1149f3e9d959cfffe9b5f5d273f1e99a2522476a406ebe8b09ac9491f4ad96ed19ee9b87052bff60b9281f65b","ssdeep":"192:2crCLsR7BR42KlNvy/v4LiTXZjfiizGW19kcKfjhVfZZbYTml:2cCLsfa/l1zLGxf9V9mfjHfvbYyl","tlshash":"c582d61bcaf3223742a24585bb56bf8bef64d54b5f29485133ac03a41fc2e49e13375a","dom_hash":"domhash79007676151f14ab622ed66063eb7c44","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"ys904.top","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-01T16:10:41Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"ys904.top","ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-05-13","domain_rank":0,"first_seen":"2026-06-27T16:09:34.893278Z","last_seen":"2026-06-27T16:09:34.893278Z","alert_count":52,"request_count":26,"received_data":1755576,"sent_data":11992,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery:3.7.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Slick","description":"","website":"https://kenwheeler.github.io/slick","common_platform_enumeration":"","icon":"Slick.svg","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"ys904.top/static/js/jquery-3.7.1.min.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2c872dbe60f4ba70fb85356113d8b35e","sha1":"ee48592d1fff952fcf06ce0b666ed4785493afdc","sha256":"fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a","sha512":"bf6089ed4698cb8270a8b0c8ad9508ff886a7a842278e98064d5c1790ca3a36d5d69d9f047ef196882554fc104da2c88eb5395f1ee8cf0f3f6ff8869408350fe","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr","tlshash":"3983f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","size":87533,"data":"","first_seen":"2023-08-31T16:03:19Z","last_seen":"2026-06-27T20:09:50.967289Z","times_seen":174415,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/js/imagesloaded.pkgd.min.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"919bcd36ba45f4ae408e47ad200e0cc9","sha1":"de12adeba034b0e200f9a13623852f1e2cdadb4a","sha256":"86dacb15f649eafe6e74e1bede434b20d20a87682fa0aab01211d87d34cc2027","sha512":"91fb370edf6ef5870e888b78acd70f53377234d3bdb151903e266cb9bef2c20ea5456e4ab8ad66d78e489ab1477b72cc5971e77682a8d984575b2f2b9ce7122a","ssdeep":"96:bwSrH5hrG6Qpw1rIN2Bkqsu6B89w1y+7Y3qv5StcXyuC0r4oYeTnf49uVhWWTfju:bwSrq6Qpw1rI2k1u6i9woa3hSSCP9+XC","tlshash":"89b1218db7737563125aa0b2b31b430ab3f6509ea128419d765cecf39cb490a1973fb0","size":5485,"data":"","first_seen":"2023-03-07T14:53:01Z","last_seen":"2026-06-27T20:46:31.872431Z","times_seen":4412,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/js/ajax-mail.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c33404ff582af3566828fa01cea710a4","sha1":"4f99ed39a76474d362d8db5bc4b4d0d351885cfc","sha256":"45894aadae79a441fde789bb2e18b3a3f972957a950c99fe61470e4187f5d6f0","sha512":"fbc3fd12030006710e8c01c04aa211bae13d90af86f2d26e224026e4ad8412dbe4e9f0ba13b50f1d639ddb2a6984cd7662af999d1cf17772acbf2c5acc60b50b","ssdeep":"","tlshash":"7321af847e6f0b6e1a47221476fd72c9ff2cd2728607662aa7e9086516841cc17c27ee","size":1249,"data":"","first_seen":"2023-03-07T01:28:41Z","last_seen":"2026-06-27T20:41:43.135688Z","times_seen":273,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/js/all_theme_plugin.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2f2d849394d8fb5bdc3009b56a07ed38","sha1":"5da2f6151aae3bb0ea019785bd105f0b46f7a0ac","sha256":"b57d7c7cec4d6045cc4f204ed16d610fc7c3bfdc4e53d50306852d375234abc7","sha512":"c7a2fdfbb4da44b5199c7137d9f01d321cb728b4082ba1d918bc4db631b6d55e67e93e5a87bcd8699f3f3c2e1bc828e58d50de6b10087a57f1b1f1bb0259e463","ssdeep":"768:IxdQHFqLRXa96uWqUpphqngQResGM6aNsqlQS4TsOp9ry99fOK6bLaN0ZwEcxe:IzIFqLRXa9nmhqFqnyODZwde","tlshash":"6533c7593a5630229b7763b9e81f1605f273807f705184ae78fc96e41ff0928167afb8","size":52431,"data":"","first_seen":"2025-11-01T08:50:04.39609Z","last_seen":"2026-06-27T16:10:43.734816Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/js/theme.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"406accf5b547c717fb41ac12047b6a64","sha1":"7824bbc04a1159b45b3f4a5bcbd4b85f2d06805d","sha256":"9e140060d47f406b90774262ee7ab2ceead7815fa97f7dee6849e8985bd76d74","sha512":"29d41c0717c1f0d6171489e420b9776a7cdc80dd889b4cf8919f0575f64bfc90b1a7921f3c5477184ad49f057f6e311a8e2fc48f141a891113bdd89ea07e402b","ssdeep":"96:ugK0IdVUVHGsJywiZDUQGsK/x5ilVV0+K4/Jo1Wca4KxGteMv9e:ugVIdVmQ85iVaaiA4KxGga9e","tlshash":"feb2044a8c61507f587b633dae369705ebab232352859ae37afd11040f7035a66c4efc","size":24542,"data":"","first_seen":"2025-11-03T16:18:16.922114Z","last_seen":"2026-06-27T16:10:43.726768Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/js/bootstrap.min.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f031fc3fc2f16ebcd7ed6a997e35c10a","sha1":"5e158b620727f308a173d0e5f866dfb839653ddf","sha256":"6824c8ab0f68a745d01989cd7b5eb8f55edf9e2840083e3c38fdccf013f6c553","sha512":"4f62732987ea72dafcbbfce1498a8869a99ddc4b0e47fb7468d13dee7b975f8745c155408065abbc241bea2c5c06cb6734e93ebf6ec96a569f0923d587ec1567","ssdeep":"768:gjN++EvGHWyOOY/uwAxOlU5iBNY5XPxyvTPBVRKwi/C9rfz7uxk6yH8Xae53XC7x:gpxY+t/Nhho1d76KV2O9EA","tlshash":"2a43b6563244b9330ade84e68172430bf7195d98b547816cb5bcacde2b7dc827273bb8","size":60641,"data":"","first_seen":"2024-04-16T14:38:18Z","last_seen":"2026-06-27T19:30:18.549942Z","times_seen":404,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/js/slick.min.