{"report_id":"83acc582-eb26-4dea-abba-7478edcec03a","version":0,"status":"done","tags":[],"date":"2026-10-09T18:32:33Z","url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"title":"AD88 - Đăng Ký, Đăng Nhập Trang Chủ AD88 - Giới Thiệu Bạn +200K","dom":{"size":260944,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64141), with no line terminators","md5":"80061cf9758007d99536186372e61d1a","sha1":"81f7ae3b8668ccba2dfc4dee8199ed56599d83a5","sha256":"c72ae87920e00c270f6f841b90925a769d8916d4f5957234f2d18c6d86e7d444","sha512":"fe812186ce4585482a566852d6fb1987379338fa40f2dac4dc34f5cc6692927b537a163dbbd167b277054b00f8f421d43ea32b782cb26c4b581d7cd060b87ce2","ssdeep":"6144:ExraC5ueNnFiTq4s08G8AndfOfod8G8AndfOfo58G8AndfOfoHP6XD+Haibxa1K7:K7do","tlshash":"97441b326651645ff72344e7e466f218a67cb2dbb30244f09a6c4bb8f581ce4f726278","dom_hash":"domhashc5c1dcb7f3d10272d62269f45d44cd7b","first_seen":"2026-10-09T18:33:13.73614Z","last_seen":"2026-10-09T18:33:13.73614Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-13T18:32:33Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ytbacksexo.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"conn.webpush.theengagelab.com","ip":{"addr":"43.134.137.157","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"domain_registered":"2022-08-03","domain_rank":401333,"first_seen":"2022-11-03T10:58:34Z","last_seen":"2026-10-09T17:45:22.322836Z","alert_count":0,"request_count":6,"received_data":15887,"sent_data":3520,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"WebSocket","description":"WebSocket is a communication protocol that provides full-duplex communication channels over a single, long-lived connection, enabling interactive communication between web browsers and servers.","website":"https://en.wikipedia.org/wiki/WebSocket","common_platform_enumeration":"","icon":"WebSocket.svg","categories":["Miscellaneous"]}]},{"fqdn":"x03k89o0jg.wgbos.com","ip":{"addr":"104.18.38.204","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-04-16","domain_rank":564550,"first_seen":"2025-07-08T19:39:03.612965Z","last_seen":"2026-10-03T13:22:34.192834Z","alert_count":0,"request_count":1,"received_data":898,"sent_data":479,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"global-websis.api.engagelab.cc","ip":{"addr":"43.153.194.206","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"domain_registered":"2022-08-11","domain_rank":1347528,"first_seen":"2026-05-25T23:45:13.860048Z","last_seen":"2026-10-04T21:21:40.230218Z","alert_count":0,"request_count":3,"received_data":554,"sent_data":1652,"comment":"","tags":null,"fingerprints":null},{"fqdn":"accounts.google.com","ip":{"addr":"172.253.148.84","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"1997-09-15","domain_rank":103,"first_seen":"2012-05-23T06:57:57Z","last_seen":"2026-10-05T10:22:54.729141Z","alert_count":0,"request_count":3,"received_data":279281,"sent_data":1637,"comment":"","tags":null,"fingerprints":null},{"fqdn":"ad852.xyz","ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-09-02","domain_rank":0,"first_seen":"2026-10-09T17:19:01.209299Z","last_seen":"2026-10-09T17:19:01.209299Z","alert_count":124,"request_count":124,"received_data":8816023,"sent_data":126139,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}]},{"fqdn":"webpushstat-sgp.engagelab.com","ip":{"addr":"43.163.81.198","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"domain_registered":"2009-10-31","domain_rank":577840,"first_seen":"2026-07-10T21:31:40.967021Z","last_seen":"2026-10-09T17:45:23.682477Z","alert_count":0,"request_count":4,"received_data":1048,"sent_data":2368,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"ytbacksexo.xyz","ip":{"addr":"8.233.17.31","port":443,"asn":3356,"as":"LEVEL3","country":"United States","country_code":"US"},"domain_registered":"2026-07-07","domain_rank":0,"first_seen":"2026-10-09T17:19:01.217157Z","last_seen":"2026-10-09T17:19:01.217157Z","alert_count":11,"request_count":11,"received_data":22724,"sent_data":11315,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}]},{"fqdn":"d9qj2d9ngy.vuprppwldvo.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-06-13","domain_rank":0,"first_seen":"2026-06-12T07:37:11.641434Z","last_seen":"2026-10-03T13:22:36.319438Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":485,"comment":"","tags":null,"fingerprints":null},{"fqdn":"140.150.33.90","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":1,"received_data":0,"sent_data":472,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_PromotionChunk.B_CKEp2U.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"6e814d3a6fe75aa9d0888024fa44bafa","sha1":"7421c4d5c76121b23879fc926a50806fd96987bc","sha256":"83f439053954c52f1502bc932eb01fe80e439383f44cf3c32ed64c07161fcdc4","sha512":"5d39779051d5e0263c7650e38e99e244563459d59aae85b831f6bef784e376f1daa83d3c0b9b94a53e0d7158928da412b82ec72b174f69eba88d9dc861421d67","ssdeep":"6144:lrwDe2lmMq+WT3CLuaQea7nwbk4mrONHSsVtv:mlslvNckM53v","tlshash":"4e441a8db06da0b4fbb9589ca0660552666c3bc7d010d4e4f0ff9f34278de64b2a477a","size":259039,"data":"","first_seen":"2026-10-09T17:19:19.176036Z","last_seen":"2026-10-09T18:33:14.082649Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/SurpriseRewardIndex.BjA_c15z.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"6087504dd31345594f26fc6e915bb23c","sha1":"aeda51b11218246b5578bf05092e48a7b064ed71","sha256":"b182f9430faec977d0e7c4daa2fda065789f8b5ea30a740d93a14220cfb5da06","sha512":"ac8ac0b41c024d88615775e4b9cbe5500eadbc22a1ea114389b2ac4330c17b5128995dace41043f30896278b9184d9c46b2bb20432914d96813474732d27974d","ssdeep":"192:wt2MweKi+xWQZBeHBqei8N0MbMQ/DZbZm7I5Py08eMzBqB7m:c2MvK1xWQKBqe76MgQ/DZdmePy0lEgBy","tlshash":"1e12b9cae24ba17793fb99bdc416ac146a9417cf56004ee090bf6d1a07cc27c7b6871d","size":9600,"data":"","first_seen":"2026-10-09T17:45:44.070593Z","last_seen":"2026-10-09T18:33:14.0833Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/BlindBoxLotteryIndex.4Mfs8Tws.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"7f029c94e4f1eb72dac662fc99aa9cb5","sha1":"483bef2fba6a56e261a5fe3a1015c92bf6bf790a","sha256":"055774d5f46a5eebaa4ffea7a1c7a010fc492e258674647724d6335ec4959f8d","sha512":"1f6bd1277b9d2d46bb31bfe528c023b11922d08bdcbf7d9f252316be04bf02498f1ebfe056f8b5ff55c959b09e57321e8ed7183539b0ef6a9b0397f6cfceda59","ssdeep":"","tlshash":"6f8100cef1e861f5756fcef8c0d3ac7024361bd101d4d5e7e9aa8e2062c883aea4515b","size":4068,"data":"","first_seen":"2026-10-09T17:45:44.016018Z","last_seen":"2026-10-09T18:33:14.083919Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/index.BruU-pvi.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"75bc5469517d1fad6d1854c6d3be2b3d","sha1":"cd570a7e3b0b275b34e68aede234a1c37983bb18","sha256":"5faf656bcef6f186a26efa238da30b515fa8ad342bfb6654b2471b6e71c04160","sha512":"efb6abdb8549d560d29dfd9379911c48f7d72b1d6334634746cbfc1613fe350bcc9b1bb003d52cba32bb82af97d5f3cd417729bc11d9e215acc2b8b99ace03a2","ssdeep":"","tlshash":"f351630ef3d872b439e9149d812196771286bd256d2890fce07f4f51db1a087e52e469","size":2546,"data":"","first_seen":"2026-10-09T17:19:18.756322Z","last_seen":"2026-10-09T18:33:13.802753Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/workers-DZZHDtNt.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"","is_inline":false,"md5":"d6e1cc2d959d07155b487d4911b6087e","sha1":"6334fce87963b6c07edbcc4277bf01565b9d0798","sha256":"b5b10a66bb72a298d200bc6c64734fc38faf8770a3e0f2a8ed5de79a0e07ef7a","sha512":"42e39ca5e6ef4d40feaf5a44af8155947e143786b7f7acaab2afe1d3cf6d2a04cbdeaa8b3dd5d2de0874a4b4ed702a68ae94ba00183c9a69c8667696b41ebf3f","ssdeep":"96:PuwSVVYp76V91Yu1b2i0BXFRY/k6/QR46XXgEUKxaYlIjRqrIspS:PuwSVVYp76n1Ywbd0drQ/QRVXXgEjxx6","tlshash":"6791230f7ef634669027b074561f9801ba61a42701dddc207e9ce2b09f558385bbefad","size":4420,"data":"","first_seen":"2024-12-20T05:32:30.464122Z","last_seen":"2026-10-09T19:17:20.776328Z","times_seen":11983,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/index.hFK7WpeA.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"3813c6309b911589e0583be58b550d0d","sha1":"a8d9691fe19505b5f6f50aa2533e7032205d8f37","sha256":"46e880a90f2d79563ffc0faee89349dc294b93bc401bae1f246a670e5ba656c0","sha512":"e2c8f8fb7dcf4b93b7389f8e57828172a77d006c7bb7cd570212502146d7c0c68c9862f95c7329b868c8210bf2e0daf925e9bd89a4c6b72eaf679fd41347bfa4","ssdeep":"","tlshash":"ac01cb67f141aafeaa3c64d4d0106bf10942019421f994d4e83daf7200e4cc75d4bc0b","size":716,"data":"","first_seen":"2026-10-09T17:19:18.949719Z","last_seen":"2026-10-09T18:33:14.084899Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/AsyncFooter.DoStVyyF.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"9e1dc7e23897062de491ffdd713a31ef","sha1":"0d2384748ea3c9c72092ee248f03e1fe536dc211","sha256":"61946d29798a0fe241cac7a31bf85723564cd41f49cd6325db3d688fce308109","sha512":"bd259c856d2a157b8d2d772ad98fc3cebae71c0287c709d60278388d21d0c2b0eddab8dc6f3fdcaba24a13736754ccb5f5bcd6dd7b2667192d455e287bea0ac1","ssdeep":"96:l/bzLg3lUbvDAIA1bVsG+XMxa1LouKWRgifhGsJXwuu6fu6JDC:lbzLg1gvAB6sORlfhGSXwuu6fu6ZC","tlshash":"4bb1724cf0b529b8f63bdc68eca79263851c37121258e0f9f1670f241295f8ca3f6626","size":5372,"data":"","first_seen":"2026-10-09T17:45:43.894924Z","last_seen":"2026-10-09T18:33:14.08557Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"726ba076b7848cafeba3564988d6bdd0","sha1":"6f25bbe5c5f4d637d2ed434212f80f7311f81903","sha256":"6d18504a26ab729320ff189c519bec6791d15741b3ee690dd7d47ce64e70c78d","sha512":"b94401e7dcdd5748fd125159cd22692eec1aba536bd3f398ff50ca157621d1a13cde717e9438828f106a7178a895acff8f68cb21169c9eaaee002e2f789fa240","ssdeep":"","tlshash":"b7f0976035c0433058c91ade61a8a294b1f83a12b86e8631c2cad49c6b7cfc84222f99","size":476,"data":"","first_seen":"2026-09-11T13:39:11.431887Z","last_seen":"2026-10-09T19:17:20.827236Z","times_seen":179,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"11a378f21b54b4438a697932ddaec96b","sha1":"c2169536c89b745692611d86f7cfe82a61d96bb9","sha256":"c4ee1097204a4ad25b34d2287d31e56d6fa888d491cd78c20aceb8fe94ac2d85","sha512":"7843609a044d76a6c91f1e934972fac5825b925d3c39f8c7ed90a214fd47741348bb41d33550f17e6c20d99aa3d66abdae72a5ae5a3c82c78fb641a8fb409c21","ssdeep":"96:Ja0EppWoqOWmWj/UYLbs6WbOXOaE+qsqdFjszNw+IoVM7R:epypLbCOXOSH4w+uVM","tlshash":"a1b1b78a714571e502ef6129646fb217b279797a694ce800a213e4e23c7cdcb43b3f5b","size":5168,"data":"","first_seen":"2025-07-29T08:43:47.856388Z","last_seen":"2026-10-09T19:17:20.827813Z","times_seen":14901,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"6f5ad16296ba56ad9e8e06d359750b29","sha1":"86fa3354be1dd039f43f912a1b66624aac7617dd","sha256":"3049f364b65f79a38aeb770de88279ae35090fd4b939295623465e5160c6d2f9","sha512":"6d9532882f810d40fa6b5b832efbeb0acca500fe5c0ec3b7dbf824fd353e0961c99f6343436fec79baf2419c65646803add88391c8ab1078972d723c3d34d0f2","ssdeep":"1536:Fia/1oISsWDeUMiONaDDF2Xfq2MOycV/5RwOsFP2wzVfwPdzB3n/to:RtoISLiUMrazuR/to","tlshash":"73b3a43657a74c8efb32446b9967e20ae63d35d7b04385f18e4caf9ca045981f7132b8","size":109970,"data":"","first_seen":"2026-10-09T18:33:14.088093Z","last_seen":"2026-10-09T18:33:14.088093Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"2acc20b26a87db0424dda4bce7dc00fb","sha1":"fd935db69ea17d2b2e66663f8c74a00ca2a088db","sha256":"53aea2ece70becd854d8eab9c2b80529c40c4d1ddf3baa9d4cf86ddc6c42774b","sha512":"4946d17c08669525088b546e0d1fdf7e07b3b02a09278091a4643c0e0e21aa79dd9190715c756a2e529c6018f3ac7b2af1687a2c7479da11ca6650dab855ed8e","ssdeep":"","tlshash":"fb21fef6f265f2971be25c8f528b72117533119628aa4083a14ede44283cf4bc617faa","size":1192,"data":"","first_seen":"2026-08-26T23:18:36.923109Z","last_seen":"2026-10-09T19:17:20.829628Z","times_seen":249,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"ff9271a01332e4e03d2c73b994671f62","sha1":"b877c10dc72cf779dccc1e1c619c976f28daa217","sha256":"3ee1434346b7416ff767c8d40145c7b25c16f2768a1f24428dafcceb6a520b52","sha512":"c13695099fb11b0e9a226bc0c3908c336ed1e1d13d349465de77411c9ea33933aa26af80fefed5533f33e283580cf928576cbfd50527c1b7c8e3ca2dcec4c2d9","ssdeep":"96:l+DfmFpHq/GwmzZiorT6FrTrSrtv5unpBNwJkkWlDnPLHvSkHU:l+DfeA36ZFrOrTrSrF5unpLDJlDPO1","tlshash":"1ca1a3a72230217111fa189b632f77817e7332186d1445e12169ed943168a8fe1ea6fa","size":4857,"data":"","first_seen":"2026-09-10T23:48:08.204216Z","last_seen":"2026-10-09T19:17:20.830239Z","times_seen":183,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"2cc5acaa3fd1127734ac14a74bd7e13f","sha1":"0f28b7b4779d07566385525337de93b6e09247fb","sha256":"4b594a62139b3f1e5518b6505ef1296824944e56ca4f2397a218762a3bd923dc","sha512":"af592d814c3a343dbb3c432d759a54ce9e9b87bfaa80051a53513adabadcdcc80b4f813476ad791d5dbec4381f22a4e1bb133b7f41487fb85bd9fc30e4e11f7d","ssdeep":"","tlshash":"ced02bb4331060b012d6c9efa28db2d45e173f660800d4724c4c50d428c411df4f00fe","size":279,"data":"","first_seen":"2026-04-15T16:50:03.132523Z","last_seen":"2026-10-09T19:17:20.830833Z","times_seen":3388,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"494ab8c88e9a8cfd9aa511a663c925c6","sha1":"4816e303ad4a09ef00d54305b7b9e2e51c9bff4e","sha256":"9de249453f6780a3274d7fae16d04d230aa9a5b70b57c7d094bbd764ceb8cf4e","sha512":"3fb9b24dc9a904670f2618493304d5b9edf4fab17eca192479cabd99a0a86a4b4a80318baaafa817311bc1ce86d533e4ed044bd9915c4a3b2219db7f0fed6474","ssdeep":"","tlshash":"68e07d48ff28c7f316ce28a7516e770858d104d58c1b58024cebccc86935ed87291527","size":313,"data":"","first_seen":"2023-03-07T01:24:09Z","last_seen":"2026-10-09T19:17:20.831402Z","times_seen":19119,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"948bd9b85d29d14ae61fb1110ca20dd2","sha1":"73856c5d4e081d15997ca6ee4c4d3497a42f713f","sha256":"fcf58482f690f3a719d590c31def144e260e8763b84d3e7bf485a258a520e9c0","sha512":"60cd3e7b1e503e5503adecbe1c7546c76d84687a0882eab041bcf0cd1820a5b4769a5a3f3444c342b3aedea134b8e218ee6bd8cae213e6da416bb3f5d1f996b3","ssdeep":"","tlshash":"2ed022f405246e0a6ffd0408930f3b0eb0e711da8a884d20690a447033ee32b9f9b2f2","size":216,"data":"","first_seen":"2026-07-30T21:56:05.422248Z","last_seen":"2026-10-09T19:17:20.83201Z","times_seen":474,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/0_EntryLoginRegisterChunk.ClHJ9qmi.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"2464c70500233dca9c17dd363f0c77b7","sha1":"576e34fdb8b4797015cdd13443781fe000227ae0","sha256":"0bd7299f58b9ccf139c2c53e97ac83e460f513a98ef9d17f2c49bcb2b3fb0ca5","sha512":"411df9be6a8288379176c7ca211b99bac62da7357f53d53bdda9083ea5c69d57c8a076e06d1e92aea0f7ee0d39326ce83d51a71f1d7431b68d572e4e8db69af8","ssdeep":"12288:k+vAAcUxV26e6xI1j66Mm+SjQbTaYlT2SO0lChBsg:jvAAcUx06p/SjQbTFTG","tlshash":"d3a43b88b1bea5b5bbbc6ce860b6052221187f166405d4f0f1bfaf55339ae40f1e1b35","size":467357,"data":"","first_seen":"2026-10-09T17:19:18.818097Z","last_seen":"2026-10-09T18:33:13.934917Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/utils.Cx8ZANrS.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"95a9b05f3128671cea11bfea7cf34f1b","sha1":"c516c808a6507f57850b7e448df545afae3206f4","sha256":"3e44a8131c43747b1e0f52c2506a8c7c1c900ee39546f0b64b585f64f3d791cc","sha512":"3481fcdc801dc0945be19911d530908afdcebbadf764cf8c05d673daff3d9aa695a6a18938c05c20fb86fa80be161bd4c7116d539bb34c10c9553857068ffc27","ssdeep":"","tlshash":"20414536a7b65335779059dda8322122e074a612382ce1d4703b0f1b3d8ebc94bf09ee","size":1983,"data":"","first_seen":"2026-10-09T17:19:18.744233Z","last_seen":"2026-10-09T18:33:14.057656Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/enum.DZ4s6Hb8.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"7dc8363cfc6a05184e3235cd48d3fcbb","sha1":"575b30d834843216571fc7d69f95e524f36fd1b3","sha256":"222e1d08a78dc825ee32e45438686d6824fdafaedac1dd8f079899d582250a0e","sha512":"3f6b01ce008bb7f595c11a1b76d6c79c7802e283060aedc89691f355e2439abc57a32b04737c6465716ebb09d91900e4c595a2ce6d2423415fee832612d5af8f","ssdeep":"","tlshash":"5ee0ec830264ae9cb8444d5adbb8988162e12ce6cfab32de0bd91a6734c1bd44cd8015","size":299,"data":"","first_seen":"2025-12-23T10:54:41.061691Z","last_seen":"2026-10-09T19:17:20.76735Z","times_seen":7922,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/vendors/vendor-@tonconnect.DfDAdMM-.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"9b5d325a81f7d41813f03cc158f1a0e7","sha1":"9b41bac1a143e2264531bcf41576f0e2fcf25f07","sha256":"2b272ef290f2e28aa02e36503fa921b9faef917d1c1a0263cff7b06f51e40fee","sha512":"c6d009227bb9857cd2b325b5532d315d1862155d8e533404d126aa55af4133f28e51d311df8a130a25784554f362b39a1c515226b719041c2b861a825d768f37","ssdeep":"6144:wqxq77+Ykat5nefHQ0/ffjnbcQAbxqOpUoUb1meFy5T8pQtKtR6MN8vkwdXlVC8D:NIH96QofstxqOpUoU5/FmT8I","tlshash":"d4743bc6f3cab260238b87d450770556b33a1ce9650d81b8f76c899a6f70588c1b7bf9","size":362625,"data":"","first_seen":"2026-10-09T17:19:18.750456Z","last_seen":"2026-10-09T18:33:13.953618Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/index.DnCAYHqw.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"5846658e69848b00e600fc76d24d3f7a","sha1":"58b3946d68a8283d6622a94aaf466b88eea76277","sha256":"40581ea3129c9923bbef1d780166a66d4cdac6032ee48c7a0d46b2887ffb4be3","sha512":"37d48146a2f17e2b2655a5dca3d12e886daadc710bcc2f59b92d0e6c242348f656707d4d017f7ca7442b1f45dbdeb0f9a4b2f1630ae90eef94e8f29359b727a3","ssdeep":"384:zu0TVTimiyHv33BPXRhlno/VEMiVEvf3YuTw3UZycR/wZEgaB6cwwmlA1dT3E+ix:i0TVpuTw3UEcRUM6vw6dTHVncm5dWrIF","tlshash":"9d8295857c18bc7f1b1744cc6493188a415dab04b4cee91ae79bba7234336c5b378f99","size":18035,"data":"","first_seen":"2026-10-09T17:19:18.841248Z","last_seen":"2026-10-09T18:33:14.10766Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/sensor.ecwK3AxP.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"64d4f7a7761fc3f6d924b17241c2cd42","sha1":"9644f21cdc4652914e9525bfb53dc718f2ab5968","sha256":"3c5cd54d2e460e258c66dd24bc847b3c636eaa568c97b1acdfb2b6228c39fbab","sha512":"57a88693c5c98f4216758d328d161f376f1d75ceaf8736be5ded0b6061913e0f810e274777a8abb41fc6d240d09b591e78c648a41e9616739f9c5bba80cc8f90","ssdeep":"","tlshash":"2201bd76120c65ba61e1c8dfb50594a2f86346b80580a4c8b33d1b94994f8ca11be43b","size":784,"data":"","first_seen":"2026-10-09T17:19:19.074914Z","last_seen":"2026-10-09T18:33:14.108893Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/2_EventOthersChunk.BMDfI_v4.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"da1d42bad7f36651c67f7877297b3087","sha1":"02a75ff2bbfbd5bf1efb9264a4a110b120a009ce","sha256":"8be324323640e4498e5883fdd8d2fb8a3b44217c8ee5dbc4b506c1036e210443","sha512":"ba358ab34580f356d00958c7184273d03cc1c2712d4b44ec041747d28433d69b20df6573ea244832f3dbfc1f25abcf39bbab67109d84e65caf557db60831929b","ssdeep":"1536:sokWjkMkgMDwmQRXLg/gzNayekWODfimslN7:sokWj9k6zcIZa4Omsll","tlshash":"a32308c8f46a91b5abb95c6ce8140490757c2b878690d0e4a0ff0e6017d9ee9f7ac73d","size":49310,"data":"","first_seen":"2026-10-09T17:19:19.142749Z","last_seen":"2026-10-09T18:33:14.111428Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"b37caca13d43c34dcf1bcc82cc983135","sha1":"8fd227d36547bc185c2886f0c3c9fc637c5b5f93","sha256":"d43984886bc8873c7e118740c8024a8981fc6150aa53a54478978ff5094207b4","sha512":"dd3c5721bd3bcbbd11b70fd6ef624bb7d7e53477cc3ebf7ca031da1a2cbebd88d5730098979fb0ac81b05a51fb8d8f8c547313132488c931c32b6be3cf37b89a","ssdeep":"","tlshash":"8ec08cc460c239001602642010af24e49024402670481b029c98d8442e220b08233e98","size":131,"data":"","first_seen":"2023-04-18T07:51:40Z","last_seen":"2026-10-09T19:17:20.832574Z","times_seen":21147,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/levitate.Np6ij6LH.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"68b1c4697942dd78f2ab8de74f7a3597","sha1":"02a04d49671cc668ffe29e69db715a4cadcfc80c","sha256":"8042f17a3515717186638d905fffbbbd928e3830e3f4e3fd69b560860221a103","sha512":"d459434b176a16b0b61a760a1a21e094e1fa7fbfd720f31f16de116be198653f9c24ace1d025f18e6723574407cf827a848a8d69a1bfb9a4b16286f7bf72047f","ssdeep":"","tlshash":"4ae0c091396170f03bb10ce0c33d949e41a403353e0166e835ed5a2171214243fafca3","size":364,"data":"","first_seen":"2026-10-09T17:19:18.957988Z","last_seen":"2026-10-09T18:33:14.114203Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_SubGameChunk.B5HQ58Dc.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"78995ffc6f39f4ae60482bdc00fbadec","sha1":"b88323302f13a91a3f47eff7da009909e9c5dae1","sha256":"6ae93bc16cdae8f967d6314d498a7f10bc7b6f8db8b964b314f016661903553e","sha512":"9ec18cf5e299f56e1ac1f7e9f22e8c2f5c3a727280af8216c36672ff0d1666b1c20ffa5026086e4a739921001befbb1f24abbdaf4528c92633d3cea1eb2521f3","ssdeep":"768:ek07wo1G843Nltm52YpHUgUf/vKGjjmuN3pfBBnGQmIi4XFU3sdjpyA/FhYU1:eSvHSB6GqdLhz1","tlshash":"2703e8d871fdbd70b3fe5899a0e1105862142b811913cded78bf8ea1377ac94a11a73b","size":38487,"data":"","first_seen":"2026-10-09T17:19:19.152619Z","last_seen":"2026-10-09T18:33:14.115247Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/SlashOnceReceiveIndex.CpMtJpeC.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"9117b6475631675b966c46f0b7786ac6","sha1":"d43eee38b9cbbe9c89a5c2d233f3b6b7c0d7b7f6","sha256":"2dffc4e4a156c28f69e54a65878b64845f328209013b9d1f1558f031c9b73c19","sha512":"e7dd1f09224b027102a4d79130ea2d1f5c59067fd5d1cd4977f8d55625b944d73e31611d4c4dd58bdca2f352ba5020694abc9ce9bf0545e05027fc1fe45e2a94","ssdeep":"96:gpVjWjW1pUF7oyr9hM3LlkrhJlIkYm7TcGbEa+rV46Wn:gpVYK2FMyTM3Llkr1IkYmZb3+rSj","tlshash":"24c1648a746f14b2bfbb547ae0a1855232b82fd38065c4e0d5ff2f101786d49f69a327","size":6024,"data":"","first_seen":"2026-10-09T17:19:19.051877Z","last_seen":"2026-10-09T18:33:14.116877Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/ProgressIndex.V0YE0rU7.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"be6df97fcb60b364a64c09fd9e236a91","sha1":"167d2e3a757e3aa645b3240f6c56b2153c4cc5d5","sha256":"97b38309ccbd2eba1296963d5c59e15ed068f62c42e4665395dc882e54caf5ea","sha512":"4db621bb0edc2484a8dc12e3dfee7f36e6bffa3054a83dcf1ddc58dd9a9c4e99848a3c41ff8c6ca5a6ba9216dcfec5efdb94ab746892213c845f2fe6d940e0f4","ssdeep":"","tlshash":"2401fed27908e6f39fde4ca8c1d0162b13f40bc9d179b7c88ae922315347a88d90e784","size":704,"data":"","first_seen":"2026-10-09T17:45:44.014925Z","last_seen":"2026-10-09T18:33:14.120498Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"2dcaabaab1bdf77f18953b6f6e3494d6","sha1":"505307e10c178950721fc86da9d7d131e08a8c74","sha256":"0ed906415c6ee177e31f065346fa1f7e74269720fe220d7397e2858a8c9ec381","sha512":"df62c23e61d63a3390db24a6451f76fcd5d277933f2c49cd4752647fe982becd0c24d7905722b0504b1987d06d93178ac873a46fd9114725bc848b754dc59f07","ssdeep":"","tlshash":"73c08cc4a0c22d20660a642410bf24e49024802770482b028c94d8493e220b08233e9c","size":141,"data":"","first_seen":"2025-03-09T03:44:28.26241Z","last_seen":"2026-10-09T18:33:14.121414Z","times_seen":3567,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"8ce75eedfbe16010cd6b584103af7527","sha1":"acb64614da9f87b18d609d6dbfc342ac01b2bb3d","sha256":"7b203be41c1e1570f6c23be7a7fa22426ace0c957e85da0cd9553ee74c878598","sha512":"10b3da553d2564d7093556c616809ed867b086f405f85f586e2deb301c2eac325cad40c1ea2c5e3c435bcfad39fcec06b05bad2601c03e188b95ccaca5aa7c26","ssdeep":"","tlshash":"55c08cc8a1c26e002a32a83890bf28e49038442b758c6b429c94d95d3e270f08237e9c","size":155,"data":"","first_seen":"2025-03-22T15:35:24.736323Z","last_seen":"2026-10-09T18:33:14.122462Z","times_seen":4624,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/FloatBarIndex.0B6wu3T-.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"8d6ca20a34b29551293267eb6ae2e7cd","sha1":"d9107efd4de8628883e15ce97413367e8177f75b","sha256":"c136b7870e45434822c214b632e23d6bee941385536d630d841b3ef202c829c5","sha512":"a7661ba52cd912b39647bc8c828d4813f421663809a656fb4bb7840ab661818609f8f725885e203c6dee85f92ba546ca9c70ff7b85dadaec328d0c5389354478","ssdeep":"96:l/UCSSNhzCuQRJPX88Z5n4X5ySDib1FFpXdSDPVU0wkunhuu96HzRBToISt0:lUCnNhzqRJdd4PDiJdXdSDNUrkunhuFl","tlshash":"1791098b30bb3ab872d50458d9a47c82ca4c67d74002d0d5e2be1da821c5c94526bff2","size":4429,"data":"","first_seen":"2026-10-09T17:19:18.935254Z","last_seen":"2026-10-09T18:33:14.123869Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_AgentCenterChunk.D6aUSIbi.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"7c8c1f26fe6862664fd39e6407ba1876","sha1":"8e7cfca8fce8fc5bd76db056f6380edbc5376b51","sha256":"e15349f524fde86f66c8f4cd7121d34de970420dcf2744cea4f62fb508b7902a","sha512":"c3e3e6c78b4bb23b3d0a7d6a9b1941069bbf7924c300e4887c77ce5f49c25bfacc3d08ab7be4b7206b6bde1b44d859feef1f564ebccd61fb618f7ec19e4fd38f","ssdeep":"3072:I5X2EIORjjNq7p7UwN13y2ifGBoIBDWCcFdQKmThwqM48YZVAFFuz/380pEP:uXROHiSWCUQKEwdDYfRE0s","tlshash":"43240988b4b9e534fb7e6d69b0750c90620c2b469014d4f8f1fe8f64678afb4b15933a","size":229568,"data":"","first_seen":"2026-10-09T17:19:19.050755Z","last_seen":"2026-10-09T18:33:14.077382Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/dialog.impl.BpUnOV4A.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"33a401ce64e6adefe60dd25115956050","sha1":"865880dcf404b384e5ba664e0597dc34a8d7a0ad","sha256":"7f731bed3333462d207ab38f6fb6070ded9dcc17aae4dcb63aa149271503c7e3","sha512":"e156eecc08859a23060371421ac93db3ee1a68e01423c6e537f22f9d4c404023733e01219ada447031c25696d0bcd0f07f6ef76ad3ab37b9219b8badabb2077f","ssdeep":"","tlshash":"ac3152cdd2643ce2ecfbe9f4c5e3a512120c25ba8744a97080df2b5502ae036de8d213","size":1867,"data":"","first_seen":"2026-10-09T17:19:19.078952Z","last_seen":"2026-10-09T18:33:14.124713Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/CreateLobbyVersionUpdate.impl.B1XbyySh.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"74b5814a86645719b3d49a8bb5bc907b","sha1":"e72e86e0bf8308280e25ca40d5af3e5c8d29e9a3","sha256":"7b551727b89028cfb6933beb26b77b2f69406150611a12d81a08a00a3049a68c","sha512":"cb8e1ace5036054cc9695984f3e43b74f58b5a1cd0511e5585377df2ed7ccd966354e3abc5d5e82a79802168c388ab9ac80d0450b79436baf696baf0c45332c6","ssdeep":"","tlshash":"4f21658ad041b0f638f209e8cdd675c40365a7a05362a5f101af665247a6b1d8f8eb85","size":1339,"data":"","first_seen":"2026-10-09T17:19:19.081339Z","last_seen":"2026-10-09T18:33:14.128328Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/0_RechargeFormChunk.BQFG26r5.