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d5a61c749e44e47159af8a6579dda121","sha1":"3b41b3bc956685015a347a2238e71db29dfa0dbb","sha256":"0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740","sha512":"5ed98cb4311c373da3ede92bb47bce551e22c30683ea8fc55097baf99abe1e0702b24de48f8b9241047cc1e4364158f5a343e4e8fc182e8866db4e99ccd7ee6e","ssdeep":"768:4rkkX123A5YHi6pWzYdlNWYcx16nnYdXRRMd2KYCQCsPShb1ez7RFmYH:EPrYdlNixEePiYH","tlshash":"e513a549d205276285d721e62105c40eb3f7fb3cba22c0e475c9d3ea646ec4896d7bfa","size":42863,"data":"","first_seen":"2023-03-07T01:06:34Z","last_seen":"2026-06-27T20:14:40.657199Z","times_seen":103038,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/js/meanmenu.min.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d4f94c3275eacb6a8338747442b42832","sha1":"de8080ae015d007cdbc9a54a328d8b9e6b658ef8","sha256":"8ae6b70f7800fd5253c9c7af41cd1db0ef8b80e2e1ac9d4f642ee237e1086c4f","sha512":"f9eaad89b2077fc62f933423b1d1216c6ee07791170b1b3c79dc91d5365d25a9399dbceb738d0bdb957a0732ae746981fce34f52dbdd4bd0ad8303d34a752929","ssdeep":"","tlshash":"27812062757084fc24bf94e6f43ee33632f7a40ef44ed400b17aa9b63466a851063ad9","size":4034,"data":"","first_seen":"2023-03-09T01:54:05Z","last_seen":"2026-06-27T16:10:43.720113Z","times_seen":160,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/js/venobox.min.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"b8613254943802980d283e20b400651c","sha1":"8cddea85e0ffa3685eb65c5881078abb01f050b1","sha256":"f10d084ade0b86368bcd785fa9308a47d9ffd1fcf5605ef6cb4ad01d41fb4d5d","sha512":"7251533e6783ee6e0a1aeda86a0bae5763c551adf75b6267fdbeaa7830788559ed5bba8b6aab8dff52d30ef4066e37fc50f5a5b0b2d2e34576431ca04915cb0e","ssdeep":"384:m8oWgNp06xJoAVp4qd2xF02HEHAiOYLBX3q8qN/209Pmy:ho5Np07AVp4qd2I2HEHg8qN+4Pmy","tlshash":"d472c8782318253d42b756f4719f8346337651e9ea118233477dd4a50efacc8e1a3bea","size":16491,"data":"","first_seen":"2024-09-20T21:27:28.254404Z","last_seen":"2026-06-27T16:10:43.731117Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/js/isotope.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5fb7c19c9c51cfb99f5ff942629f0f21","sha1":"14c7f59e73d2a99aa688c2443a9a9b24acbff43c","sha256":"a931e5af561b1f0efaf6cdb96aeac4c035c30756dd6edd1091da1a68747d35bc","sha512":"c634a129ea9a27dd22c8382b46a94f07465001f26a027707849d60b402f21470ee5f329d46902084f317705cda5873eeed22d0624ee21220e88f09d23f317039","ssdeep":"768:PAyxsGKyc1gfflZVP4eAnmc6FumKSshD6cD6GLQfq9SvDz231Fxt:/xVKDSfJP4Nnmc6FuCshD6cD6xS9ODzE","tlshash":"faf2d84f73403925468bf166926f160fb137a56c6a4790acba6ad8db1c79c0d6033fbc","size":35456,"data":"","first_seen":"2023-03-07T01:18:38Z","last_seen":"2026-06-27T20:42:51.685775Z","times_seen":6354,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"ys904.top/static/js/meanmenu.min.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.210Z","timestamp":1782576618210,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/js/meanmenu.min.js HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 30 Dec 2024 17:30:38 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6772d8be-fc2\"\r\nexpires: Sun, 28 Jun 2026 04:09:09 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MQvj9l1TeHutciMNskQJOd37Cbv3prPxeT2vth3wpOH0aaCIyjPphA8OJ8M%2B5UBbALE95JXZG90dTBp2YmTapsl30FW4xnSHWZpiOOJ1thy4%2BCHlTnAhAPgVkgw%3D\"}]}\r\ncf-ray: a125b897c9545685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4034,"size_decoded":2168,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4034), with no line terminators","md5":"d4f94c3275eacb6a8338747442b42832","sha1":"de8080ae015d007cdbc9a54a328d8b9e6b658ef8","sha256":"8ae6b70f7800fd5253c9c7af41cd1db0ef8b80e2e1ac9d4f642ee237e1086c4f","sha512":"f9eaad89b2077fc62f933423b1d1216c6ee07791170b1b3c79dc91d5365d25a9399dbceb738d0bdb957a0732ae746981fce34f52dbdd4bd0ad8303d34a752929","ssdeep":"","tlshash":"27812062757084fc24bf94e6f43ee33632f7a40ef44ed400b17aa9b63466a851063ad9","first_seen":"2023-03-09T01:54:05Z","last_seen":"2026-06-27T16:10:43.720113Z","times_seen":160,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/js/ajax-mail.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.218Z","timestamp":1782576618218,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/js/ajax-mail.js HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 30 Dec 2024 17:30:38 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6772d8be-4e1\"\r\nexpires: Sun, 28 Jun 2026 04:09:09 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VWjFJnm3IrssK0HkLeI7twTCscx8%2B2JQ5XNgXDyT%2B83WNY2Kda0gvt55gRbF3%2BKI5VtwNfvZ5B%2FJDfZnIntsK0gAu%2Fq2qSTpwGQFnf9Or4MnD%2BewDcFQfMjTVpA%3D\"}]}\r\ncf-ray: a125b897d9595685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1249,"size_decoded":1258,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"c33404ff582af3566828fa01cea710a4","sha1":"4f99ed39a76474d362d8db5bc4b4d0d351885cfc","sha256":"45894aadae79a441fde789bb2e18b3a3f972957a950c99fe61470e4187f5d6f0","sha512":"fbc3fd12030006710e8c01c04aa211bae13d90af86f2d26e224026e4ad8412dbe4e9f0ba13b50f1d639ddb2a6984cd7662af999d1cf17772acbf2c5acc60b50b","ssdeep":"","tlshash":"7321af847e6f0b6e1a47221476fd72c9ff2cd2728607662aa7e9086516841cc17c27ee","first_seen":"2023-03-07T01:28:41Z","last_seen":"2026-06-27T20:41:43.135688Z","times_seen":273,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/27-3.png","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.237Z","timestamp":1782576618237,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /27-3.png HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 27 May 2025 14:03:40 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nvary: Accept-Encoding\r\netag: W/\"6835c63c-14cb4\"\r\nexpires: Mon, 27 Jul 2026 16:09:09 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WHMvZwdhWV9w0W2ZTF8xvi3h9PK2ecBkKLPD7p8cgB0pJA1knMuiIJjPtRUnXpbZLpp75r3eAPQ15MNQDauWSdQTmPnwTjkCjC0QdpCyJL2nuiq77ITqupZGOPE%3D\"}]}\r\ncf-ray: a125b897f95d5685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":85172,"size_decoded":83031,"mime_type":"image/png","magic":"PNG image data, 582 x 769, 8-bit/color RGB, non-interlaced","md5":"d007c4eee33be73abda221279f7d7ad6","sha1":"bd5081021d68bc19c799ac89655212a81cd5b5c6","sha256":"97857e3aadaa2ab93c4590b0dfe1f8ba854bd6e0e689118c53753677ef54fc12","sha512":"44b65a15c94ff4f87d297a72404a930f437776a18b672249ba4ad02f29095c9cd1b14234fa6f030c443707ae2344dca833ebe947c3a58f031867150d235da3b8","ssdeep":"1536:hRleqRrk7Q4ZApUn24TSDwYTW1U6ApiJveJNtPLtHVUVzbQiwDdR:hbur6W7ux/iJ2LZLtH11f","tlshash":"4c8301268ccbc8c776c9b4be386a41b053abd42503fa0833145661bebad02dcfee5565","first_seen":"2026-06-27T16:09:38.72359Z","last_seen":"2026-06-27T16:10:43.721567Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/font/8vIQ7wUr0m80wwYf0QCXZzYzUoTg_T6h.woff2","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.364Z","timestamp":1782576618364,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/font/8vIQ7wUr0m80wwYf0QCXZzYzUoTg_T6h.woff2 HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/static/css/css2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: font/woff2\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Mon, 30 Dec 2024 17:30:36 GMT\r\npriority: u=3,i=?0\r\netag: \"6772d8bc-777c\"\r\naccept-ranges: bytes\r\nage: 68\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Idy%2FzH6sD4t8%2BdcjXb0prdvJvOkQNwH1gsLK9Y8bY66FOmwHB2GJGQ423ObEz9efwcOMZG1fXuSERuFipTtd33ZfTfQxHd07ciGjlUaRvFohzzd2%2FYRFSxzx1qg%3D\"}]}\r\ncontent-length: 30588\r\ncf-ray: a125b898c9615685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30588,"size_decoded":31281,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 30588, version 1.0","md5":"b7d4e087d9242e90225fc31075ac7cb7","sha1":"a1c87363c257350aacd0b2493e12958f288d3d95","sha256":"5225c2e6a39dedcaf838a053359b9c1053fcbfdba93888479b4cd1e3163dbbf6","sha512":"14fc0e9a80d4a5ea1eeded60663002bb3945e5050b5de3eb277a5649fe1fd60ec6c0d209f7377d02a9aae762bf4c01b69918a2fa4b5483ed9536a62726144d41","ssdeep":"768:wS89toYlfm/+gXwQRpvVoDnjfCFCalaavwxL2JAh4dUxWt9wXj:wF9ed/vgQRdUneFrlx4x9EUotMj","tlshash":"4cd2f128b5778da2a4182e700ec9f914f0b3905ddfb3b41b32a71533931ab4dc5a9766","first_seen":"2024-12-04T22:36:57.236517Z","last_seen":"2026-06-27T16:10:43.722444Z","times_seen":1232,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/font/icofont.woff2","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.368Z","timestamp":1782576618368,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/font/icofont.woff2 HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/static/css/all-theme-plugin.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: font/woff2\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Mon, 30 Dec 2024 17:30:28 GMT\r\npriority: u=3,i=?0\r\netag: \"6772d8b4-88af8\"\r\naccept-ranges: bytes\r\nage: 68\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=I1jm3Hl5vRrBLGBcoEeXYzO0xN%2FFFfEY5vmn4tYF%2Bn6Q9T7Vf0CWFHtNuGkoTXwsXvRryCrABrABz6mMnjKTuLWCxXdORxhKwaGIeBC1AANyWhpRL7sd0KGgIl4%3D\"}]}\r\ncontent-length: 559864\r\ncf-ray: a125b898c9635685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":559864,"size_decoded":560557,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 559864, version 1.0","md5":"89556e7bb88ca8b9e678e126707b5a15","sha1":"4fad064838653d2ce6e8237725e58ec4ee2e88bf","sha256":"02243f8178a85e5b78fdb62d92fd0cd0ea886305fbe0039a41fc4e2970df4a5e","sha512":"73d42ff992adea5ccf47c285302c6bc3154aefce8cb423171bccc0b4c91d21816dd263f2a60fa2feb5ae574c8e7233a017348a1b26e0406b444810c09113edc7","ssdeep":"12288:WfMOlkCZudE+v7MLh9HSmOoIjOfj3IVI8zQ00vmwzy:WfXltZPW7bbjKIV3QVvmwzy","tlshash":"32c423760f4ba91411e702709698af1f3dba36929190ddb22bbd1ff5c186712b644ff0","first_seen":"2024-09-20T21:27:28.36691Z","last_seen":"2026-06-27T16:10:43.723082Z","times_seen":18,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-27T16:10:17.476Z","timestamp":1782576617476,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:17 GMT\r\ncontent-type: text/html\r\nlast-modified: Mon, 05 Jan 2026 06:28:44 GMT\r\ncontent-encoding: zstd\r\npriority: u=0,i\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YWAPTBTGx9WszkdxoCOKJ3QxPqihtJ%2FKwsFBmVQoRYNYrVLU9TP5z56WlLOU3%2BBZEJNTpgyHEHnPddZ171TEDiMxh0Z%2FPqyVAPA4qb7DC%2FTnnll%2BdBMWWQXzdF4%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a125b893b9225685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery:3.7.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Slick","description":"","website":"https://kenwheeler.github.io/slick","common_platform_enumeration":"","icon":"Slick.svg","categories":["JavaScript libraries"]}],"data":{"size":18937,"size_decoded":5837,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (422), with CRLF line terminators","md5":"20379efda3df7d3ceb2f50288b273f89","sha1":"6bf6978033f6b4a5d00f44cbbdd84733e25ede47","sha256":"3fe8159f449cf1b5e953be0e276a93415af0a57fad1b2dda9ffca66bab6aaccf","sha512":"379ed1264589503c1501c545e142c0c0ada1e60acbd0c3e24e069aefe217dbf7820868c80b4db57d9ed6a0f634e792f57f1be4b53badfe25ce6f1892207bd560","ssdeep":"192:XjkfO5A5E7MKT4IKRGMuava6QXfcf8lzGWx9jcK7CFeZ0J/6k:Xj/A5FKsRRjsvkfAR9Z7GeqJyk","tlshash":"2382b737cac136374233408dab26af97ff64818b9b25685133ad03a71fb2d08d533695","first_seen":"2026-06-27T16:09:38.7269Z","last_seen":"2026-06-27T16:10:43.723924Z","times_seen":2,"resource_available":true,"data":null}},"time_used":468,"timings":{"blocked":-1,"dns":55,"connect":19,"send":0,"wait":394,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/css/style.css","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.194Z","timestamp":1782576618194,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/css/style.css HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 30 Dec 2024 17:30:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6772d8bc-4ea1\"\r\nexpires: Sun, 28 Jun 2026 04:09:09 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=i5OJOlvpPM38Pp8o%2FWuvzggu2Z1scLxOpsd0HkWCix8DBreQ7h9aRegfHLDCyxN7HHTg4pzgKvjcd%2FHBnIorJCly7zCAeW5AH2YC4N8%2FhbUykJmDCLnaHx8dyyc%3D\"}]}\r\ncf-ray: a125b897b94d5685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20129,"size_decoded":4832,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"ce2feb37e72dd493cb42c361d83cb4e1","sha1":"504e2a04fc6b7a6dc604d7c8c0364573b10e076c","sha256":"7f61c35c99a5cf50790d4671881b13e6553eab77ffbfa42e36cb5aa62ef83157","sha512":"2d193547809e284803e2dfee29789fd0f87c2a1b8bfe111303aca6baafabeca1c82fb684edbc8d1888ab05285d0db929c2fbd626ff9f4e1233c3af0a19ea60ad","ssdeep":"192:KABiOgD7e+VirqKZCqMkHvxxPvt9OQ3PB0DwN9cbPRkapOu5NeSIrIMbMUT6KDE+:qP/IM8/6PqapOgq314Wyfo","tlshash":"0992105ce9204552b2778e683fe15786e68d20a35f05a4b5ff805340cfb67b853a1f8e","first_seen":"2025-11-01T08:50:04.41716Z","last_seen":"2026-06-27T16:10:43.724602Z","times_seen":3,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/css/responsive.css","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.196Z","timestamp":1782576618196,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/css/responsive.css HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 30 Dec 2024 17:30:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6772d8bc-600\"\r\nexpires: Sun, 28 Jun 2026 04:09:09 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dK8fj0ZzH1OlQLrC%2FW557FHvttzwnk%2FyP2wLvby6udTK3A69RRxsj%2FcGNJr0Cckl3fgvI0eYOsPzqGpCI8rfxckyjWV6waaGh3Nge2YLG%2BkbQTYAfrW8AiIeCNE%3D\"}]}\r\ncf-ray: a125b897b94f5685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1536,"size_decoded":1064,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"e557e88cafaf71aa6be62b271a77d1a2","sha1":"7e0dda0ed2dd31e490ab2cf55ac087fb050a3f3d","sha256":"e8501316e473a3c4536aa236542fe840edcefff3d8f26205eaaa9b30a07ba7d7","sha512":"77cd3b79574a6a95de7571307b8299d80caeaf102e4f4041f4e8485f0608a4cf1371a9e02a1350167d708fdb62cfef7481210c1547db0b39cc1cd607767a15da","ssdeep":"","tlshash":"4731734796001839317bba38db675b9bd68e0417e38e7af53dac10910fb83698165f8d","first_seen":"2025-11-01T08:50:04.428058Z","last_seen":"2026-06-27T16:10:43.725417Z","times_seen":5,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/js/jquery-3.7.1.min.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.204Z","timestamp":1782576618204,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/js/jquery-3.7.1.min.js HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 30 Dec 2024 17:30:38 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6772d8be-155ed\"\r\nexpires: Sun, 28 Jun 2026 04:09:09 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AFoKX8%2BsXyDtj0Uek02r9nEvo3%2BLKzcDCTgGCSPaC142jz9qmP1Ia68ae%2F2B0PRPt%2FKcsD7zYtTc8QKmQOVgYrzM25AkVNNl7hUG%2BPg1FTSwXkQZiyEGxTsMGWE%3D\"}]}\r\ncf-ray: a125b897c9515685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":87533,"size_decoded":31381,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"2c872dbe60f4ba70fb85356113d8b35e","sha1":"ee48592d1fff952fcf06ce0b666ed4785493afdc","sha256":"fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a","sha512":"bf6089ed4698cb8270a8b0c8ad9508ff886a7a842278e98064d5c1790ca3a36d5d69d9f047ef196882554fc104da2c88eb5395f1ee8cf0f3f6ff8869408350fe","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr","tlshash":"3983f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-08-31T16:03:19Z","last_seen":"2026-06-27T20:09:50.967289Z","times_seen":174415,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/js/theme.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.222Z","timestamp":1782576618222,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/js/theme.js HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 30 Dec 2024 17:30:38 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6772d8be-5fde\"\r\nexpires: Sun, 28 Jun 2026 04:09:09 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZZNfxKK7y5sOF4PxZNbT8K0vJyy1KWxYSnTFqjKHqVmrS8admDclHRo%2FUlMyVdw7ek%2Fy%2F6Hrqk4duc7PZkixVWizXjmQkVHZgDpk1FADjSh78JxjbJpYG5LnKv8%3D\"}]}\r\ncf-ray: a125b897e95b5685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24542,"size_decoded":3691,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (390), with CRLF line terminators","md5":"406accf5b547c717fb41ac12047b6a64","sha1":"7824bbc04a1159b45b3f4a5bcbd4b85f2d06805d","sha256":"9e140060d47f406b90774262ee7ab2ceead7815fa97f7dee6849e8985bd76d74","sha512":"29d41c0717c1f0d6171489e420b9776a7cdc80dd889b4cf8919f0575f64bfc90b1a7921f3c5477184ad49f057f6e311a8e2fc48f141a891113bdd89ea07e402b","ssdeep":"96:ugK0IdVUVHGsJywiZDUQGsK/x5ilVV0+K4/Jo1Wca4KxGteMv9e:ugVIdVmQ85iVaaiA4KxGga9e","tlshash":"feb2044a8c61507f587b633dae369705ebab232352859ae37afd11040f7035a66c4efc","first_seen":"2025-11-03T16:18:16.922114Z","last_seen":"2026-06-27T16:10:43.726768Z","times_seen":4,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/27-2.png","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.229Z","timestamp":1782576618229,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /27-2.png HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 27 May 2025 14:03:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nvary: Accept-Encoding\r\netag: W/\"6835c638-19374\"\r\nexpires: Mon, 27 Jul 2026 16:09:09 