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"61b941b0d313683fe5b157d750031a56","sha1":"f08423f5307d9d2f31cf103570b3c1375320b3df","sha256":"5002f2efd762d3f3fb60820245edb2dd88db9cfb764d2f18e6a284cb97ea8cea","sha512":"3b08074c2d46df513dc5d6b9eb14374a4bfc0ccb9f83a3ce2b39066b83336fb3b887dbb1d6a00cb2a88494d063b536eb76df883960c78a77342e3d6325c6fa18","ssdeep":"1536:k5tG8NfTmpt39ztoMtqJQbxv7zi0YsH1GHXU5OGMyv6K3TIdfx//4QFRQnZCCwEd:k5tGvt39z9tqJQbxv7nYsH17IdfxX4Qc","tlshash":"f1835c4a31697075abb644a7a0f2010292183b45b403d4fdf1bedee51faad8436fa73d","size":83552,"data":"","first_seen":"2026-10-09T17:19:19.129307Z","last_seen":"2026-10-09T18:33:14.130753Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"11158df6535bf8487a12e4804bf91ecd","sha1":"4a923322897cfcd2e1d3097d28773e7ebb04dd73","sha256":"0b5f962475de9c03fb3ddd008dbb67340e163c86761360527823ace3b87b86b0","sha512":"b8c44520dde957b7f1520e6c7746f2bdcb11fd9b111ffe0c5778220d3fe07848525e484eddd0691c4088141403762a9a6e24eb5464730e7dcf8da0c4aa7fc6de","ssdeep":"","tlshash":"9ac08cc9a0c26e001612651010af28e4a024482670481b02ac94e9582e220b09237e9c","size":143,"data":"","first_seen":"2025-03-09T03:44:28.292702Z","last_seen":"2026-10-09T18:33:14.132796Z","times_seen":3481,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"8af88587c3c477b39b6e8ffd7629b54a","sha1":"e96e7a6d2f8b799f2948ca439a1835e4bbb4cb31","sha256":"348c7e508234b7d725d6b0535d02c4f6cd0a473c7f142e80d72a22ada8755d2e","sha512":"1dffa59f806fef7f8164c9846d7fb4e2452f016c6b0fd68174b8c5d1980eacb766cb93df68cdc9a43d3f72adc238b221e79e2ac9ebd8d2acb3f48ec70d2b986f","ssdeep":"","tlshash":"f7c08cc4a0c26d101a02641021af34e490244426b4485b038c94e84c2e260b48233ed9","size":141,"data":"","first_seen":"2025-03-19T06:50:21.459763Z","last_seen":"2026-10-09T18:33:14.133542Z","times_seen":3366,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/index.BcVweGMN.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"ec2e1dabc746cc3ee39f2ddb289dfc0b","sha1":"7ecf33a7fedd70faacd7e63f289acb9d01f2724e","sha256":"23be3b503a4d3010137a881bfd9552e8426ef193a6accb5a2aac4b611a5a5bb2","sha512":"7f801f9f3e69ea937667dd4c33b01596b2a59a33df02ecdfdbb65bb64298fc77be3dd168a8c6d59d98bcbd8f789a775e7f32a4e1b51efeb4a7c6fac010f6f73d","ssdeep":"","tlshash":"4631feaa709930b635277fb4d09a83a6014566d73564d4f07e8b2f6b020fa41d88df1f","size":1496,"data":"","first_seen":"2026-10-09T17:19:18.745972Z","last_seen":"2026-10-09T18:33:14.029034Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/MarketingIndex.CiwxDjc0.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"972fb5f0e7d403add20d3d163c04493f","sha1":"4b42b7427bc7183b9bf42e749659f6b15524cc08","sha256":"241bf8d3b2278b32bd62c5a34e4840dcf52d232b98837a292f8a92dba7940abb","sha512":"b6fa5fc7cd7ba64c095c77288f801ba4dbb6e56c36832c9978fc68a75e86ceba4db96f37e4fc7bd7ec532abfc018d2fe59f96e42a8ab57eb7bd8286cd73c8c22","ssdeep":"384:tjbMaz2pHxlao7t3FZx/+CV+qL3GAMGj/gsb/5BfUU17PY:t/Maz21Hao7tfB/+qLWAM+bbhlUi7PY","tlshash":"2072f94cb47490ea3275a9ccc07d1f56fa0d3b998080d1f6e4efae971b44d1863a862f","size":16146,"data":"","first_seen":"2026-10-09T17:19:19.093447Z","last_seen":"2026-10-09T18:33:14.134364Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/ActivityGuardedSwiper.DQoZGWzs.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"b667394be3ce0cb5cf9f10e91675c8f3","sha1":"57cecf1f911e2b2f5d6d81b92ed9907d7952b661","sha256":"7b14db495fc00af9315f63f221f2f384c22a9fac277d898c0799011c202137b1","sha512":"a259cb6f0799f1db0b5eca7188b64c64e4179a634d58131a68c9b837e76dcdb75e351e6828bb91a5e625cfff5ac9744de870ad7e1735ffcb217fc8de371f0a0d","ssdeep":"","tlshash":"d011024c74a870701f7f8c64c069a199ad715fed020ea1d4b49c1e10d3a98bfa0bba39","size":1006,"data":"","first_seen":"2026-10-09T17:19:18.980171Z","last_seen":"2026-10-09T18:33:14.136184Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_SearchSubGameChunk.0mMNu3rD.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"540987a80abb3a78487f7cae217739fa","sha1":"30d7c50fb68a39e34f817e85a5f3bfa3c3d261ef","sha256":"c5b1a2053a58a109fcdb89c3a6ae05afa3dfac0e129dec733f599c687b8b9a40","sha512":"ae380cf2c05ca5d19cafa736968e20bf83f4fb96ea93779240a70815c666c47e8e9d3e3ee094f11ba401910ca07f7664fcba1a27840e928f7ff818976492e271","ssdeep":"384:lr9GPH3hlJdi4+TjoTyn01vlLVndimEpENnih+Xkh8bFR9TAjUIJYbs7H+:lrAPHHJM4+TjoVOmbnDkhmFRpXIJYbse","tlshash":"5cd2e88ef41de95abff638e5603470806918d64f9510e4e5e9f2aeb4328de58330877e","size":29824,"data":"","first_seen":"2026-10-09T17:19:19.148742Z","last_seen":"2026-10-09T18:33:14.138404Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/2_DownloadDialogsChunk.BFnIef_M.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"fc86f599e77e99582c7f9c064ab48ed3","sha1":"2172233f599a96ee1ab7cae7206fbdfdc402a2cf","sha256":"3d7e50c11b933d3b1482db0f93be9dc10b0627e571ee91575722d7144222c70a","sha512":"aefccfb872bfb0d2a57949931067926d6d3cef88980f45c6a869e16ed01b7d6114fd281525e3d6d9d5b198355e614033cdc8ba13553cafa08c109f0e8a736d42","ssdeep":"384:7M9f6aWKV2ANEbXCoIJjfCbqi/ECJMAa4jQwn/WN1C+dq8q4Mlg:49f6azjNEbXVIV0/Es7aIF/WNTMlg","tlshash":"bc92fcceb495f634777a2d5de02a140076181f9b8100e4e990fe6fa46792d2cb3ad72f","size":20758,"data":"","first_seen":"2026-10-09T17:45:43.919023Z","last_seen":"2026-10-09T18:33:14.14053Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"941d0639adc60b5d5ba28435114ceb42","sha1":"c97ead822939737306e88c9d30f9cabfab6d13c4","sha256":"e358f91f76d488e3fd55d8c075ea53e622cf6e1eb43bf99dc33da89a86238da3","sha512":"00ec9b6df13ac06cb53bd2865a2f5949974dabc587482e536a2032b9e4f9a5c79beafe882dd1367c60c305d4fdf8fa43e07447c2507dde895897ff6586ed6998","ssdeep":"","tlshash":"f4c08cc4b0e62d101626646020bf26e4a028442770881f028ca4d8483e230f0823bed8","size":144,"data":"","first_seen":"2026-02-18T21:28:14.197935Z","last_seen":"2026-10-09T18:33:14.142365Z","times_seen":118,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/aliveDomainCheck.H0OUlClY.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"319a87ff671f09cafda236d68895b361","sha1":"3207f4ee9b9a437a34f0f351a0bb2ac053f4440a","sha256":"dc5ee795a5a97ff8d6877746522f539830a783172c306f4ecd8a30a2eed8ba6e","sha512":"00d12733b78639fad01262057609dbf7ecc1b48d3073e8692cc61d662433b9aaa0d425a1d7bdcb227d56e4a74cd0d44cfef1377cde1667291069ffc92da69e11","ssdeep":"","tlshash":"e54142f243541435b0d28a5ce068f9729217f0622cadd0d5e2df5e83471e640f87bd4e","size":2276,"data":"","first_seen":"2026-10-09T17:19:19.072543Z","last_seen":"2026-10-09T18:33:14.143866Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/useMarketing.BE1f8w1h.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"68fe7af4505394dce9ed5a68154a7133","sha1":"1e7e9700e9305d752ba075c5f807c0fb55b92009","sha256":"0a7728a3eef9f49b88e38e79b369cbeb7375febad17a1687c0f3d53df03c06ce","sha512":"36a4de291d275ef9de3169f55c1932372c39fa33a164a6142c645cf1ccaac8d09835b41320a2b74a4bc4738e93d85fbffebf242e58ec6ffc57bcbce7cc946b06","ssdeep":"192:FgUiP0o+/k2EGmX3SAsXwwlvGtoCHkZbgTJSFkwLE29ofPQ5:FfiXhGs3cXwwJGiBgdt+6fPY","tlshash":"6b328485b16fddb27847e8ec85e41df4916739e120c0b3e17b5d9b2062347ecb05ab82","size":11267,"data":"","first_seen":"2026-10-09T17:19:18.945662Z","last_seen":"2026-10-09T18:33:14.145128Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"3a32d7682eb9bd55d35085564532fa03","sha1":"2b7ff3008159f1023261356be04307abf535a049","sha256":"9e0db488ebfa650c14f73cf6013dd2ff070581f9c8af141a9f2db3bc527f1915","sha512":"44f82418db5ba04777272e56333b58c97033cc686e935549b00081c09445d3f7224ac7e14e213db4bbfdad33db51febe83432260705f633db68bf1e3345560f6","ssdeep":"","tlshash":"18c08cc5a0c22e005602641014bf28e49024403a74481b029da4d8482e220b08237f98","size":139,"data":"","first_seen":"2023-04-13T07:32:13Z","last_seen":"2026-10-09T18:33:14.146091Z","times_seen":5536,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/AsyncAsideIndex.DJTJPSZz.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"7b9a73e415a2fd708aa6527f14dfa93e","sha1":"34c905a28c22dfea29253abe98f43336be4e2ead","sha256":"f537b5bbc78d91a636ea94e39e4685ad0443ea8e89ee9bab3df9770691dc29b4","sha512":"8bcdc123f7d17d53fe4d7a38ba4c9b53ab81781a67ba618d8d1ca9b6044e113ce92b831e8dead351ff01684b6edac0a509a24a68a1b7b7f76d238d739d757d5e","ssdeep":"","tlshash":"b4118c8fe04179e2f4c69cf9c5a5e83106aa12c207c1d7b1c0dfb7669394479dd4da83","size":906,"data":"","first_seen":"2026-10-09T17:19:19.030998Z","last_seen":"2026-10-09T18:33:13.751922Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/libs/webPush@2.2.0.1/webPushSdk.produce.min.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"68125da114d3691c0b2f30e141ce79fd","sha1":"91e806bea4f6dce8512f4f4256c39747f7536363","sha256":"5f11ee8b12d8b4c5d7dddb00c6517280df2e1bf0fb5db094e2a12d62929ee3c5","sha512":"f7a033b950ce8483b91c03152486cbf7001b27d4a9a92fb97b0e4c699f89e598c6829ace105dec24da516df732e0a4a769e2c443229ffc6c2b4989029bf3504f","ssdeep":"768:porqwD5QO6hsA6KJsacRUZd3O3PegdmW4i9rpr294fLui9/yFGlq0VTH0t+QiRH0:275L6hZbJuOujS8JHuiAJ0obpOrKB","tlshash":"45534bceb18d753107e7b465c53b100277332815aa494268b6ece9e6bc7a1ce7113fba","size":65947,"data":"","first_seen":"2025-09-08T15:41:02.523794Z","last_seen":"2026-10-09T18:33:13.790236Z","times_seen":3413,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"18dc3c0f369671bbaadf404673f2d2a3","sha1":"8eb94410b28cf17b005ff5c7615db2942de9b12d","sha256":"ccf74a6ceded050768000801549ff19600241f12c789aed81ec74b2610906814","sha512":"c9bcc9f74c3773586440731b23b5ad183f2344a9f6660db557c0e400a2d3bd515ff64f4611a7601da87ac4fbaa8acdd447aa027b5f7edecbef092993517b259f","ssdeep":"","tlshash":"f6d023d8e0e32c0012055330f07f2bd850254437608415095de9fcd97967070c33ff48","size":210,"data":"","first_seen":"2025-11-28T05:58:21.960481Z","last_seen":"2026-10-09T18:33:14.146981Z","times_seen":383,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/index.AIIBx_I3.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"a2ae85c5981e99dc5984ce15363879db","sha1":"0bff2507c105b951998cfc00d21951e645e67bd2","sha256":"b1c9b04c835957c5361ce88041b03c913eaa2c3ea86ad285bbba46ed088b9d0a","sha512":"ae5f6bd1320a80662d3de51d4a3ec4069a703dd138bb5ae8df7d19171d23d431aca6cd4049407099c507999d0665e8a26531cc921a9644104dd38e9c96115a92","ssdeep":"","tlshash":"a961824ee0d9ab3833dc4c8850791492a62c3a50710ed4d5b5af4bb5a61aac7827372e","size":3380,"data":"","first_seen":"2026-10-09T17:19:19.09245Z","last_seen":"2026-10-09T18:33:14.147979Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/2_SportChunk.CXcdYvRK.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"9a325fc7d4bb0c130c409e8392af62f8","sha1":"91911e554b20eaa547de52436e9bf3ec834494c1","sha256":"f9566580a6995d8c552d9f602fc32637a9e58037a39cddc5dd6817d7b8bd4bfb","sha512":"4eb9209114c5cf089bfc1caf19f5d67501be84fdf43805f72d08b0d66c14ade77b55bfbebe529a3ac6ae0dffd217b71ab01fc5cc188a3b7a510d016df86acd92","ssdeep":"3072:lPdnc5ixxhR34PpdrqjTa637bSZbZtJznEyW79eOyqblMjsfiEHa8krIIF3ykV27:l1ncIxxhR34PpdrqjTa637bxys9eOyqL","tlshash":"ab043918bc217d77a32fdd48713d1588252e1771b486c9f1f8fa9ff4b589a40a322e29","size":187413,"data":"","first_seen":"2026-10-09T17:22:28.402364Z","last_seen":"2026-10-09T18:33:14.148799Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"2531cb4ffc4a6bc985a0ea9fb157d7da","sha1":"b750e6e7060e1bdbfe062c926e7d168b11b3aed7","sha256":"8d1c1a70785c21b22caa8a307a6449c225bcc98a13b0ff7323c12b919c810774","sha512":"9a70f9e22ead893f5fcc2e20119779b8dfa198fa618390d43033e7047e61a29fcff1d41d3376018b1ef35b16dfb7717cbddca35cd3d7a83373b17b2d1845acf2","ssdeep":"","tlshash":"8ec080c571c26d00a516645051bf34d450354017704d1b129c94d8443d934f09233d9c","size":157,"data":"","first_seen":"2025-03-20T05:10:37.647837Z","last_seen":"2026-10-09T18:33:14.149635Z","times_seen":4518,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/ThirdMenuList.EMB1A7Ci.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"a52d66f9cce0a9436e871411cfb640ea","sha1":"686df3e19c1e5baa797e28a65673747d1e25e165","sha256":"b6103d36520186959a18e324ef0d32ddea2f5a4151655225b864218ff83b254c","sha512":"b8272c55e9a05085ac6f4da02359a64b51f0587d807e247f6ec5e616f437e40523999dfbf63c47b7ee94c58bf41ac6f6dd652668e41ac95d38af8d95bcac6a89","ssdeep":"","tlshash":"f9f002cdf5a4a7bc2a0c148ac0fef15a194c828d860561a0c5f79572a3d284dfb6e725","size":636,"data":"","first_seen":"2026-10-09T17:19:19.099486Z","last_seen":"2026-10-09T18:33:13.973145Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"ea0471119136448a25f9a37f9ea9df9c","sha1":"4f411a7ebf1b143906b9eca11c05303cc92c8487","sha256":"280ef9aa25ac6ecae4a1ba7ee34bdbb6fd4bb8cdbc45dcf5db200971ae080a2a","sha512":"b64b1b96f987d2a2c8e5e8c97ff28e45ec4c657be62cc4402f703465de765e9e4e83645ee53412970f826bf497e5ab575ef3ac75436417c938ce973401c4e8c8","ssdeep":"","tlshash":"22c08cc5f0c36e001a22a82460bf24e4a0344036b5486b02ac94de592e230f48237eac","size":153,"data":"","first_seen":"2025-03-22T15:35:24.750486Z","last_seen":"2026-10-09T18:33:14.150341Z","times_seen":4665,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"1b9767fefe58661c6cb4a462c456c7fd","sha1":"4767bd633f592d8902ac128b221d4a1ed7c3f02e","sha256":"1f917a1b7642ba3332b12a938429952898cede22e6cf7ada7bf0244ef100847c","sha512":"23ea8761a9f986a3730cf38dfcda6c581ae7106cfdf03e42db07a8cc39b1fb4fba4f295efb9bfd6e31b000e241d0310a7f17b474bf0133beece261aad32fa832","ssdeep":"","tlshash":"c6c08cc4a0d63d001613641090af34e8a038402774481b038c94ec493e620f49233e98","size":143,"data":"","first_seen":"2025-09-27T13:41:29.19961Z","last_seen":"2026-10-09T18:33:14.151058Z","times_seen":75,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/0_RechargeLegacyChunk.BGwcg7Zr.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"a8e41d592e9ffbfc75b3c6b1a3c3d507","sha1":"58b3f1edc8c25699a9a4883c1da8a838bc458a89","sha256":"a3c313576720edb52d95acec1f3f6e3bc174eda95dcb70810ced1bdefc4f7540","sha512":"de7f6daf9451420e150b76e22a00b9145c808b246b1c7ea4596ce056753a02d66b01d24d907a67de4260fc9d8d03342c76041eac2bbab65a4e11be412d72d41a","ssdeep":"3072:lrQDVJ2XpxWYzTvRae7cYInLCcPdS2btBqcnyFl2jyA7+ipvBiBr+cU6uzKj:lrQ5JwpxWkTvR/7cYInGcPdS2btBqcno","tlshash":"fbc3d68c787aa57c7b6c295860ea0ca6531c7f9bd000d4f0e1be4e607799b60b2d573e","size":121979,"data":"","first_seen":"2026-10-09T17:19:19.052931Z","last_seen":"2026-10-09T18:33:14.163565Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"535ffed3525290d1f9db393bbdf06188","sha1":"e627f32c8ef69639e0062680ead2d15d32eafff2","sha256":"f35122db935a134938e84fc13a9c7448db1e7a542c7f21689952a09316450637","sha512":"cb9d15673be5f5bd415ad028ac7ee6edb5876f8bf2096978c36abc20e6f4067e6e0dbbd937997a5ef41271c608ac375419e6eadecefcfd1b6124c8df2e2903d3","ssdeep":"","tlshash":"bcc08cc4a0d76e002602a96418bf35f4a034882770482b52cde4d8482e234b88233e98","size":148,"data":"","first_seen":"2026-05-27T04:37:17.653176Z","last_seen":"2026-10-09T18:33:14.16521Z","times_seen":469,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/const.cVjhTEo5.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"98ccfeb256bb1d42495691e3d40396ec","sha1":"d38daa7eaa811517bf6cb63c83088426e5140b62","sha256":"6e244d4823acddbc15cd99fb29037d67c21e78a94d9ea2b1193f4c625c4c6e77","sha512":"6ffc3c8ced237b4e9aa3633155c637c6488bfb95105a9d2f30327de6e908275290b0ea14886010641d314468036f86b44c5e01a05df5a1d5af29d29066749282","ssdeep":"","tlshash":"341152aab361d3716c8b3ff9587a1035d24103ff21e748e024e919332192c9783cdca6","size":1046,"data":"","first_seen":"2026-10-09T17:19:19.094524Z","last_seen":"2026-10-09T18:33:14.167071Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"6163e7dc79fab37ac03f67b48a573d69","sha1":"731519ce84b4e29d60703f3651657f00a73cddda","sha256":"351788168344c1bf8ca805bd18558c871b5ffdf1399e9e8528df39e0c7798ae1","sha512":"3b2400a6364e1cb65ee5e91777da26607547cfd0a61a0c3c007671ec8dc9ac0ef669dc6007ce2048ca84200656267063ddc4fb94ff2e22f371566e02832efd0c","ssdeep":"192:dRYzYRT6Acex45QLM/rKXtLLzFDH0+fNZLyv87/lqL6UnIQnTKth3NawC:TYswQtZD5R1Nax","tlshash":"f222509c34b70a2190d360ba9adf5016b037a413398ede503ead42947fc15798bf6bdb","size":10750,"data":"","first_seen":"2026-07-10T21:31:54.415425Z","last_seen":"2026-10-09T18:33:14.168196Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/CustomerServiceDomWidgetIndex.BrT0ICrC.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"6fb048b650a62e2826de1380f73c8a9b","sha1":"08f8c26113c7f0bf3bd6f251a311d6b78d0fed96","sha256":"2a4f75d306a99be61b51c6622817e244b96f1af7606c48900ce557dacc6b8c5a","sha512":"a2e3e25f23e7857cca7eaefaaaced2efcb81cd8584749dfc206477e7a820b31e1fcd94f4ee0c900b3eb599294310a3b9455c026c1ab257a80d66ecbbdf3247a3","ssdeep":"192:tm2tIjK2Ls1f52bTDvaf1bRRTV5swEZyhrdlA2/JrVy/4bPJqtoX5gCxgoa8e5x/:w2YK2Ls1fYbTDvafNJ9EZyhLA2/NVy/n","tlshash":"25121a386632743066b59ecbf078d6a22964018eb513d1f831be4f52eac8cc33276979","size":9086,"data":"","first_seen":"2026-10-09T17:45:43.865867Z","last_seen":"2026-10-09T18:33:14.169032Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"89aba8e3d0b0a20b62e8c31f32ef8a28","sha1":"bbe11545aeb34d9e753d52ebd37fa95353c1a5d7","sha256":"1bf3f6637a3d66486836bc4d7fce4f6cbd80e52ca7663db8a24310f331872e63","sha512":"55d4d8cf1c517fc546405f7c3a7c84db3164706c28b5a8fdfadb7bcf126c3aee0bc72c78fbf8407cf8aecdfafd1b8151b3e99dc72cb382bf6a938a1ff8d8fe6d","ssdeep":"","tlshash":"f3c08cc4a0d72d001603642111ff34f4a0284426b0481b038da4d84c3e260f08237e98","size":144,"data":"","first_seen":"2023-12-03T05:41:21Z","last_seen":"2026-10-09T18:33:14.170756Z","times_seen":545,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/commonChunk.0oGKmx_H.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"415e85d6ed50af9c12d39272b65fb77d","sha1":"4ac9ae6ec088613af7e22bd959891bcce2493818","sha256":"ff68a6a8121fa764dac448a63cb65351316333649926948b77defea3c65c633f","sha512":"d4384b82ccdac5a691453bb054ac3ffdb6a45406787a23608bbf2c6b62fcfe35c89bb46dbed4b92521b11f3853d8f6590760a3e3c9c2109f34ee8ac0cc690a29","ssdeep":"24576:3FrPLPikBBoVy6GOGbNRF/XWdQZ4IecpgDtQa46jQ9YjHjZ:3FrzPNBBoVy6GOSbF/XWdQZ4IecpgDtT","tlshash":"1e658f89b1be617177b91cdc907a156261287f02b405c4f4f2bf8f363396945a2f2b3a","size":1434522,"data":"","first_seen":"2026-10-09T17:19:19.173532Z","last_seen":"2026-10-09T18:33:14.172941Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"cd1df43640d00c8d0beaab10621a17ee","sha1":"50e8ae32299af944331c5fa90f3769ef5cb9043e","sha256":"81f4d1ac7af632b82aac2738e5c3c84702d5ba71599b1bfaad26131c333ed185","sha512":"9b87b964b38b6f247dda088584bba2a0e26205028e77ca49610fc858ae2af5b47350ecaddbc26921bb606dba8f7129725b2f6685624bb6a27b80c4f4c01e8976","ssdeep":"","tlshash":"f5c08cc4a1c26e005a02641411bf24e4a0344427b0485b439c94e94d2e230b08233e98","size":143,"data":"","first_seen":"2024-09-24T22:12:58Z","last_seen":"2026-10-09T18:33:14.175325Z","times_seen":209,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"76480994e2477cad82be2d8485fb0afd","sha1":"0761c021ae4aae6c2abdb5d36ad1886b60888e40","sha256":"8a81bd85714c35c307fe68f42e43a2576bf0e914e1974a81a2d5a071b36b2662","sha512":"e13efdaa8ea00b5919cdfcbc299ff31fe0172eef4a6a09596d154030ee68992b2212c2dc15534988a3f80c533d993a9600296febe51b8d25d0e75a9938376f6b","ssdeep":"","tlshash":"cac08cc4b0c32d002606646425af24e49024542ab0482b428cd4d8483e220b08333ea8","size":143,"data":"","first_seen":"2025-08-11T11:53:40.344341Z","last_seen":"2026-10-09T18:33:14.177423Z","times_seen":40,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"18556f4b1a57b7d4c5900bb487f0e63a","sha1":"26360204c8e82c05741b820a863bba1f2d46d39b","sha256":"d7ed28de108a90547b3dd98691d71a1d9b09eacc820c57d30f682060dfc98aad","sha512":"7791b1aca74861c6fae4f7ef92c08948583e2c5cf76e7e3ce9f0348f13195a9adffcdcfe76ea1e948e09868b79cd9bae5b098c8b4897f2a978acef5fe326950b","ssdeep":"","tlshash":"58c08cc4b0c26e101602a45110af28e8a024883678481b02cc94d8483e620f08233ea8","size":144,"data":"","first_seen":"2025-03-19T06:50:21.425346Z","last_seen":"2026-10-09T18:33:14.178443Z","times_seen":3372,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/index.BujPupHU.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"27f49a65ddd05841841486e6fbd1e1e9","sha1":"9deb2887b26f1a215ed73282becf8d4298b8efff","sha256":"fed5c88579928a969361ca675d0383255749d5cef5aa250b84feab2585f3b7e9","sha512":"f9ef4d50394786f8cb6e41541820734977a11fbc9994b057eede34acab0e2768949994bbf2fa35f4659e973c3874f4698c58e3b8babf6fc70a5c410758d88d49","ssdeep":"192:lUC97hiGmSS3LEFc9f8V/zTE4zSM2Q30mRq4UVSd7nbca12Fh:lr9liGmSS7ECoXHzSM2a0mRVUE7bEFh","tlshash":"2e22a98534ed58e173fc0dacf463a82699d92b43b81ec4d4f02b6d2d24d7d0862bab75","size":10605,"data":"","first_seen":"2026-10-09T17:19:19.154716Z","last_seen":"2026-10-09T18:33:14.179562Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/WinnerContainerIndex.CM4njSoc.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"35c031de65ddd4b0fe543def1227cc7a","sha1":"6c0a92f115534ab1ac61aa891bbb2b24dc41782f","sha256":"0b3a225397e10b42a80fb5be7a5716e1cbf9bb5c1b086d8ecd04f11f7fe3e107","sha512":"6800dc15475a62d94eeb6c8bbebb63c69a67c8bd5424f1a1ad5a8f42b9315326923c0796d39057c690d9861dbb9758a31360576f7ab7648e70201eebe92bc883","ssdeep":"768:ldlI3ZzFpglrNlfSY3vYTIcxxvbg0iIYOrcAn+4fVRfi+0:lsuExxvvrm","tlshash":"59d2e98276186c3926bb18c9b0245058e905cb1f2795d4f8c8fbbe5151fb6bc61cb77c","size":28587,"data":"","first_seen":"2026-10-09T17:45:44.050741Z","last_seen":"2026-10-09T18:33:14.180602Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"425b414873a4d41a77a9027b74d64926","sha1":"1cdc9df5fa052a568f685ce7716d8b51eb005ba1","sha256":"cecf307ab10d69efb831cefc4fecbe99e75341f8faba88a2518ea8c9840905a4","sha512":"2745d407bbc3cb3d77bb5cbaba5739bb33e48be5e6fc361515dd6dd5629c5841a75d5e51590e9cde213b03a7b70d14c8a08d5ef2fa0b808f2173f45b38c9424e","ssdeep":"","tlshash":"43c08cc4a2d2ae10a61a641012bf39e490348427744d1b439ca8ec893ea70f4d233e9c","size":158,"data":"","first_seen":"2025-03-23T10:10:56.985656Z","last_seen":"2026-10-09T18:33:14.181573Z","times_seen":4399,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"419f309549f27c2c9fc2f8a09073c772","sha1":"765a2150e5aa4c701542d992b80d2a091992b70a","sha256":"17741ba6c9643186973830964df0389ab89a156148dd2eb7890191b31cc7f015","sha512":"ffe34c274d5f7b6acf2e8bb43382d0f0bbe19d13c81727da81985828b2c811ea8af83a1f02fbfaf6093c79a6a33abe958c5b632771527b344a70851582a22584","ssdeep":"","tlshash":"0ec08cc4a0c26d201612651010af25e49024402670481b428c98d8483e220b09233e98","size":136,"data":"","first_seen":"2024-08-08T11:57:45Z","last_seen":"2026-10-09T18:33:14.182622Z","times_seen":131,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"7222387ed69451630a06e99393e5a4a9","sha1":"deb7e5cf7ecd41befe298872746324b1eae78f7a","sha256":"b4ef82824020b24870a33910784661554cabf51bdb086adbeab6e21569227b6a","sha512":"11eca5829e44be64cee9722e3dc1b8ada55bfcb0c758910ed9a34cb24971e50869394e5020a82b059d0d2e01677daa2e1b8cf458276a6275dc36947ab61b9a47","ssdeep":"","tlshash":"94c08cc4b0c26e001a22682450bf24e490344027754c9b429d98da592e230f08237e9c","size":151,"data":"","first_seen":"2025-05-29T18:24:21.16705Z","last_seen":"2026-10-09T18:33:14.183259Z","times_seen":2604,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"064c2d1ca20887e5424f22f7cfe5f24e","sha1":"8b99eee21e5ee93b073caf21a05b43ffd0ec0d13","sha256":"225d38f54bf38b924860ab5b6d9d27c04de52ff1db6a951470b4b4fa7a344587","sha512":"01193875682144cd1ed4ab8d28b79134dd54691dc5135f9f76efacbadecd5c709eb30adc73ed2509b61c6b7350007649da9fedce1035d61fc78c3b4f4937715b","ssdeep":"","tlshash":"98c08cd4a0c22d50260a641465bf35e490244427b04c2b528c94d8483e230f09233e9c","size":144,"data":"","first_seen":"2026-07-01T19:10:07.13443Z","last_seen":"2026-10-09T18:33:14.184176Z","times_seen":26,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/MessagePopupIndex.DWNSSsu2.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"8abc59bd467cadcaebb6f753765bd014","sha1":"6ce8e39dc00021c096b642ce9944d1d87423779a","sha256":"59c2c0a0f87da181d812844d5c56ddd8714d7ef45d386ea8f6fb4c81a43009dc","sha512":"018e8bacd6c4d20e3dda2700ab8483ee97a65b569b2cc3593ceeebd5957560c9f0845bb5d2abc8e00e8fbee59b95a4746833b2496c26860762ab8bbdd3b4b771","ssdeep":"384:WAd7KGPDocSqKSEvteTEY1QMUMFbUb0Lu0cumHPRt4wug+cVYWTcakTqxeUC6a3:WANKGPD91EvpbMUMFbUb0LuJlHPRtn/m","tlshash":"47621a49f31db576b7fe9cd8d071211254283b5e2190e8f034af1a2552e8b6563d733e","size":14978,"data":"","first_seen":"2026-10-09T17:19:19.062437Z","last_seen":"2026-10-09T18:33:14.185008Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/AsyncDragServiceIndex.BVxebsOM.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"fa401511e5bc6867bd3e5dda1c4a731d","sha1":"b9695f3499bd52450c967c8d812481f402c7fa0b","sha256":"d1ca859e8c1b40a4fe502bb582da3deb188d5d7e77f7e37a4aac096b33235ec0","sha512":"f22f01012385a08ec1cd91d3e4cd494b11e939b29d9eaec66cabfa064365bea4eaa388b1232daaa6563abdff8c95cc0542ee023c2315190bfefc395216058f44","ssdeep":"","tlshash":"a05145c650a63df0b5d90c94dda650624a99339b4106d0dcf2ef2e3592d2464971fff1","size":2550,"data":"","first_seen":"2026-10-09T17:45:43.91291Z","last_seen":"2026-10-09T18:33:14.185845Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"5acbe8ff03b35d066ed227294e179d65","sha1":"47aa97fb9cdcbd839924491885b46abf364132bf","sha256":"8dbae94755c823acc69a1bef2232b3cf59506cff7d166dfe979545313d367d2c","sha512":"1b43ae8b3f912c941d0a4a2141b7e9ee94638167cc076b9103de811ca88c53a5553683e3c1566cc0ff6d83c407fe693292634624a1c634f7ad93ab569fe21025","ssdeep":"","tlshash":"2ac08cc4b1d32d101a02685414af25e490248026b0486b02cc94d8482e220b89333e9c","size":143,"data":"","first_seen":"2023-06-07T15:49:18Z","last_seen":"2026-10-09T18:33:14.186736Z","times_seen":4438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"dad870c0e72000ea0c41e565b8ad84ad","sha1":"bf8f2f1c8668972422ad7124c10a6a8eee851206","sha256":"365296989dea408baeebb41916ae220b91ce8567c1123541fe9fed361b4621af","sha512":"2b9438dbfbe1f041dfdb93e8e391193a1bcf74c1f7963a38f178a6945653e15fc593ad76206e764ea8798fcd8af9b9033d184ef3876ae8880089718192599cad","ssdeep":"","tlshash":"36c08cd4e0c36d00161aa81028af24e4a0248026b0482f028d98ec482e220f09233ea8","size":146,"data":"","first_seen":"2025-03-09T03:44:28.265401Z","last_seen":"2026-10-09T18:33:14.187816Z","times_seen":3962,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/AsideIndex.CcjgmB2M.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"a3e53891776ddbffc2545723d6f037c0","sha1":"8c783c5b9458fa6ce87ee19761e799382ed02d3b","sha256":"0cc475f0a187b20a1e50c19dda9b042f00a5d41ede9297768921b2f294eb9ec4","sha512":"1178f0639f854369a9f49effb79cb93a37cbd60c9b6fa216f4379cf7a9dba59f9d696482d50592f2bf7983ebd398336811dfd5abb96907ff1a592d1a8463d731","ssdeep":"96:RbigjWPZ9TK/3yEpX/oXjOLsnprwXdcPPPYBxMz/xMYOJfhPtP0qOT/tKzKHhnhW:ReSWK/3pd/oXjNnQknnWfa/AexU","tlshash":"6ce1c772900576bee83735fdb0813d3043689bc4da40861251fa6b2d4bacdebfa4c45e","size":7040,"data":"","first_seen":"2026-10-09T17:19:19.155887Z","last_seen":"2026-10-09T18:33:13.968585Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/FastEntryIndex.DS15tXqv.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"fd53b9d03f05bdf20c3f9df7e041245c","sha1":"53ffb704198c48f44190398f8412c2f57225fc23","sha256":"b4602feeecfed11f99fe8494bbc9181c0038de5f68ec94c353f3155b6eb5a9ff","sha512":"b86238b570c05f424bfd4fb75e7f48ee52fd8c3d377601a9cff8cca27a9e5292cee765646d7da7dca5ca33d299ab37a7fbff1f919258f66e6a01fbbcd7b9bc11","ssdeep":"384:u7WfmZiGQWzZJDoSBLeRtk2Jl0ukBQ+dP5R6ce4kc8HRFaJRFhVIO2enwFmmiEDC:u7Wfm0IDoSstk2r0ukBQ+dP5Ace5cQFG","tlshash":"5272ea8db4b92426fbb9ecdce0799563582c2fc65440e0f0f4af6ea11179db072d8716","size":16867,"data":"","first_seen":"2026-10-09T17:22:28.40032Z","last_seen":"2026-10-09T18:33:14.188853Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/locales/vi.DAxNX6cn.