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YnRvmMNKdBavNPXUOsxBhJowWwa0dTi8lAyH2McZm%2B2%2B6tipsEe6OGQIyMwprt%2Ff2vbwFNmIs%2BytC5fejtLxPxOH6%2FJBTF2vB113LA0778rNvlOMtNPCMSiJNNo%3D\"}]}\r\ncf-ray: a125b897e95c5685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":103284,"size_decoded":100333,"mime_type":"image/png","magic":"PNG image data, 577 x 774, 8-bit/color RGB, non-interlaced","md5":"04d077038b248719860a1bdcb77cebcb","sha1":"bc2bbe967ff0a5fb8c1fb5f0a512be33ed848120","sha256":"7087191c642d11711d2d4c772f37b8497ae9cc70270b3549c076ca6761db1f56","sha512":"1349f953bd43dbb3b9b3493b09aea733c8589bf4b418e15db4bbb1387e0ae9b2fae178f56f4dd2073c7dbe29d7c6841598189fadb7ef4d038da407cf1eb42463","ssdeep":"3072:xXrZrSAcDMEnbEzl1muDCtPyvH+Nxico8RVgZ5vbv:xXrtaDMEbWl1HCtKCssVExr","tlshash":"d8a312bd90678873e30ffb91726dc64b677064cb9ad2803e5795f34c9a12a4e023f5a1","first_seen":"2026-06-27T16:09:38.69681Z","last_seen":"2026-06-27T16:10:43.727461Z","times_seen":2,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/font/rP2Yp2ywxg089UriI5-g7M8btVsD8Ck0q7u0-K4.woff2","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.366Z","timestamp":1782576618366,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/font/rP2Yp2ywxg089UriI5-g7M8btVsD8Ck0q7u0-K4.woff2 HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/static/css/css2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: font/woff2\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Mon, 30 Dec 2024 17:30:36 GMT\r\npriority: u=3,i=?0\r\netag: \"6772d8bc-5a10\"\r\naccept-ranges: bytes\r\nage: 68\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=P2E6ExL2EVWSqdjDwfbq3Mr0T7MtMGrduzoyRAKIrOFKIW%2BUBmSKLK4nSf9NUHFHb9EfWYnmEoBpGBeYbdtS91ZCsMJ9u6I6neaUrxhObm1ftYhlyTAGenN9JXA%3D\"}]}\r\ncontent-length: 23056\r\ncf-ray: a125b898c9625685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23056,"size_decoded":23745,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 23056, version 1.0","md5":"cd920e922896e370b989150ae07ecb07","sha1":"a7b75b23a97dc62f0138140f253c6418e1d3d0a2","sha256":"f64ca286be52f8c45b5a0f605abc38768b074ceeb439eac24529ca19eb259765","sha512":"6ea95b8b972a46e3c9701677b15f48f9f6e2126489ab6551fa3645199ed43f7772511504258b3c49d314c9d94b4c317388bd0350daf66cd2b41dfaf3a0cae216","ssdeep":"384:lpWawZiHV8XEk7MFQFH+droznulxVBHEwTJfwinK2sYlMMgeMI3qb3n:lsawC80VFMHYroC3kwT9nK2i3pWqb3","tlshash":"83a2e04e3e74444f8d8864b7918bb8de340786326c42d3bade4035f79a4d98ad495fb3","first_seen":"2025-01-05T14:20:39.029994Z","last_seen":"2026-06-27T16:10:43.728211Z","times_seen":6,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/css/accounting-responsive.css","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.201Z","timestamp":1782576618201,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/css/accounting-responsive.css HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 30 Dec 2024 17:30:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6772d8bc-303d\"\r\nexpires: Sun, 28 Jun 2026 04:09:09 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4x5SbwPVeDDHweb9mmAJGmUXHQ4wIgTx2atM9Om%2BooyGvO1BAeM9Qb0htof9OzKVSJuzhNtasnjC9dG%2FoPBH8S%2Fr0zeDJaCylSJJwlXAqPVFmajQtsyNodnzVpo%3D\"}]}\r\ncf-ray: a125b897c9505685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12349,"size_decoded":2241,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"e282faecd58a02b1a169fd1cf6f8a94c","sha1":"28acb867ee7ba01290c940662d81158c4cddd38c","sha256":"55eeaa2465a3a6139c8b9e7e006541305a6bf83db91b3dcb8ecbb53eb9db664d","sha512":"34acffc04f2c45c6cd76611f3cc6caf39a188b2bdcb49661f28cd6ef7f8ac875d863ee572f80729712c76f0fb3f92845a410c7e44a1e426aeb416b4f0bb2cb67","ssdeep":"192:+GbIXXQbIXFIw5uIXXAI33jIXDhJGzojIXFzb+bBXgsfIX/o4Q:PbHbkLu6AojG08ab+QsfBh","tlshash":"3542481ee60015116c77b634efa35eabe8aa4477978650b0fcec91188fb47644298fce","first_seen":"2025-11-19T04:27:54.121603Z","last_seen":"2026-06-27T16:10:43.729096Z","times_seen":3,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/js/bootstrap.min.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.206Z","timestamp":1782576618206,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/js/bootstrap.min.js HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 30 Dec 2024 17:30:38 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6772d8be-ece1\"\r\nexpires: Sun, 28 Jun 2026 04:09:09 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uGcnyHSS3xzza7uJ4JkoJ4YQUgjYpjrYbOklhF3i4BZp%2Be1o0OSeTd4eumcyRAIZutdv%2Fb3m7vlr57w90v7e%2Bzpb5n%2BiOIn7vJwnM6BiIotuK3MGoaHPK6t943U%3D\"}]}\r\ncf-ray: a125b897c9525685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":60641,"size_decoded":17491,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (60356), with CRLF line terminators","md5":"f031fc3fc2f16ebcd7ed6a997e35c10a","sha1":"5e158b620727f308a173d0e5f866dfb839653ddf","sha256":"6824c8ab0f68a745d01989cd7b5eb8f55edf9e2840083e3c38fdccf013f6c553","sha512":"4f62732987ea72dafcbbfce1498a8869a99ddc4b0e47fb7468d13dee7b975f8745c155408065abbc241bea2c5c06cb6734e93ebf6ec96a569f0923d587ec1567","ssdeep":"768:gjN++EvGHWyOOY/uwAxOlU5iBNY5XPxyvTPBVRKwi/C9rfz7uxk6yH8Xae53XC7x:gpxY+t/Nhho1d76KV2O9EA","tlshash":"2a43b6563244b9330ade84e68172430bf7195d98b547816cb5bcacde2b7dc827273bb8","first_seen":"2024-04-16T14:38:18Z","last_seen":"2026-06-27T19:30:18.549942Z","times_seen":404,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/js/slick.min.