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"eadf3fd1e5d64ccbf8461e713afd56ed","sha1":"3f9a9eb784644848c41ce0e0c2cb0432f9182e51","sha256":"0c6714e651627fdb655f27af31b0b0f3fa1db93c1eadf8f944ae9aa9ea3336cd","sha512":"eae233da40e69e9ae72d36760e995c08321a6b23f938d041229587d91e4fdf5ac52089cddf9e5d060df296d93489d0062d162ab0e12a53ab3050c82ee73ab47f","ssdeep":"12288:xXkZ6h/ZLasGdjJS4gZ6tu34AGKNA8ZMrAoDh874lSFHwYJMUqtvJuOno7rUyq1G:xXk/jMf34ApZMD874lSFH4/Pno7rUyqs","tlshash":"78f4ea0112a4302a857d461ee1eda84d5fde786ff380cfe82aec05b55a46db17e2178f","size":779239,"data":"","first_seen":"2026-10-09T17:19:18.948631Z","last_seen":"2026-10-09T18:33:14.073419Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_EmbeddedGameChunk.C45ma66o.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"568ad1d3bacfe74d86763c86e28d7a15","sha1":"de68009fe25665c2cd51ead7572f71de822d20e7","sha256":"7d83a116caf217b21b7d7b4f571afbc1807adbdc995923b479719b9cd360f77a","sha512":"96ca65bcb5394d1654e1ca3296ba6c38731c912a69e6faf9b3292d6102bd3596bfa327cf06e2f5b21fc45015dcf1eba19aeba13f876cb4313bbee20482f101e2","ssdeep":"1536:lafZeOg6Oln3APQqV7/IRfzeEAPHDmFY7dgF1VKp4cE:lafZeOQOi7eHHDmFXVKpJE","tlshash":"a2532b8db7b916b872a60c4ca4671d5256542b03fd08d0faf67f8eaf13d5500a2bdb38","size":60917,"data":"","first_seen":"2026-10-09T17:19:18.889008Z","last_seen":"2026-10-09T18:33:14.056604Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/useOpenRedPackDetail.CT0KBE1u.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"3a1ed7f0ba5f539d01dc90ed83e26194","sha1":"b3b2891d5d6d4a8f0c292e7d318e52d89db289b2","sha256":"5e739ec7d6afd7f18fcaa142b7e314f92030e03da6edf95837db349b105a79b2","sha512":"9fe14ca8a77aa4790fe4af323d828a23584772cb9a94a79a5d0ce1a6d7708d08648d7f7cfee64d113f609ff7f388cbe42ca4e4254f7fa1be4d40e550fee71da7","ssdeep":"","tlshash":"2b21560aa07f653472dd00acc1add432a14c55c5260854d2b7ef2e263b1e4c3b43fb1e","size":1330,"data":"","first_seen":"2026-10-09T17:19:19.143967Z","last_seen":"2026-10-09T18:33:14.189829Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/ForceSaveFindUsIndex.DZga-eJY.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"9e616f0029b800edb70feeb116e268af","sha1":"4f69741ec584783b5e66fa1bda2d04ce8abc287e","sha256":"b6dca1f320f0015702a70974dea31951841af251f2549699b7891b6aca4c6a0e","sha512":"378b5a8e49a9400fe526a1d0b7cc1536f558be2c11d5f3feb8642ce4112d23af8eb24abed53b1c5a152da4762a574c8e3466936db3858e158c7c51ad4686a63a","ssdeep":"","tlshash":"e11132cbd8417cd2f8c28df8c594e82102aa12c3038193b191ef736683aa039ee1d603","size":920,"data":"","first_seen":"2026-10-09T17:45:43.880676Z","last_seen":"2026-10-09T18:33:14.19176Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/surprise.C2KIsymD.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"3e3c7305e6f0bc8428b592b611838c0b","sha1":"74cc501e71a9349873eea322152da5202ed0b4c3","sha256":"36a0079476f4d28eb8bdd7da83f7fc5b85cfb96314a9d72bbc6e577066d70346","sha512":"c6f9ad1684893f3a957eb59544de43c4d8663895ea9a3105efbb3255fad94d068634681d49321b6b56f41c71253cd716dc40ab963778e958f4ee27509b91fa4a","ssdeep":"","tlshash":"d921e34037d8607292d14ff789e87522501cf6823a870598d1fb1c85aa1eeecf05ddbd","size":1349,"data":"","first_seen":"2026-10-09T17:45:44.141452Z","last_seen":"2026-10-09T18:33:14.193058Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"0e13459ea0f3edc7daa4639b51942689","sha1":"e0026dc739ac5d9eb8d68245f2069c0c3d471d55","sha256":"d15f6d7f313bbed1fece0bd5a18ccf4446c8ccc70abaf6a6f09e46b068b82312","sha512":"10f0e4145c03c7b6e7529e391976c5d54dfa8a7a2a733e1392de7dd46f4e208adcfa2d990ca157c6875d1e36b6c4af3df59be7f0a89499823fd7875d07797665","ssdeep":"","tlshash":"fec08cd4a0c33d102a02641020bf24e4a024402b74482b038c94d8493e220f182b3e98","size":142,"data":"","first_seen":"2025-03-19T06:50:21.459017Z","last_seen":"2026-10-09T18:33:14.19386Z","times_seen":3645,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/2_EventDialogsChunk.CHUBS5yU.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"e578065ac202df1228ab7fa20bfa2a7d","sha1":"251ddbe8ac425adc42a79c35df3b7f3d6083feaf","sha256":"1cb0dc8dd5cc44e83d7dec0fe2d306b8087b7087584da88535e77739bd18c014","sha512":"0fe8859c62b01c22b89b95233f29bfebc907e8ac93b0c317009bd00bcfd804cddd13eea43afe17369a5537d915dcb930d13683a58c0d8346683e4d074fb1eeb7","ssdeep":"6144:lr+jdQ7aFDIzC42/hEYjyVINemJ26PGcLQnYiQu/FUE8i+bDw:bzC4qj8IrPVjE8iCDw","tlshash":"30440a49b06aa5b5bbbd685ce1a9089175682fc7c450d4e4b0ff4f342749e24b3f833a","size":267886,"data":"","first_seen":"2026-10-09T17:19:18.990551Z","last_seen":"2026-10-09T18:33:14.195695Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_RechargeDialogsChunk.CIJyYGkW.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"0c60245e0c4d2071425cf5bb546d4339","sha1":"4e6f8e4d61b1d126470c2836f6a5bcd2665ccf78","sha256":"c92bac403a27f356edbaef09b540eef01760cb3d2be3f311d9deb370022455f9","sha512":"b59009d49e18aa012a4cb66be0151ebcdd756c6efcd2c1fa49d95bfa66b5febbc7463f038ec4c7e69f08da863338aba7bdb5cbe1106eaff2d18e3e0825e1b595","ssdeep":"768:quvEvnXjhN7ZNfOxeW8GVfJUQ1AsK8C92T1mSlgi7FxphrGV+wYMZWT6fTiV3/C9:qIEbhPFsB1r1puSLa0MSPSQuf3wc","tlshash":"c893a64d7c7998bc7abda42450b90c66a64d7f5f8003c8e1a1fe8e603768b34f598778","size":93634,"data":"","first_seen":"2026-10-09T17:19:19.16586Z","last_seen":"2026-10-09T18:33:14.197784Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/ForceChangePasswordIndex.DMOKti32.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"e933e8663ed65114776489de3db7729a","sha1":"0f8fd7e7907de28a18fd683a86224cd19c941b88","sha256":"b622e5d479df5de09f4c846cc08a4e39e8fb00437adb0689cad749b98ee44660","sha512":"3aceec3df38c486e3cbda733a8d6afe8d5a1ffad46ba9b8083890d3d98a3242e525989c9f270be5e62ebb7b33c868be19075c12c44aa8981d9a49d02eb961193","ssdeep":"","tlshash":"2b5166da613ceeff16a54df0114634452004cbda43a14aa296ffcf6837e6da27e08727","size":2463,"data":"","first_seen":"2026-10-09T17:19:19.12205Z","last_seen":"2026-10-09T18:33:14.19863Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/FindUsIndex.C4KMbJum.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"3016a38d029b7f0cc1b810e124f9c76e","sha1":"ef0fa51807a73b0999baf43a1f6714dc6a4f2f68","sha256":"1e5d35c3def09cfca9ccf51a71d777622c24502cddd70bb24e13532844b59b7a","sha512":"b2d2c9c4fdea26abb4ba4916add77e072be27223cdd1a5b2994c2f4f2000443a083a93e28de1188e26552abb3a49bf9d800518789c042c491333a9a2181019af","ssdeep":"192:r9WtfV9TersMQADLA5QWVPaNx20vCtl6T3+TYD3QXtqsFcN7VUfzQ2OvEVgi/bDz:rQfVJ1MrnAWWVOx2fWD3QIThVGJQCcry","tlshash":"ff32e749b0586678fbb40ccce0a67811b2146f825b81c5e0d1ff7e7857a9968f71a33e","size":11085,"data":"","first_seen":"2026-10-09T17:45:43.967983Z","last_seen":"2026-10-09T18:33:14.199225Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eventHandler","is_inline":false,"md5":"d313558795d5a89ada9c73c4e7c6d37d","sha1":"c66fa2f3b1a23d8b43d20357d6e391dfc18f492a","sha256":"baafb89d4a9938d8004739b2da4475c3d102f907a283f4b2774f752f24fcbce9","sha512":"59da58616df3c9a81a0ba26355f8013f90a9ef32a3620dffeb4fe040f348f89aae6cca2178cb4b5226058d353507fa8959e7378a471739c7de147b7644fe03ac","ssdeep":"","tlshash":"cb80000c0820c88822202f80a000c203a2ce200b0a2022aca82b28e0a23c888e08fca0","size":38,"data":"","first_seen":"2023-04-17T00:16:30Z","last_seen":"2026-10-09T20:32:19.342851Z","times_seen":26947,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/GlobalEventListenerIndex.BYsJMIjY.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"48a6983cfa2bea9a9a3b42459eba7f1f","sha1":"70ad4b16859b9bd21d7226cb052fd766a95ad50b","sha256":"91f9e876b1e94d247be7f5a842ae2102cabe31426c8b812f5caa2c417c48152c","sha512":"1162b9549964006422413c6967502c65c9dba26f35fc0e122cbadce22f9e8579a9dee27b3166f38e2e9e060dc79b38ebecea71487507fd68b20558a3b4a4034c","ssdeep":"192:lUCCdxhTlc8c0ipXDpLBzVMuq+Av0N8Zy83pRR7Rs+D5hdSuq5o7lk9kPZSkWM:lrCdXT+8c0ihJJlq+Av0N8I83pRR7i+Z","tlshash":"ab02c88952797bfc78e52dc8e9a35093061567d72502c3e8f07f2d15628d8018f79ef6","size":8289,"data":"","first_seen":"2026-10-09T17:19:18.854711Z","last_seen":"2026-10-09T18:33:14.021983Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_PromoteChunk.VT1akud3.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"208e674227d624f5af9ca758e6f3e9d1","sha1":"f50a556c6414370ada4863d273ae575d74e25b7d","sha256":"1a578291bdfe86d6aed2f1806c6c270d53cacc2086f09b053088929c84e1e322","sha512":"b82882a75e06b6b9fb8fedab5e3ef119ff103abc00dd238c3c1dfc132f1dea54b40ec110d9768d2c081857b839b71d97857c64d01e983ad80ef704bff33f69f6","ssdeep":"6144:lrEmjIiGLURJQxiyheJg4Fb6chZwveNabCKbvVt+FC2IJfiYZdMuGUO:uGQsj1TAxiMGUO","tlshash":"9784e78df469d474f63ead18a0b50851a31c7b8e9014c4e861fe4f2067d6fb8b69933e","size":405923,"data":"","first_seen":"2026-10-09T17:19:19.103906Z","last_seen":"2026-10-09T18:33:14.076428Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/enum.BEBvq45N.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"9e5fd4e2077f002ba595bbe65f0e604a","sha1":"02ee8dadf067cf816f7c206ba108c55464793afa","sha256":"b9cdda410ad2794f8418a8345b09e83067ae6858504f705bf69227ddd27c6af4","sha512":"c5dba3429024a02d111a350f6beb19e2f1bda37184acd564f9f6b0036e5f2580cfd66a745b1542045643c7e823138559aef88c39f6033e84c6678ef862486b7c","ssdeep":"","tlshash":"43c08c0200b13d317b2c319c15062c8e23a34a30abb121c0430e20bd0008cc262c212a","size":154,"data":"","first_seen":"2026-08-26T23:18:36.963784Z","last_seen":"2026-10-09T19:17:20.850562Z","times_seen":185,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/2_ReportChunk.nCxsN4X6.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"7dfab84b36d38c88eb46190dbe15dab6","sha1":"282e5094607c6c584b9cd38aa0a9112afddf0477","sha256":"21a73ecaf0fb182fba17b34c4614b483c0de27b9c9cc525ced03c27092085ac5","sha512":"b03dcf8a3b4cc5d1b71140f5805e189d21921963f1d241173de1913a5f5e44cf18e2b7a55a79062d700565a39290a3e992e5e0d4a9e6f4e459805ee0f66d6103","ssdeep":"1536:vNpXmMAUK0Obzn/9+ObZndkMCjqdj6Cs2VR3nc5:FpXmMBOdNx6CbVe5","tlshash":"86633a8cb07cf5b8b77f9585a0aa059062182b51d001c8e960ffcf553b5eea9b6c873d","size":70409,"data":"","first_seen":"2026-10-09T17:19:19.04593Z","last_seen":"2026-10-09T18:33:14.201209Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/Devtools.ClmI0gdC.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"1ec9e7fa379e5f4e120dc793a502e32f","sha1":"5d53446c56b0c816496dbae7ef45ee206c8de888","sha256":"7f905a6ae181a8a67d49ede8c1c67d027dcd940cdfd2f0e72bfe1ad58e948231","sha512":"d82bdd461eb63e68706b7bb83bfc4f54e3bc26cb0e22bda06a9d03c3648cefb7a907686b5f8d6ceed351adfc6ed30ff2b5b622aa0699bf0ca64805dfa50c764b","ssdeep":"","tlshash":"15f0024ff063f2b098958096d344981421dd4fcb5304809155de9c13365d545e63fa9b","size":624,"data":"","first_seen":"2026-10-09T17:19:19.059473Z","last_seen":"2026-10-09T18:33:14.202163Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/EventSubPageChunk.BvhtCx_q.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"d531a76e3bc4b408f2dd0c738a037792","sha1":"fe6233fd44337e12f950b0be2c4429608ddd7a20","sha256":"49f0493bb4ae874c84de807454b88a141bb6861af8eb96e4e1745cc1abd877fd","sha512":"cadd58fb25203bf1d6b46b98ef7bff14cb0f3fec91ad2cb407d27a37362212dfa59ccaab49faed056ec4672805dd103188a0d590f3a71582b360e976d09ed57f","ssdeep":"3072:lrDvV8crO/dzbU6u1IfQO8MW1HlkZHvspVwEcXaONLBeuv5mnIGunm9:lrDN8crO/pbU6u1IfQO8M0H+vsgqMLBQ","tlshash":"d7040949b07ea1b8f77d586ce0ba19626a283f879400c4e0f1bf4f642789e74b65473d","size":174871,"data":"","first_seen":"2026-10-09T17:45:43.864823Z","last_seen":"2026-10-09T18:33:14.202986Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"a39b5ff589ae67a49f0f4bbea75fa0ea","sha1":"0f45ec9451ac9f73f27f52e89128f3b2b374db12","sha256":"46a0fa78a104a1c19b1d3e1c4f6235ad61d83af59abffece54765565ca01e6f8","sha512":"d71db39910f77555c1ff7a0e7daf2feafe3c62ca6b648f37f11563e3fff8eff43736e952c083854d7287b4c91803344f5e3cedbdb039c2d44ef40142bd5c3b6d","ssdeep":"","tlshash":"03c08cc4a0c26d102612a41010af34e4a024402a70481b128c98e8492e230b08233ea8","size":136,"data":"","first_seen":"2023-07-14T08:52:04Z","last_seen":"2026-10-09T18:33:14.203868Z","times_seen":5330,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/websocket.impl.DrPzdGis.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"dc0378d79c09cd7d4d6368f587c75a60","sha1":"afef52e0c7e6f2d11b15988dd660fa03db373b0e","sha256":"008b7836205c099c3ea1fcc9add3e36dd4bd37033321b620dcc3be4067fbf4b5","sha512":"39e2a0b0e01e71eb51830475cc8fcb474e2addeb8b5514517a53d8a4c9ee863aefc134dd3ee680979cd211d7be52d205c328569af44dfdba611c1cde9a9dcf8d","ssdeep":"192:8HAZhl705K992sieCcXknNgoji6+YzWWq2LgFZWjvXq:8gvlA5afihIwNdji6TzWWq2LgFZUa","tlshash":"5002329457568a3b62fac267b2342613632427510704c38cb26c9fee8b2ed817d74bf6","size":8577,"data":"","first_seen":"2026-10-09T17:19:19.178027Z","last_seen":"2026-10-09T18:33:13.950012Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/props.BALfofGW.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"92c34b490e6151d6858e74c4dd152438","sha1":"b27b625230344edad480d26e3ee157f170be46bc","sha256":"9b8c67e363d74a0d486d311aa34513cb60fb1b24f42d4034e2e0e1459fcd5174","sha512":"d4f4fe9a00100aa75ad03ab04ee020c1e20a9b7ef5d8de4df2270c7778faab2564356a22709db843854a191b701436fcb35d44a98b05dd0c2a03790effa2697c","ssdeep":"","tlshash":"25f0af2b784de6539fd78d3a60651b894908ce5de8243ae0ab973579478bceca60d310","size":607,"data":"","first_seen":"2026-08-23T14:57:34.897016Z","last_seen":"2026-10-09T18:33:14.060946Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/EventSignIndex.DCEpyNE9.