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.208Z","timestamp":1782576618208,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/js/slick.min.js HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 30 Dec 2024 17:30:38 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6772d8be-a76f\"\r\nexpires: Sun, 28 Jun 2026 04:09:09 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tgBk%2FTlV%2BLrz1%2F1jYfhPINVDHA7kC0NiCQlpnM12mIz0gazEGoU4bivIgQ9iejb%2Frn6Z0Y7FBv8syJUQLQVlKvlaysIlt2FsijWTBzyHF2TSxugChCgEp2FYeb4%3D\"}]}\r\ncf-ray: a125b897c9535685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42863,"size_decoded":11315,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (42862)","md5":"d5a61c749e44e47159af8a6579dda121","sha1":"3b41b3bc956685015a347a2238e71db29dfa0dbb","sha256":"0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740","sha512":"5ed98cb4311c373da3ede92bb47bce551e22c30683ea8fc55097baf99abe1e0702b24de48f8b9241047cc1e4364158f5a343e4e8fc182e8866db4e99ccd7ee6e","ssdeep":"768:4rkkX123A5YHi6pWzYdlNWYcx16nnYdXRRMd2KYCQCsPShb1ez7RFmYH:EPrYdlNixEePiYH","tlshash":"e513a549d205276285d721e62105c40eb3f7fb3cba22c0e475c9d3ea646ec4896d7bfa","first_seen":"2023-03-07T01:06:34Z","last_seen":"2026-06-27T20:14:40.657199Z","times_seen":103038,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/js/venobox.min.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.212Z","timestamp":1782576618212,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/js/venobox.min.js HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 30 Dec 2024 17:30:38 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6772d8be-406b\"\r\nexpires: Sun, 28 Jun 2026 04:09:09 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iXy0kiwpSSRs%2FWe47VaDYjLH%2BEZImCv6h00NcwXgFQTbJ7kTYKmO7xT1BsNdxIa5O1Dqc9VMq5PZrOccIgbPPEyIvG5QnsE8gD073h5adOscmim0PEbrNNyEFfM%3D\"}]}\r\ncf-ray: a125b897d9555685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16491,"size_decoded":6117,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (16071)","md5":"b8613254943802980d283e20b400651c","sha1":"8cddea85e0ffa3685eb65c5881078abb01f050b1","sha256":"f10d084ade0b86368bcd785fa9308a47d9ffd1fcf5605ef6cb4ad01d41fb4d5d","sha512":"7251533e6783ee6e0a1aeda86a0bae5763c551adf75b6267fdbeaa7830788559ed5bba8b6aab8dff52d30ef4066e37fc50f5a5b0b2d2e34576431ca04915cb0e","ssdeep":"384:m8oWgNp06xJoAVp4qd2xF02HEHAiOYLBX3q8qN/209Pmy:ho5Np07AVp4qd2I2HEHg8qN+4Pmy","tlshash":"d472c8782318253d42b756f4719f8346337651e9ea118233477dd4a50efacc8e1a3bea","first_seen":"2024-09-20T21:27:28.254404Z","last_seen":"2026-06-27T16:10:43.731117Z","times_seen":19,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/js/isotope.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.214Z","timestamp":1782576618214,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/js/isotope.js HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 30 Dec 2024 17:30:38 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6772d8be-8a80\"\r\nexpires: Sun, 28 Jun 2026 04:09:09 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GKh%2F5YgJsGcRfoo7rhEvIrLQknJsqkLb%2Fagix1uBrJUgBXW3eGkrM%2FzeXiMj1eC0%2F0h3WNkMGA%2BQPadnmY5uwSls%2BOLXERlSG7uaWm5s7TQK0rYDLzXAstOBopY%3D\"}]}\r\ncf-ray: a125b897d9565685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":35456,"size_decoded":10731,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32019), with CRLF line terminators","md5":"5fb7c19c9c51cfb99f5ff942629f0f21","sha1":"14c7f59e73d2a99aa688c2443a9a9b24acbff43c","sha256":"a931e5af561b1f0efaf6cdb96aeac4c035c30756dd6edd1091da1a68747d35bc","sha512":"c634a129ea9a27dd22c8382b46a94f07465001f26a027707849d60b402f21470ee5f329d46902084f317705cda5873eeed22d0624ee21220e88f09d23f317039","ssdeep":"768:PAyxsGKyc1gfflZVP4eAnmc6FumKSshD6cD6GLQfq9SvDz231Fxt:/xVKDSfJP4Nnmc6FuCshD6cD6xS9ODzE","tlshash":"faf2d84f73403925468bf166926f160fb137a56c6a4790acba6ad8db1c79c0d6033fbc","first_seen":"2023-03-07T01:18:38Z","last_seen":"2026-06-27T20:42:51.685775Z","times_seen":6354,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/js/imagesloaded.pkgd.min.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.216Z","timestamp":1782576618216,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/js/imagesloaded.pkgd.min.js HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 31 Dec 2024 15:50:26 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"677412c2-156d\"\r\nexpires: Sun, 28 Jun 2026 04:09:09 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SB5OaHUcfQsqzfNzfLav%2B%2F4vw%2BUBMKeYNjYL0%2FRd4mVSTIonZUTqsdCuVzrQRgm3kuyZIgpgQB9MfHIIDsfQlN94Wvrne3a19CuMN5t5HY6O9RyNyNNMKXGCmYw%3D\"}]}\r\ncf-ray: a125b897d9575685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5485,"size_decoded":2541,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4358)","md5":"919bcd36ba45f4ae408e47ad200e0cc9","sha1":"de12adeba034b0e200f9a13623852f1e2cdadb4a","sha256":"86dacb15f649eafe6e74e1bede434b20d20a87682fa0aab01211d87d34cc2027","sha512":"91fb370edf6ef5870e888b78acd70f53377234d3bdb151903e266cb9bef2c20ea5456e4ab8ad66d78e489ab1477b72cc5971e77682a8d984575b2f2b9ce7122a","ssdeep":"96:bwSrH5hrG6Qpw1rIN2Bkqsu6B89w1y+7Y3qv5StcXyuC0r4oYeTnf49uVhWWTfju:bwSrq6Qpw1rI2k1u6i9woa3hSSCP9+XC","tlshash":"89b1218db7737563125aa0b2b31b430ab3f6509ea128419d765cecf39cb490a1973fb0","first_seen":"2023-03-07T14:53:01Z","last_seen":"2026-06-27T20:46:31.872431Z","times_seen":4412,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/image/breadcum.jpg","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.333Z","timestamp":1782576618333,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/image/breadcum.jpg HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 30 Dec 2024 17:30:28 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\nvary: Accept-Encoding\r\netag: W/\"6772d8b4-128c4\"\r\nexpires: Mon, 