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"cb6531fd4a1b4cd070020d1fe0e924e1","sha1":"09857f4e67f09def56d812561bad7b8da9d80f6b","sha256":"c6afde06191a53804da1c97124a4d98eaa3289ff32e3fc93e1318e56710eaf0a","sha512":"661ca1af4af24306d42c7750cd7e667f11e680d2942079b75252c61b29dbafc7e0a09a28665c04616b26558709af990d8f9dbc66210b1cd5be2aa516262d55ec","ssdeep":"192:LX1nKI0rkDpHFhWwaqbJWhMC6bSuHuw3pds:LxKI04Dpn/aqMhrmU","tlshash":"f6d1c689f0a66870bbbf5994c114c4a226595fca41e5c4c8b0ffae441789fb8939821f","size":6599,"data":"","first_seen":"2026-10-09T17:19:19.064762Z","last_seen":"2026-10-09T18:33:14.204717Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/toast.impl.B0tPkYzg.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"1d7f8ec03569bc7a23b8632b6719dfa5","sha1":"029fa52b505b445546b9ebd16750ce7d0e4d0dd4","sha256":"d4526b6152635c6d4ed98ad817aef43f301a1c8c4a71e9c59812f4cbf9de987e","sha512":"6a472cc217d0ad3e8321c921a920138f44b9d62061e7e6e4be2ad65f0782c148ed4d4d72dc847b01d76300708ed1c37e35db9a45032c9fec30d09126c411e4ec","ssdeep":"96:qmXTv76jWADyBnYHnkX2aV7aDA9RPHdjgXQRkyMrJ65a6ACNpbyw9gxMbD4nXXzK:rL7opaYHe4Az9gXQ4A5JXNw24XX0vrqA","tlshash":"4cc1e9c6f044b5fdb9975ce8c0735400236c1f8afa94e591e1ff5b2a5366142ab8ef18","size":5642,"data":"","first_seen":"2026-10-09T17:19:18.992871Z","last_seen":"2026-10-09T18:33:14.205491Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"accounts.google.com/gsi/client","fqdn":"accounts.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"172.253.148.84","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"0866f65ee4b7b6345ada47b47955c555","sha1":"c09f6fd344f9d2f088ba86f389ba740134edb0ee","sha256":"0084e0d896335f4b1b5273ce9713a21a318df32fd22f0b4c9dbdb6257c1f1656","sha512":"5837d9e281efe95da0eada1b418fd6fb18c448bf290735ac14ab82ec8783e1ef589dbf137f2000c8f516d759aa5c733b56fbdcea933f9317ad2437ecaca9c6b5","ssdeep":"6144:VDxV7hxy5msIJQhS/0Cr3fwnZqeFMFaCzFBG5BU:VDpssr/0CrPsscMFaCzFBG/U","tlshash":"65444bdcb6e270359222f8b5c43f410ab076a679f4498cacfa94c5f5acb0d890167f79","size":275137,"data":"","first_seen":"2026-10-08T09:17:23.759675Z","last_seen":"2026-10-09T20:34:35.234598Z","times_seen":219,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/WinnerIndex.4rA_i6vJ.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"99278e3e5f2f4de4096aa5c7ddd9eb0d","sha1":"21827c5890e89b9400e858baa661fab46a602ef4","sha256":"edaf4cf40e523e21b0a4fd3926ab3d62f98401c3dc0e3412b6d4f7957bc371e0","sha512":"51ee55e6b3bdc919c73b6a976e30f9a1696094eda4cb69a2dc62fd65bdd856ffc1ae03760b1a18e02e75c3a1e713b2e30239c3880fd813e5edd4e284ed42929f","ssdeep":"384:y0JSV4VKfFZZg9icKNIUhZYiGwRnJQKMG7CNyP+1g9itUaNM:yMSVZfrm9ipIUvPGSQ1YCQPN9iu","tlshash":"ee723243a6187c3a617a0c8ab010149c7556c71f5f92d4f8c8efbc25b1a65bc729b7bc","size":17062,"data":"","first_seen":"2026-10-09T17:45:43.908741Z","last_seen":"2026-10-09T18:33:14.206379Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/index.DA9GMHKq.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"014181943da3ca77be2e48eeed50c8e2","sha1":"5d68b295874874e9b430e1512d7f279363bee07d","sha256":"6231bb7634726c6cfe599093e8b918a809fbab6bbd5fa70ad612deea26d63b5b","sha512":"8280b7bd422e89a37809aefc1c380c8a10e55d748830c361eaa44a4c34abb9a47b044bff46a1812302f6885ae12f6e9053633625624f9b6844849da4d00b8428","ssdeep":"192:L26q2KYUNw3NJRLzDVWS+AKGxK34+f5M21Nrhf0MgADxYYd:L26q2zUNANfHVQ6c34CC2rrhf0MgADxJ","tlshash":"d7d10989d0b5b07638f98dcde0b413625020b8547982c8f061f76f6ab247286e3bfb5d","size":6394,"data":"","first_seen":"2026-10-09T17:19:19.087643Z","last_seen":"2026-10-09T18:33:13.922445Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"d08718636bf337d5b2069391e7aa98cd","sha1":"d72b9956ab2f5b3b1e63765704b1379bcaf95650","sha256":"3a10becfcd857467ae4fc91737c40d63e355e9f9590e4f96e817e5bd703a68bc","sha512":"c9ee312c923edf6deea987b91bdd437592128532de9fe6633d38e9a12f5d1075cb9ac65d08b9a4da0275e2aa1b7665c11c7dccd3202fd7d00e1643b93e363f52","ssdeep":"","tlshash":"f1c08cc5b0c26d105a16651410af24e490344026708c1b169c98d8482e230b0823be98","size":144,"data":"","first_seen":"2026-05-24T03:10:25.085445Z","last_seen":"2026-10-09T18:33:14.206983Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"5dc6dee46f3ec762349f213bc9829784","sha1":"905a7e60d59ddbb35cc7dd810a073e01dc1ca9cc","sha256":"cd29fd6000bc372f4593bbb7ad5c32a85888c60444a28417bcdf915980220288","sha512":"0a1ca8205ad8480614adcc099ef53ec239d32f4ebe1a00544bbd61d7f6e9201c6a2106a92f2958bbbcb8e33b0f69a6a44c308bfce0a9419c48a3993f88ba27ac","ssdeep":"","tlshash":"e9c08cc5a0c2ae001a16a92051ff34e49034883ab2485b539de8ee5d3e220f48233ed8","size":159,"data":"","first_seen":"2025-11-11T21:06:39.220309Z","last_seen":"2026-10-09T18:33:14.209019Z","times_seen":153,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/0_RechargeCommonChunk.Dq048yTz.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"f9bbee0b9fb36767f5c4a6a6cfe28345","sha1":"96c071e8962d651b685b32642c3d07489353bf01","sha256":"928c5cd572a77499d103cc569b83fc40b63b1c28846732362528b26ea9e07de2","sha512":"38f24c0f2dfcd93d3e56130f0181050b5f08da5d6ebea1d515161c8184e89d40eada2e18e0e84ff96b7480df6da2b459f48a6ab33744488ade2dbe97e1b87ba9","ssdeep":"6144:lBbQalcai0+sWFaXJm9EcGlu7VOUNcZt5v9bpKVtnP/n2so3bopxLFhuTxL+:Nlcai0+sWFaXJRciu7VRcZt5v9bpKVt7","tlshash":"1934d78cf4bd616576745c8890fb05b70248bb82b401d4f4b1bf4f6673aab41e2e5b3a","size":233700,"data":"","first_seen":"2026-10-09T17:19:18.908711Z","last_seen":"2026-10-09T18:33:13.778954Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/SettingTipsIndex.B43tZR-Y.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"2259f4cafbda906a52116648877e07c8","sha1":"22e99969ba6a19d16a5bbe7294b7eb9f8d5cbc7e","sha256":"626966a7f5f9298f39816cfb9301ed1d9a19765a6f623bc8e5b62ed16d8b2ab7","sha512":"47380568d20217523d1af2a54ec02032b2303164feb010f577cc611b04ae233c7c0c9ba41cfda1bfd80dd9c3c2d42f3468034d91a519a535adbd6a05b3729e43","ssdeep":"","tlshash":"9b416669e3c4a6f4d6ee8b44c32c75153c1801e6b515cadec2e638f8834e4ed3c24886","size":1893,"data":"","first_seen":"2026-10-09T17:45:44.071753Z","last_seen":"2026-10-09T18:33:14.210729Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/vendorChunk.DPuxujPK.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"35bfe8e2c8962b1b2266e75ccef87240","sha1":"22fce2635b65d33f39be2618da2c5ebb32fd8632","sha256":"cfe26b2f4ff209464c919e8fa7ac5750a69d224d50c8ce57ae248bffddbaa7be","sha512":"30e2a89825912f21c1c0a544e5081578cda489cf6f8e4f648ff44bd2c29d31caee857f931c231b25c13bfce9d74d3b23264b57121175041da733250907672ea2","ssdeep":"3072:Hum+HqCBgtMfZ6keiFbcRwoShyqoTu4O2SwJ5HplAqB:9+9gMfZ6keGcLCIu4O21J5JlAqB","tlshash":"03242add71e6f06143f764a1807f100bf23a6d54a88d9094f2a9d4ea3c7498a52bbf3d","size":225525,"data":"","first_seen":"2026-10-09T17:19:18.783666Z","last_seen":"2026-10-09T18:33:13.941399Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/vendors/vendor-stable.DEnvQj4j.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a85cc350db19948b83611bb91fc0caa7","sha1":"0d92e9935dd7ffc640a0d44eb20150014b8dc2fd","sha256":"b6585208cc1e1a50a19923def5d91558fe7462abd3dbf6af80b6b3adc4799d4b","sha512":"b6ba8970c7003a17b5a79b56fb68701bcf93468d2f3621ccd83a7d3f3b9365f638965365db01bd4928ce9293c64a30f72687cd2c1d54e255bd089033b0c14415","ssdeep":"6144:qCnwtLgNQ1gC4IZn9LDyIJfXyUZm9SesUR4rdfM8uqpy+Bc:PoLKQeC4IZ9HVU9SeslrVAqg+Bc","tlshash":"797406d932d6b02243b659f5507b0006f33d2925b84dd498f1ade8da3d7680a82bbf7d","size":344988,"data":"","first_seen":"2026-10-09T17:19:18.780869Z","last_seen":"2026-10-09T18:33:14.072017Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"bfb805bb584281411df14653a1deb500","sha1":"d0131a157ea289290c3a78d8be4be5be56f04541","sha256":"c40310197b9e317ea6cad5480308b32e8e86e06a3b2855c6ac069837395b8e75","sha512":"31a1885dfc7d35ad80b93f9db5f0913e0f33df6ecf00f60b2ec9984987ff55c882f7c6b07a582e538b6a46b8de740e755f3be9a5e0746029f5ee4d021fd09c62","ssdeep":"","tlshash":"1bc08cc4a1c63d006a02641420af25f8a025506b70482b129d94d8883e630f08237e98","size":144,"data":"","first_seen":"2025-06-04T18:26:18.235015Z","last_seen":"2026-10-09T18:33:14.213429Z","times_seen":42,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"9c6cbed4488180bbabe84c1a048960c5","sha1":"364cc8387cdce7e56959836dddcb3012e019bd66","sha256":"dbdac16e55d845984b3bbc17a3db4a8a54cc82f602cdf80cd07f2fb73c3a5685","sha512":"cb662b90c54a2afabbc3ae2435842ec770828f450c9751462defd2ccf407eeb94b5f6c9583af02fe4883ba36ec8a53d7f890d6f19915e01260db735afa29eff7","ssdeep":"","tlshash":"fbc080c461d76e001511a974547f25f49034442775485756dd94d9592d330f84137ead","size":162,"data":"","first_seen":"2026-04-17T06:27:03.100101Z","last_seen":"2026-10-09T18:33:14.215164Z","times_seen":109,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"34509914889737631a8c5d85a5fedb14","sha1":"a737d2a4a3c467edf05a291d504bd9bef93150a7","sha256":"32727233ec4e9ec1cad0032bc42a2a7fabd74e312cbc7e6cf28617915c45bb82","sha512":"55ca44fd790d364411a99dcab0afe3ab0b195e95c8ab4d3a35903112c0979b024f0f045c9f3cb3049abaddca6b9ee68a9fcf21b5414ecac3ada03b141f0b7b2d","ssdeep":"","tlshash":"f8c08cc4a0d67d001612652550af24f4a024406774482b028c94d8483e220f18233e98","size":143,"data":"","first_seen":"2025-06-04T19:22:44.094625Z","last_seen":"2026-10-09T18:33:14.220668Z","times_seen":131,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/festival-ui-group.DIvylWvC.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"0c9d4beade2aa1c54b14b08aacbef53a","sha1":"61ff5d9069aa11d8f8f5419700b8d2fda5dfe747","sha256":"fe05be9fb5f12ce448924ba7be291ea34afe1d20c91ff6c4fbfd3b50bfca42ea","sha512":"4c9cfa405497361ed1fd9db4d04344025d8d0272c8a2325dd8b0f971db4258d6ae4475c7290e70862ca11b2144cbb93f4193c9710d1cbff8cf5337df4ea0ad30","ssdeep":"192:Zh882fRHkTbIO8X6NVhFlkxAPh3oyoLavf1LTl:Zh882fRHabIO8XEVhw6P7","tlshash":"5512988f50983430d66f2d97803a8092585edb5ac311e946f3f2fea876c2e695f91633","size":9505,"data":"","first_seen":"2026-10-09T17:19:19.160508Z","last_seen":"2026-10-09T18:33:14.01059Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/MenuList.Bsrkl6q1.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"0f764b91ef8d7586de6d7b76cec91a3e","sha1":"18c17bf86aacee75229d2ef8b42bd3d9d535b57d","sha256":"ce5d77298156b4593f1d81dcc73e0c9bc76fedb7171c321c204d54b29a58b736","sha512":"616cf698a13aef27c1f2376871a87a84dd7f50eca9a0abc57ff50b5ebc3a193846ea20ac727a28c7880d877395c8833b6450538235ad11b97603464364c9ab62","ssdeep":"96:6otGlZlZiON+9yRzJP9wxnWp46nDvOPrZKCuCcAX+Qbu3cTHxi6oHuV:JUlbY+RzTMnSRGZoy1THxX","tlshash":"8d9175d4891cd03e32bbf8c7d856c002a248b5a5de01e96462fabb79c6147dc63b1b2d","size":4551,"data":"","first_seen":"2026-10-09T17:19:19.127875Z","last_seen":"2026-10-09T18:33:13.974775Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_ClubRebateChunk.BoVNrNqr.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"8daec3a3c09b9369ddaf4224cce58dff","sha1":"ff17730d4c1a2361ea8bd2c4197d446cc4f9b043","sha256":"718ec9caa270512cdebec013cbe88ded64f5604e6ba0105dab636a4e91c470e4","sha512":"771524ab53a442dda9d75e448a12f94a6f30475763408158c08bf94218f6adcb29d7b4920b923fd0652f43ef20f75ac83da9d64f646bf5a38f3494bab949b5a9","ssdeep":"1536:Vyj8aPVyWtduxMfuz1uywA5sw04d0rXpcuQAtLckR:Vyoaq1w4dAXyuNtckR","tlshash":"6c43e8cd747ae5b9fa799da8a0784d50611d1b4e400550f9a0fe8e213748ff8b26cb3e","size":58592,"data":"","first_seen":"2026-10-09T17:19:18.950734Z","last_seen":"2026-10-09T18:33:14.04626Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"cbfeddabc132efb0b31f6349529c7b19","sha1":"45de105ba218c0b1fbb8f9ed04ad4b187712b376","sha256":"b3d2e4c40f37a1df2625c4c2bace4e8e85ebfff0a329e48efba018901f3d25dd","sha512":"a4b75be97c6c33ddde7a3b6db5526f3edf106444e7bd1fb821941008412f54f03007844d38938384936eba6c3c71f8dd307ead78556861e244713ad8df480268","ssdeep":"","tlshash":"61c08cc4a0c22d001602a45018ff34e4a024402ab4486b828dd4d8583e230b08237e9c","size":143,"data":"","first_seen":"2025-03-19T06:50:21.428342Z","last_seen":"2026-10-09T18:33:14.222282Z","times_seen":121,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/utils.nieanS-i.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"dfd674e356c05cceb72b9543f0593fd2","sha1":"ca51a3f6323b9f44a4db83234629db4926712174","sha256":"1c6ee8c39d555c3f110736ad2e1cd5d29ae404a7de3a251c0ffb70a2d9ad985f","sha512":"e5384b27eb7cc2bcd5f3596c4cdbabfa8d32717e7e0f0fe8e4908a164696e1c70261e149447c52b8339980fba5f55dad6460ba3299958c6e0a78925e539caa96","ssdeep":"192:377f6+759H17HBMoNlfAfMmb0yDRkz/9+kXyfE:3Hf6+XnMM4MiVkz9+FE","tlshash":"2b02d8da6069b173bab52cfc948249e1a620ffd298d0e1e075ee0f50335ea78774135a","size":8618,"data":"","first_seen":"2026-10-09T17:19:19.146132Z","last_seen":"2026-10-09T18:33:14.223443Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/GlobalLazyInitIndex.BsE1dwtT.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"d0b21518a8f2e706a608363c2b203f68","sha1":"ad1ad512c499705528e4be91c6df0a57dc9e5ad2","sha256":"7944b5c77358e50aa5d4e1a4033680af4bb57cf79c5f2af795fe6a8b28a3975a","sha512":"480e4c9683f5019e6cb37e51075081e70611caedbf9ce92529ce39293b0f5c2ba419712cd58d6ba0190776729758885099f0e84c4ea66caf7c86013ab8bdeb13","ssdeep":"192:lfCnNXVoUkx0OnovufFddZd1KyzM3JsAA1A5xdoCl23m+kwL3BUDeIPsCBXN2/6v:l6n1V+y4ovufFddZdbw3y1nCA3m+HLRQ","tlshash":"f322c94ab2b62bf1be6c5c98a47254925b5d3b531400c0faf0ff5e3533d944062baab6","size":10592,"data":"","first_seen":"2026-10-09T17:19:19.063523Z","last_seen":"2026-10-09T18:33:14.224755Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/2_RechargeDialogsChunk.DcEKdzk9.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"367f546fbe9388bd14259f25bd1965af","sha1":"871658f413f304dbc1644642efe64e52a2000c10","sha256":"a4962b893a99498877f4754f054d8c4aa10d43a8d87c96a9b817170869ef59b7","sha512":"e53ecdc45f7154be765108649a219e20b3f07890d6768cdd160856877f26ef90e35ab271a14b0e400c2a16c71bfa4ed100a0d73794b6244621bb057b233149ff","ssdeep":"384:Wgg7UIn+08cbuYo+HN4jGlOChD6hmyazwb1o8GQv9Ve7y3KIHxgJMjyberWlPZWr:g7UIn+08C6jSOChD6w4ZYQ+7y1yMjyyv","tlshash":"eeb2b688b6797365b7a85d6da1ab4db3614c2f525000d8f1e6ff8e0023e5f607ee6234","size":23954,"data":"","first_seen":"2026-10-09T17:19:18.984317Z","last_seen":"2026-10-09T18:33:14.226237Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/index.BK_13tHV.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1ac4cd5398779c0e7c79022361e44044","sha1":"e43989f341cf004914b3a6fa4b44dfb28a06ecce","sha256":"e4ab9ad28ed82614500d3420b0467843720abf14f9f3a7d567983b09873b5620","sha512":"ca90934eb888e6084ee6f06e78726a4cbe436673354bd989e1ba6d8e096399f090e24a292fd7a1c75e06d72aa3191af2cfdde4d6847f46e74fc4be7d172cd898","ssdeep":"","tlshash":"23d0c0a3c010b6d028e1c8c0cfb9e592a3ce03331302422bf0fe33169348c31cd04411","size":199,"data":"","first_seen":"2026-10-09T17:19:18.835474Z","last_seen":"2026-10-09T18:33:14.008215Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"f7cb2926d03168de937c2ba018fa8a83","sha1":"3610b76d4a0ce9a957931df94264c858dc2cfed5","sha256":"d81e0f1d0bdb243983219617e956d1720154f1b7af5b11d82bfbfb6ba942a9c3","sha512":"e1cb744062965853ba697efa49b7dfec7da91ebc83dce241963a2b1c5b88ca2b018e4da462558322b18ce9dcc0d55bdd6b78994fab49cc4f60423dba46974b41","ssdeep":"","tlshash":"b3c08cc4a0c27d001616641410af24e4a0248426b04c5b02cdd5e8482e220b48233edc","size":142,"data":"","first_seen":"2025-03-19T06:50:21.449209Z","last_seen":"2026-10-09T18:33:14.229464Z","times_seen":3537,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_MineChunk.DK19R5qV.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"d669f5c42c10fa5a161f47ec4e64ce30","sha1":"944921367320663545e68d4cb95a3bbd574de310","sha256":"dba1270162ac1fc5167a6000d93d07529756854e06572cba6692cbfc5e9f05a2","sha512":"b15c53122aee281fdbc93d6aee2d88c41e8c87744bd92d42b73250d49416d6004f4943c7b6b14cee320cd2997cc7a42145882a5b3fce9e09cac96ecc37adcbd4","ssdeep":"3072:lruj+LSJdYSV8H40DBxaeID13pJ78DOr6OCGDbteldFGVJE9:lruj+LILJQE6OCGV+FG09","tlshash":"16b34a81b25ba1b5abaa2d9ca0344875465c1f85ea41dcf8f27f4b2153f6b11f3e0b21","size":116304,"data":"","first_seen":"2026-10-09T17:19:19.07579Z","last_seen":"2026-10-09T18:33:13.923938Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/store.B9beBFT9.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"724d364900bdfffcad95a04f8675dde8","sha1":"8460591ca62b9f6167462bfe3e74297dde9b9616","sha256":"5f9086627129d3b144e5d6a811501e0b403f6042b8aae19bb4485109d34ccca9","sha512":"6dcb011468041b9407267064650bbfee746331c4392f434a4307a0b72b62042404a522485f42b409aa0fe912e5324f3975422af1f6376d451282529f20036138","ssdeep":"","tlshash":"7831508870ea3074a7b95cd1e0714137020b1b752d32d8c5e0af4a920306f01a66ff54","size":1677,"data":"","first_seen":"2026-10-09T17:19:19.078172Z","last_seen":"2026-10-09T18:33:14.231144Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/Common.BwP30_nx.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"69246be4c4d4267beb1c2a25977d5d26","sha1":"69d6a4f8a7da040987456de5978d2d0c76e507c5","sha256":"de6b3f4794bfbd2730974522eba2e2c54050f7b96e6159ce23d9b949d27bedbf","sha512":"9aa97eb9a8ee80e3654305b8d3cc582959ca13323ea20a690350f4d0a3ad761d2fe113dae56c70bcb519d193003dfc1eb9a791c83f564da542034ad9dd76b3b4","ssdeep":"384:lrzU5UqAnIKI/LRc+GnnK1G76s6eJS90TU:lrQ5UqAe/16nK1G76s6eJS90TU","tlshash":"eb52c465b4973d719be36d78b07a14088b1d1b602340e6f4e0eaee3022e5e89c15b73f","size":13842,"data":"","first_seen":"2026-10-09T17:19:19.05543Z","last_seen":"2026-10-09T18:33:14.233174Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/index.BKqwvklx.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"09f0507b422f7b1b82c87503431518d7","sha1":"03baf677c4f54972ec84f35dd19901c120c6c936","sha256":"11718469fbb9bf7d58f4bd4cbc6dcaac86527c2805a87cd84a04b7b02bc8e710","sha512":"830f16a4c4b24ef3967fdb9de12f6a581c2abeb61cd892a59ec2c1916f34d41686e7711edb98bc8102ff2919c2785b7058a277f57e218cafd33469aeb3c9f0dd","ssdeep":"1536:lrkSMIopTdd0QJgTMjmA9dRG542jPDUy/PGGmCktAMWkCVGeIyL+5VD8WIzP4Jzl:lrkrIopTdd0QJgTgpRG542jPDUy/PGGu","tlshash":"8143f797069e97d720c81decdb6b4a174da41f47eb4ac0aded362c2d238e016d0b97b1","size":57438,"data":"","first_seen":"2026-10-09T17:19:18.991763Z","last_seen":"2026-10-09T18:33:14.235113Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/useRichTextImageInsert.C0oT6e92.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"6176756df15bbae3fd3ab93fe09308a8","sha1":"9c307af26798ec5ce8538aa16f96b694affba377","sha256":"1053795030ef7838b06b0216cce0a5294bc30ae84595978225f57e7bb177031b","sha512":"dcde8003660dd12d3f8dafdde9785290921ccf2e7392a5d720eb58d898c5aa822afe2f1aeb17c2d1574a4137a4face55a0fdd863128614463f51ab222a017f6e","ssdeep":"","tlshash":"eb319660f8a79c3637a705ded4ba2002f5084a08324dc190e06c4d1d32aa8c0a5bffef","size":1453,"data":"","first_seen":"2026-10-09T17:45:44.061063Z","last_seen":"2026-10-09T18:33:14.236601Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_SearchGameChunk.BjzR6crl.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"3d33242dcc290a112de8339ea30fada0","sha1":"83fff0b8d1f099b53dc48a8c7d7246484965a9a2","sha256":"be14fc6c652cc4c6c0ea575090bd88fddfeb844f63e438191df094a0ec9c236b","sha512":"4416088db8968244a530ab34972d2505c820b1f3f48ba3110e317e5d8da8f660d59ab385909541474f58e0123596d7a96b886e26467cbd3cfb8ce2ea6f994d37","ssdeep":"3072:lrtLcWmNVfBq6DSZXfoyd22PHGnQ+Mnc29Oc0OLD:lrJcWn/msO+D","tlshash":"a2c35c89b299b538b7fa5cd570a020c0b5345b066401d9fce0fb9d2523dfea4b7a6378","size":118258,"data":"","first_seen":"2026-10-09T17:19:19.088613Z","last_seen":"2026-10-09T18:33:13.886134Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/vendors/vendor-swiper.BQ_VG6mx.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"d94f8ea49d0c5f9577ee0a216a90eb0e","sha1":"4e3973ba9347e48e59425e410ddfb6523e15c340","sha256":"eefe97f89ebb89a9edeb07ca29c2c8465e3b025bcf1a3eb7612e298122a0eafa","sha512":"d063bf53ad40fc4bd039e32ff6e1196c547ba6b91a69e29b89bb830a63aecc4e8fa876a58e56234432d0a4f2f78e0becb10308d6be424f5c67abebbc0e576779","ssdeep":"1536:wTfptYZ8Wdd23B39snwDmvj+P40Ie27vTNjdPKoFxq/4BlxvHr+CEIkpXiA6wKb3:wza23B3K+PuxHNLq/87RgPG","tlshash":"e3b30989a224757742fb1ada83758201b2b04854f809d4e4b0fd9d7f497e99803aeffd","size":111837,"data":"","first_seen":"2026-10-09T17:19:19.151562Z","last_seen":"2026-10-09T18:33:13.862338Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/simple-theme-blocked.B5PQ2FOB.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"e8530e3ce94d9ad3fddeef11c844147d","sha1":"4189f19a77ce865b57bee196f00442df8ef540f3","sha256":"2ad7f7d7b43f2be36fe607e5998baa65ecb609c6d68a40279f755b7e7fdbeca3","sha512":"0ea055617856ae5fcbed263689dbec803eeb58039c98a6f466b184033293536914829fdc89519f5505c1b8e829ef8ffc861ac50b6f20112e7b9e63b6a715a34a","ssdeep":"","tlshash":"9ed02376405d57f43c4ca09055a0fd67e090352d63525dd271081a11130a599199f435","size":212,"data":"","first_seen":"2026-10-09T17:19:19.073586Z","last_seen":"2026-10-09T18:33:14.237812Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/useRewardTips.CVA2gs2Y.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"edb28f5c2ab8ff204e54d3fbce6f9e35","sha1":"f7b05abde52378106a524b5c01ade0b25269c6aa","sha256":"ba596a2486a92d0304774f6a62230600700bb92a8ca42306a766221d6b660f3c","sha512":"fd310ea6a669763bb8880e2982e452f02409a28727495a88a5f42cd85ee905170c0bd901180228e625705b92fbfb30b5cab448c6f6124fbc15d31472dd5f8f3b","ssdeep":"192:FuTag+fCYN2fCOyfCzQEt6Y0UbrteyIgkKLi7WLu:Fgag+KYN2KOyKzQ26Y0UbBRzkt7Yu","tlshash":"7be13485b3eb62a3318d5e78c0e31b24128526cf7d19c9d1648b2f361bcc699f81ef52","size":6923,"data":"","first_seen":"2026-10-09T17:45:44.083588Z","last_seen":"2026-10-09T18:33:14.239082Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"170252f2a0a319c86387ee84e074957b","sha1":"6d3390be05a3eb0f0dd039199f308c44a15a5d8b","sha256":"7613b3ba74053bfffee654355a35378a14729cadf885b97504467297f5953f1d","sha512":"e13677542f901169d68c3a8cccab947ceba9b36d3d23ac5bc6114702ee95b75dfd99982ce2b65e0e63b088b1d0e81529ed141b81a8db03adc80614405e687ac1","ssdeep":"","tlshash":"25c08cc4a0c62d00a602685014af29e8b024402670482b028c98d8493e220b08233ed8","size":142,"data":"","first_seen":"2025-03-09T03:44:28.294579Z","last_seen":"2026-10-09T18:33:14.240254Z","times_seen":3542,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"5c90c2c70c9572fb63492be66e890aad","sha1":"1fbc53a78d3ea05dff9a34534f1cfe66d0bc3177","sha256":"330102842ff39221bb366d9e801d3d09e985b5890bb0695250b09baaab94bd05","sha512":"e903f67a45ac526cf21940e3becee20f2ad959ae26958a48e051b506d833d2ab638df4a5437cb22b875b02424603dfe121d12c7bb1166cc0a0ac93f2b3fc5d3c","ssdeep":"","tlshash":"99c08cc4a0c3ae001a22a82464bf25e8a034406779485b12ac94d95d3e270f08237eac","size":151,"data":"","first_seen":"2025-03-22T15:35:24.697892Z","last_seen":"2026-10-09T18:33:14.241223Z","times_seen":4612,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/2_NoticePageChunk.4YawWZVy.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"5cf88f2fdd8b7efa350a72d32ce50c41","sha1":"85d808435ac533fc434d46f30c4050608a33652e","sha256":"03a0c33ebc2c2bd41f90e55ab23648552a47a3bff341011db6e4d0a659cd993b","sha512":"5b82714aba7e57c6f0e1587a25c2eefd026b5a00ae07dd7289cad5d83b3850bbb3efb9095dfb7b3095b6cfe1ddea9ceba0a3b03d70a401609f1fc92e50393289","ssdeep":"768:Dz/I2ag/B21l1VY9EbPBfvdGqA+yn75Od+OVHru9mCQeSU1yMGpeO1qLzCDCTQiR:DbNaNlPPBfBAmXp5QOXZxOkgYB+7","tlshash":"2c631889f065e679a77a8ca964a854b06a082f899000d4f474ff5f2437dff24b39833d","size":68005,"data":"","first_seen":"2026-10-09T17:19:19.161645Z","last_seen":"2026-10-09T18:33:14.242465Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/register.impl.Cio1qJTM.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"7c3c556324ad4742683d1f3a180c3495","sha1":"d927eb35601e18c47a65dd0d9fb7b4f843c7149d","sha256":"17aefb2de129edd94a10d13b0ef46e2b993f67f3ae950332ccfe004a7ab68ecf","sha512":"aae71d6be648b653cb2f3e4baa300a6eb0d65c9fd2eaef2bdd1ed750c7dc20e125692fa2f7e06a92e6a48cbf982b8340c6999df0e9de39f73074503c71b7ac78","ssdeep":"","tlshash":"c581e84e6b2c80312aa485e2993f6fa3557611253d488094f63ece90f60d4c763a87bf","size":4070,"data":"","first_seen":"2026-10-09T17:19:18.961631Z","last_seen":"2026-10-09T18:33:13.870492Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/0_WithdrawChunk.CVJE5O4x.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"2722010c369b881575a45335efc644b0","sha1":"db2a0f2865bc9fe5d0611d906c5e50e33616b96b","sha256":"cea3647cb22f98ece5e50929582b8d85d0e38236d1cc48d52908f3a835bad653","sha512":"d7df869acdd2c3d4fc8cbd96c0525868b1d9d943659d124cb31a7df2c9890aa78b336395ff70ef12baee65c3c435147d819e32b6b2d636f3f81f2e8a972f2e3c","ssdeep":"3072:lVNpOAJzR5NywPlm9GZ13ZRXxCADzFQO4Yj0aXf:lVNpOAJzR7VA92QVu","tlshash":"14c30bc97167a0f47af87d98b4b20696721c3fd9a004c0f7b1ff4e21278aa91f994725","size":128596,"data":"","first_seen":"2026-10-09T17:19:19.056575Z","last_seen":"2026-10-09T18:33:14.033129Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/NoBackgroundPopopIndex.Dijuxdg9.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"c10291c084c040bb0d23e87f0a28156d","sha1":"8b91b21782d969a0d1432dba7fe3be2e7dfb8cc2","sha256":"e879d153de7fad47b7efd3e3879cb116a3d34f2b07e1686fc28be657157d8779","sha512":"643fcadc854289d1a611fdc645b89918e99d8703916421726d3b241f56738aa56796433942c5464f404feedd9f14f4e4cf8cab83f42245d052c2b73c4bef9c38","ssdeep":"","tlshash":"9361420b77aea235b3f80cf5d4610405816c1724a42ad9fd64bfa7f22978f4827a673d","size":3282,"data":"","first_seen":"2026-10-09T17:19:19.117098Z","last_seen":"2026-10-09T18:33:14.243718Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/libs/browser-media-match@0.0.6/index.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"6ebc5c0381a7d5e83324d8f44fbe055a","sha1":"716c0c49b5eed05fc5752e658e280a37b2eca14a","sha256":"048412edb70558ba3a98abb4c3b99982679f8a941df859d41b2f18e0f56fde56","sha512":"8ccc49138cb761ce38fe430bb63386fb187d6d8b25ca56c4cfabc915fd81b5eb38356c4cf7d3f522aac5fff047327db27e99f5141bef65c3cbd72c9e32d462e4","ssdeep":"","tlshash":"6e611f69767ab5194616b0b0998fd009bde9ad3613cc4845822d88f4f8799f8473fdcc","size":3248,"data":"","first_seen":"2025-06-26T13:19:27.401603Z","last_seen":"2026-10-09T19:17:20.721293Z","times_seen":16363,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"a5746966fc9c08bc07dc5651c3057d2c","sha1":"8f8521e4a6721076f18ec6067754e857a026cbdc","sha256":"e579a19de508d1b8d5c12448ff9f3a2ad330cec031c194833605dcd3df85b12f","sha512":"5a83935592dee952dcd24942727c6e288c0362a10a0e8bd19ab9613d95c962ebf016371918c68aaea961e6d93ca6e412e1b992e0f2ce686c866692dedadc6eae","ssdeep":"","tlshash":"11c08cc4a0c22e106612a41150af38e49024442674481b028c94d8482e620b09233e98","size":137,"data":"","first_seen":"2023-10-27T05:38:28Z","last_seen":"2026-10-09T18:33:14.245415Z","times_seen":367,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"3de60706f0a69509aa0f0f90d55f74de","sha1":"bcb72d69ad68395bd6b20b204b620c4dcfb1cc94","sha256":"9f497ec930a6535e72974b096c2089918d8327f71fe764e205d78e827a5b296d","sha512":"27cc542551ee264f315126a541ace26a6631be48c4338553972ab069062526d54377441e5dd13830c2debcc062cfa83cd764c817814bafdac76852603b1a533a","ssdeep":"","tlshash":"bec08cc4a0c26d001612692561af24e4a034442a71885b139c94ec4c2e220f48233e98","size":149,"data":"","first_seen":"2025-06-24T13:04:13.173922Z","last_seen":"2026-10-09T18:33:14.246745Z","times_seen":680,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"5b944b9d6d3e6b77213ad592b3b1c14a","sha1":"a2641707adb0979b0119c9f6130c0af71c5bc3b9","sha256":"0c53b570e60e997e11017c8ab361a628cd67975e566d055436e5add67da9d205","sha512":"9148b5673901adf086c363a72451153a7a268df5816792a4eb65ee4c18714f44ca56c87d26c9949371472a9398040e83692e2041272422f3b3e7b732e7dd06b3","ssdeep":"","tlshash":"c7c08cc4a0c26e001a22682450bf24e49034446675489b038c94e95d2e230f08237e9c","size":146,"data":"","first_seen":"2025-03-19T06:50:21.42016Z","last_seen":"2026-10-09T18:33:14.249608Z","times_seen":199,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"afc4d02707697e9380a58ef15e76c26c","sha1":"8d8c528ec3c2182f2e4711f8bbb6ef8af03e968c","sha256":"fa442ee10b51e4e6c8f94f508aed3e1175fca17d1fb11304795e6d0104034e24","sha512":"e155a414f000115e67d33f0964a5b2243ddd3f9bfed087f29abf3c26464d4134208c237092627126628dc58b2bb4d1ea627273f915d57beb3227fffb2f5188ee","ssdeep":"","tlshash":"9ec08cc4b0c23d209a16642154af24e4a038802670481b02dc99dc882e220b18233ed8","size":144,"data":"","first_seen":"2025-06-04T18:26:18.245396Z","last_seen":"2026-10-09T18:33:14.252275Z","times_seen":42,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/CreateSwitchDomain.impl.yd64c6YF.