27 Jul 2026 16:09:09 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FfmhpBrLNr%2BbOl2udMcyHH1Nt24mb04Bg2RyJRAcBGKb7uCSifMoDrqyJuwbEPKStX0b%2FKi4JjhCfP3Llyh74qUCsfx6OI5FldD1BTvIdvTK1NvsJ8oZhrdyctc%3D\"}]}\r\ncf-ray: a125b89899605685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":75972,"size_decoded":72474,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1545x806, components 3","md5":"d0229b7b166f22ab8794b3c83284a237","sha1":"33595cc8cf777bb28fdb9953c41ba30b6cd49a80","sha256":"1de466b50b6331339af017b87a94f21e61ffc05c6e219431d2f8f7d018aac0d2","sha512":"c66443cd796d4bf66425a1cb31dcdb65551e76c1f3cf18c1397eaf0b47522caf930ce878700cbc932db44e6d2b0f23d173e097c29827d5c29bed8b2eeb9b643e","ssdeep":"1536:ct6pbNo372HFYhFU1R/4YI7+4at1FhtV2fTmauDsd8XhyO39Y5P11o9O:ct69W722K1R/hN4atzhLaWXhyho9O","tlshash":"a973f1472db0efc7e0c01f3a669639b664024d20cbcf695874dec91b7d8a6666c13a37","first_seen":"2026-03-02T07:47:59.835126Z","last_seen":"2026-06-27T16:10:43.733145Z","times_seen":3,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/css/bootstrap.min.css","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.189Z","timestamp":1782576618189,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/css/bootstrap.min.css HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 30 Dec 2024 17:30:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6772d8bc-38d57\"\r\nexpires: Sun, 28 Jun 2026 04:09:09 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JItr0stuaiHvGG9TDDHxHHI4AJcEIsAyMdiW9G5fhC%2BXV%2F3nDQS6xU%2BD2I94odDvsjl553JuX52Ye54OOh9yNXB34MdCyxx%2F6LIoKfifUs2b57h78Q8kaTv%2F3F0%3D\"}]}\r\ncf-ray: a125b897a94a5685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":232791,"size_decoded":32569,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65355), with CRLF line terminators","md5":"7796389edae3be68117bdc0f62757aa6","sha1":"5c1f9db52a9af29e5c8c79b0427b46f7c289ff64","sha256":"4052e7438d623c1fe6c716b346f274aeb2ce2a736f127b412dde50539c5f4988","sha512":"e3f38036e888302632c039d699d9b9bd5331b4a0a47f74b176d481b5380cc2f5181c77f622cb6c3998203aa2b9ba96aed922647733bf5ac720beb1556343a890","ssdeep":"1536:H9YnIWbn98fdRfvO5wlP77k9P3EV98IsYRElV6V6pz600I41q:CnIw98fbV986I6V6pz600I41q","tlshash":"cd3482d6f590317d9ca7c1499681fefd896fa985cb120aa6f003776807cabd30962dcc","first_seen":"2025-10-14T14:53:52.552682Z","last_seen":"2026-06-27T16:10:43.733713Z","times_seen":3,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/css/accounting-style.css","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.195Z","timestamp":1782576618195,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/css/accounting-style.css HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 27 May 2025 14:01:20 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6835c5b0-cf8d\"\r\nexpires: Sun, 28 Jun 2026 04:09:09 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=F53DhwISgXPHeTpBGAmIgkYdSMXMbSf7b8PI14yS%2BF5de6NSxXyw0O4WAhw2wR3CkJePVuoi4T4kRdN5HutAIyPDzKxttks6E7n%2BDNbZqkRLTRjoYnNp%2FUvpVG8%3D\"}]}\r\ncf-ray: a125b897b94e5685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":53133,"size_decoded":9767,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"524d12427fd04c2229e165eab0144fea","sha1":"43ec027a9061f789bd2eb1dfb137a4e4f2b9227b","sha256":"a6fec5b495e08cff68386a3bc4faf8a567b4d930527888223da4b20f87cd7ff8","sha512":"1f0232ef8c7dd56fc60c1ab2ceb472397225db701692a96fe764f6b808d55f0c2ec6f1a4a283eb8693ab3c5de87c156327601630ba4b829fcc0cf9f68e652f50","ssdeep":"384:i2aP57mf9j2BIf9UgoPdV9kEw+qDX/azNmZoXtBYRxSnYm4hsFk3KvsAeC7EycUj:izPk+pBjO1cW2r","tlshash":"b833434ce7105261aa375a286ff2475dd6dc20935f021ab8baa492418ff23bc5375fcd","first_seen":"2026-06-27T16:09:38.67827Z","last_seen":"2026-06-27T16:10:43.734233Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/js/all_theme_plugin.js","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.220Z","timestamp":1782576618220,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/js/all_theme_plugin.js HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 30 Dec 2024 17:30:38 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6772d8be-ccd0\"\r\nexpires: Sun, 28 Jun 2026 04:09:09 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hFDLJ087c%2FPY01AmpxGgCM0xBiJj13%2B%2BLb9SOOIVvtfgNhPsXylzAd0HDRlit2xi6%2BQPukHD2lwGIJq77krkGGUn1%2FOUXr%2FrlVey0%2BSP7DZaiTZKwgK8yONFhIg%3D\"}]}\r\ncf-ray: a125b897d95a5685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":52432,"size_decoded":15297,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (8385), with CRLF line terminators","md5":"2f2d849394d8fb5bdc3009b56a07ed38","sha1":"5da2f6151aae3bb0ea019785bd105f0b46f7a0ac","sha256":"b57d7c7cec4d6045cc4f204ed16d610fc7c3bfdc4e53d50306852d375234abc7","sha512":"c7a2fdfbb4da44b5199c7137d9f01d321cb728b4082ba1d918bc4db631b6d55e67e93e5a87bcd8699f3f3c2e1bc828e58d50de6b10087a57f1b1f1bb0259e463","ssdeep":"768:IxdQHFqLRXa96uWqUpphqngQResGM6aNsqlQS4TsOp9ry99fOK6bLaN0ZwEcxe:IzIFqLRXa9nmhqFqnyODZwde","tlshash":"6533c7593a5630229b7763b9e81f1605f273807f705184ae78fc96e41ff0928167afb8","first_seen":"2025-11-01T08:50:04.39609Z","last_seen":"2026-06-27T16:10:43.734816Z","times_seen":5,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/css/css2.css","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.303Z","timestamp":1782576618303,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/css/css2.css HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/static/css/accounting-style.css\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 30 Dec 2024 17:30:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6772d8bc-995\"\r\nexpires: Sun, 28 Jun 2026 04:09:09 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LwdcKfm8qHOzFXX%2BeL%2Bm4uf4GtZmBoI8IYCqI%2F33hvBhhTjecO6NlWxP7NYnmCSZsBlpBVRMEI9YCMIsL3Vb0%2B3dppPvR8QYK544btfkvdIHq8%2F2eaVQjB0ZeUk%3D\"}]}\r\ncf-ray: a125b898695e5685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2453,"size_decoded":1223,"mime_type":"text/css","magic":"ASCII text","md5":"f1358d8701371177b5aad47410d8bf31","sha1":"5370dacf83d9193ce17e4bd3b0e3f268f999c49f","sha256":"1d4036545737f3817603bf9a5b0062a8b0ba6aaa172e6dff6f816f7b9f220297","sha512":"2fd7b1319e3e6186d31d316a697d38e7a9e0c4247110dfc1dd8e1f5866947de2a766d38babcbc617277d2149ed8145011b401bc7802b0d962c0b4a0a5e7a8b67","ssdeep":"","tlshash":"cb51c180086b6104dbd71ec262cd3e22ef1eb2807445aa356ffe149cfc9bd59936274d","first_seen":"2025-11-01T08:50:04.438453Z","last_seen":"2026-06-27T16:10:43.735405Z","times_seen":3,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/favicon.ico","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.396Z","timestamp":1782576618396,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: text/html\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IAGDVwg9u8YUznMx3%2FWVchTVEDex%2BcC40Jk8aLQcinP2CuAx82tFXUBt3j4S63n%2BrJFVXpbIBF9tLoWtFZp%2BiApduXQBxouXWKv3u7ZvZZch%2By4ueI6g5jTaVyE%3D\"}]}\r\nage: 67\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a125b898f9645685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":138,"size_decoded":705,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7389d931c86b3d7bb6b8af46d8c4172b","sha1":"8d2a4760aa0b47984d11cd1a66448719177fb791","sha256":"301bd9f16f94feedfae7a946a14bac38cb73c43efe6117bc5586835af03d7d6f","sha512":"dd6d1511e4fcd5bc09d821ffe091fb5946ac9654c48664aed504e479e9ac20c1cad44b6df90f42190d47e28f5f96bfb09d24056df6b950243d68ee8100a9a889","ssdeep":"","tlshash":"d9c09b5d755366449913155167c33641d196837f689a84510941c593f0cf69ac4c73a9","first_seen":"2023-03-13T12:56:15Z","last_seen":"2026-06-27T20:15:08.752723Z","times_seen":281430,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/css/all-theme-plugin.css","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.191Z","timestamp":1782576618191,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/css/all-theme-plugin.css HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 30 Dec 2024 17:30:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6772d8bc-29c60\"\r\nexpires: Sun, 28 Jun 2026 04:09:09 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=N4ccJW3RUx%2F0tZ7Mq8pMSQYBMMT0q2EK6sotcigufHVN9eKqs%2FuF%2Bjaxa6lB3E5G2ogR2ixpZD6ueguLWE6V1b4RRq%2Fj1Nx%2BElDdgTJ9lw21kyGXfiFDkabqnvk%3D\"}]}\r\ncf-ray: a125b897b94b5685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":171104,"size_decoded":26292,"mime_type":"text/css","magic":"ASCII text, with very long lines (6563)","md5":"7ef88dbee00578107fb14b1c9952d597","sha1":"5be63372b4c0e6083a05bfb1dd1d85e547cf15bb","sha256":"4c670ac6c0d591b072c7479ac32692ddcc93f68fff0aa02ca42acf4560cd99af","sha512":"39afbecaae5afdadca171bd75ff62dcc7c9bee28109f514b39a4cfe4533996d4260d76a0d9021313bb182a59ac730ad151e06fe89ace34f134892af286c58227","ssdeep":"1536:m6yp6eWKSrLVNf9xXFF7NJCH3ZuRW5xH5E3+7IIQinM:46eWKSPX9xXFYuR0H5sSIIQyM","tlshash":"e2f3f4a4d65510cc7732cc07e3caa728a9a4f97384b15e65f18b444e4ef3768b3c4b6a","first_seen":"2025-11-01T08:50:04.43417Z","last_seen":"2026-06-27T16:10:43.736754Z","times_seen":3,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ys904.top/static/css/venobox.min.css","fqdn":"ys904.top","domain":"ys904.top","tld":"top"},"ip":{"addr":"104.21.90.135","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ys904.top/","date":"2026-06-27T16:10:18.192Z","timestamp":1782576618192,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ys904.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 02:35:03 GMT","end":"Sat, 15 Aug 2026 03:32:28 GMT"},"fingerprint":{"sha1":"E4:92:82:82:96:83:A3:51:3A:43:BC:42:38:E2:FA:55:38:2E:89:04","sha256":"F6:80:E1:7C:5D:F8:CB:BB:F4:73:D4:B6:F0:AF:25:A1:2C:46:72:8C:D1:18:EB:40:DD:41:CD:F0:3A:27:CA:F6"}}},"request":{"raw":"GET /static/css/venobox.min.css HTTP/1.1\r\nHost: ys904.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ys904.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 27 Jun 2026 16:10:18 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 30 Dec 2024 17:30:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6772d8bc-3c34\"\r\nexpires: Sun, 28 Jun 2026 04:09:09 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nage: 68\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jlbWJrrW7kGenA0YjqGuVbiaXqkvBs2PoyFf5sIr2NXDVswSukrcfDyPPfzyQMdzmxbyF1G3%2F0PNCAnhCjsQkmCtBNRNrXHl9tcJu3M2KWk1nVRbQLMQL%2BpEho8%3D\"}]}\r\ncf-ray: a125b897b94c5685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15412,"size_decoded":3783,"mime_type":"text/css","magic":"ASCII text, with very long lines (15368)","md5":"4db00946a76957607e438b8c8960a8f3","sha1":"95e4694c292969da2e44441fc933dc6d2dd86c2a","sha256":"13fa8aecede9bbfa2bee758863ab0d57eb2409cac6e2b7cc0d1b02a4051a85e2","sha512":"050d6b38e0965991d8b0fe0ea2ed9d4ef79d96bfa0076f9a2d2820c1a7b3a7c6a49fa06b370fa99316b133d7f9c31c237abfad7bb7b38e920bd5b6878b974e8c","ssdeep":"384:qF+Vv/JYyRtbwiSii53BCPPaYSQEL3FIgPOKcAekXzfszC+0UUzHumYJDgGjpyEV:qF+3JYyR7Sii53BCPPaYSQEL3FIgPOKm","tlshash":"7e6254b11f1421dab5478753a3ec8b9c4136c6929f334fdbb321a0a847c6ab61357b63","first_seen":"2024-09-20T21:27:28.223273Z","last_seen":"2026-06-27T16:10:43.737258Z","times_seen":53,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"ys904.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}