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"fffd0fd117a37352438830732bfad838","sha1":"9044d23e2de3c554613aa0bf766ae2511e7d5600","sha256":"99bbbfac126ae08ad30c9a21e7f450534980290d4ecb28ae00ec76f27747fcc8","sha512":"a87dc4bd837c4309c60bbb8f40c666472e513852c7505fddfdd86d831c94e24dd6d68d305d9444c90c00ce49b3fcb551a4a9867ed5f7d5b3d2bfd98662f3c189","ssdeep":"","tlshash":"0d21a79b800075b816e341e9f9676848136163b92446f071646f1a169350f06fea777a","size":1228,"data":"","first_seen":"2026-10-09T17:19:19.119508Z","last_seen":"2026-10-09T18:33:14.254993Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"4026c93b8c138bb724e7e5b6bd6561ae","sha1":"a656e88bbfd70c835395d37b23312891b5e49cb1","sha256":"3b6bdf66c2591ee368c99b3b57b80664094bccc0d104504bbe3014ded5697bde","sha512":"392221eeb98709565b70bcded106cfed9af11484ebd23d51b1e6fc36048d7f3c4d17dd99703505b04a8810acb2602055c5ac3e44606eb838c360ea6b7c94aa02","ssdeep":"","tlshash":"3bc08cc4a2c76e10a626642016ff35e49024842b744e1b029c94d8982e660b0a233f9c","size":155,"data":"","first_seen":"2025-03-23T10:10:56.981724Z","last_seen":"2026-10-09T18:33:14.256554Z","times_seen":4213,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/UserProfileTipsIndex.BBNkLwr7.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"2b7b513f01816a24987840ae96a299a9","sha1":"423cf113425be23ef8ecd4cfce0471d17a003ec5","sha256":"1558f675aa8fdd0604ac5a7560631924c1b0926cafd7e40c094038242b51f356","sha512":"2acd8737e48d143727593d43b953260d3abe658a695736fd2c71aa599b3c4fcc3c8ab221e7e806746b2cfefec241d3750e3873b2e04be2a6fcd30726141c9485","ssdeep":"","tlshash":"ce4165cbe400baf7a1a75cf4d0929ca5937a11d78394e6b290ff122a4395078db5c613","size":2376,"data":"","first_seen":"2026-10-09T17:45:44.10466Z","last_seen":"2026-10-09T18:33:14.260268Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":" ## Welcome To Visit SaaS Lobby Next ###","filename":"https://ad852.xyz/assets/theme-0/commonChunk.0oGKmx_H.js","line_number":41,"column_number":2255},{"level":"info","text":"[低端机降级] stopOverlayAnimation 已启用 (score=-, quality=0-39, scoreVersion=)","filename":"https://ad852.xyz/assets/theme-0/commonChunk.0oGKmx_H.js","line_number":18,"column_number":45863},{"level":"info","text":"[低端机降级] deferLoginSuccessTasks 已启用 (score=-, quality=0-39, scoreVersion=)","filename":"https://ad852.xyz/assets/theme-0/commonChunk.0oGKmx_H.js","line_number":18,"column_number":45863},{"level":"info","text":"[低端机降级] stopRouterAnimation 已启用 (score=-, quality=0-39, scoreVersion=)","filename":"https://ad852.xyz/assets/theme-0/commonChunk.0oGKmx_H.js","line_number":18,"column_number":45863},{"level":"info","text":"[低端机降级] disableSeamlessScroll 已启用 (score=-, quality=0-39, scoreVersion=)","filename":"https://ad852.xyz/assets/theme-0/commonChunk.0oGKmx_H.js","line_number":18,"column_number":45863},{"level":"info","text":"[低端机降级] reduceFirstScreenEagerList 已启用 (score=-, quality=0-39, scoreVersion=)","filename":"https://ad852.xyz/assets/theme-0/commonChunk.0oGKmx_H.js","line_number":18,"column_number":45863},{"level":"info","text":"[低端机降级] disableAvif 已启用 (score=-, quality=0-39, scoreVersion=)","filename":"https://ad852.xyz/assets/theme-0/commonChunk.0oGKmx_H.js","line_number":18,"column_number":45863},{"level":"info","text":"[低端机降级] stopScrollAnimation 已启用 (score=-, quality=0-39, scoreVersion=)","filename":"https://ad852.xyz/assets/theme-0/commonChunk.0oGKmx_H.js","line_number":18,"column_number":45863}]},"http":[{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/AsyncAsideIndex.DJTJPSZz.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.169Z","timestamp":1791570703169,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/AsyncAsideIndex.DJTJPSZz.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/commonChunk.0oGKmx_H.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76becd542efa-OSL\r\ncf-cache-status: HIT\r\netag: W/\"7B9A73E415A2FD708AA6527F14DFA93E\"\r\nage: 27340\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: e5pz5BWi/XCKplJ/FN+pPg==\r\nx-oss-hash-crc64ecma: 4021611394483029591\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C842231938373626AE57\r\nx-oss-server-time: 4\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":906,"size_decoded":1195,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (905)","md5":"7b9a73e415a2fd708aa6527f14dfa93e","sha1":"34c905a28c22dfea29253abe98f43336be4e2ead","sha256":"f537b5bbc78d91a636ea94e39e4685ad0443ea8e89ee9bab3df9770691dc29b4","sha512":"8bcdc123f7d17d53fe4d7a38ba4c9b53ab81781a67ba618d8d1ca9b6044e113ce92b831e8dead351ff01684b6edac0a509a24a68a1b7b7f76d238d739d757d5e","ssdeep":"","tlshash":"b4118c8fe04179e2f4c69cf9c5a5e83106aa12c207c1d7b1c0dfb7669394479dd4da83","first_seen":"2026-10-09T17:19:19.030998Z","last_seen":"2026-10-09T18:33:13.751922Z","times_seen":5,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/200/3/2001023/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.660Z","timestamp":1791570703660,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/200/3/2001023/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c1d8ae2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"38399006868560B0BF4BCC09290B3F2F\"\r\nlast-modified: Sun, 27 Sep 2026 04:27:26 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: ODmQBoaFYLC/S8wJKQs/Lw==\r\nx-oss-hash-crc64ecma: 5821601217375407223\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D36675EC463134656628\r\nx-oss-server-time: 74\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 9584\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9584,"size_decoded":10326,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"38399006868560b0bf4bcc09290b3f2f","sha1":"8231bd07bd909f9089c4d64603bbfe832352894f","sha256":"3c588061b6d51d3762dbee424133239d9edd330be7fa407d6b252a78b77ac02a","sha512":"091aadccccaddb0f8cf6633dd3884b92bbcdc1facb0b8343860df3cdee11bb6b3496969595a09a58460b1529521cb7ccca65ed264da812c7d787a227149a3773","ssdeep":"192:It9NXwkgxCDmZPnz4KzW41rrlFXKy09C3UBU:wNAkAPz/W41rrl0QUS","tlshash":"9512ae4a6f9c2053fc15f287ada65f293e85b9409274293069c16ebca27690cf9620ed","first_seen":"2026-10-09T17:45:43.646793Z","last_seen":"2026-10-09T18:33:13.753931Z","times_seen":4,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/upload/img/2105266361794228225_x50.webp","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:44.050Z","timestamp":1791570704050,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/upload/img/2105266361794228225_x50.webp HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:44 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c44b0b2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\ncache-control: immutable,stale-while-revalidate=86400,public,max-age=86400\r\netag: \"4F01F3B75627DC8753213FDB117A383C\"\r\nlast-modified: Wed, 30 Sep 2026 11:59:55 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: TwHzt1Yn3IdTIT/bEXo4PA==\r\nx-oss-hash-crc64ecma: 3060076177493567050\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8EA898F02F93830DA8871\r\nx-oss-server-time: 5\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 16434\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":16434,"size_decoded":17130,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 510x150, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4f01f3b75627dc8753213fdb117a383c","sha1":"a00245ba784bb85c7140511fc5cce1e4bf18ed9c","sha256":"2637c6af6c8678c82bf06d9220bac767a8f66a0f53fd2ef68506f3d1f420980e","sha512":"50864aed8f01aff58b42fe818392c3c2226e2b074aaf004ec773a19cf04edba17bed1997625adc45e1e7917c4da8b29b462ff014c546bce29f8828aca3820da8","ssdeep":"384:laS2GMZdE78uWTC4els5Yd039KVv3f3UIRdcOL:J7MZdEwuWTdhYd039e35X9","tlshash":"8372d0eb1743e60272b4f722e4b9b202719119e68f454729190a0d9b8fab1f9dc356b1","first_seen":"2026-10-09T18:33:13.755428Z","last_seen":"2026-10-09T18:33:13.755428Z","times_seen":1,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webpushstat-sgp.engagelab.com/v4/web/report","fqdn":"webpushstat-sgp.engagelab.com","domain":"engagelab.com","tld":"com"},"ip":{"addr":"43.163.81.198","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:46.863Z","timestamp":1791570706863,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.engagelab.com","organization":""},"issuer":{"commonName":"RapidSSL TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 25 Aug 2026 00:00:00 GMT","end":"Thu, 11 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"2D:37:4A:17:47:09:76:A5:C3:14:DA:C6:FA:75:C8:68:99:90:1A:D0","sha256":"5A:9B:4F:D1:E3:1F:F2:80:4A:C1:E3:15:B5:C1:05:A0:28:53:24:47:F0:25:6B:88:22:2B:1E:BD:C3:5F:F7:F1"}}},"request":{"raw":"POST /v4/web/report HTTP/1.1\r\nHost: webpushstat-sgp.engagelab.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nContent-Length: 268\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nAuthorization: Basic MTgwNjIyMzQ5MTo2ZTdmMmI1OWIwNDJkMzYyNWNkZTE4ZjBjM2FlNGZjOQ==\r\nConnection: keep-alive\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":268,"data":"{\"platform\":\"b\",\"uid\":1806223491,\"app_key\":\"9ec737c30e02452cba9b30ce\",\"channel\":\"\",\"content\":[{\"type\":\"oversea_info\",\"time_zone\":\"0\",\"lang\":\"en-US\",\"contry\":\"\",\"os\":\"Windows\",\"os_version\":\"10\",\"web_channel\":\"Firefox\",\"web_channel_version\":\"134.0\",\"itime\":1791570706}]}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 09 Oct 2026 18:31:47 GMT\r\nContent-Type: application/json\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nVary: Origin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":1070,"mime_type":"application/json","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-09T20:29:43.461907Z","times_seen":18980891,"resource_available":true,"data":null}},"time_used":176,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":176,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/upload/img/2107727930704044034.webp","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:49.226Z","timestamp":1791570709226,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/upload/img/2107727930704044034.webp HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D; g_state={\"i_l\":1,\"i_ll\":1791570704718,\"i_b\":\"AUD+1QJhwLFQIgL25h/mMPSBZUZ0nELdT6H4yLr7+QE\",\"i_e\":{\"enable_itp_optimization\":24},\"i_et\":1791570704718}\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:49 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76e4afad2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 18565\r\ncache-control: immutable,stale-while-revalidate=86400,public,max-age=86400\r\netag: \"6269F19F9D1E401C585F296429F87920\"\r\nlast-modified: Wed, 07 Oct 2026 07:01:13 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: Ymnxn50eQBxYXylkKfh5IA==\r\nx-oss-hash-crc64ecma: 12407914294270600602\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8EA90AFCCE63630C782F7\r\nx-oss-server-time: 23\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 72660\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":72660,"size_decoded":73370,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 920x720, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"6269f19f9d1e401c585f296429f87920","sha1":"534ec1b0903ea0e4ea1883094283b456b097c7eb","sha256":"125a8a4fffd82de1e236703f7d612ffc8017f75796d7a8fa9bb39b33506e3794","sha512":"b6b8e077fec61ce9ee927ae7decdd1640e2f94780520c329fd7d841fb997e068a3d07bf0222c0c4cdf307581cf6bd8b2293863964ceacd87e5549599f78497e0","ssdeep":"1536:aEYRsGFG90FTYpnnKB0UWp06djosgdIyLRP/NS8vlhgNhuSl3:R0Jw90ypnOK60jXSLRPlx7gNhuW3","tlshash":"c863023fde24a15ffb8007d4ead751270a876b7995eb48c848924ab112f4cf895cec1e","first_seen":"2026-10-09T17:45:43.714966Z","last_seen":"2026-10-09T18:33:13.766395Z","times_seen":4,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-common/common/_sprite/icon_dtfl_by_1.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.370Z","timestamp":1791570703370,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-common/common/_sprite/icon_dtfl_by_1.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c00e7a2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24490\r\ncache-control: max-age=604800,public\r\netag: \"494B862B6E285D053F1A3313ED8F2AD7\"\r\nlast-modified: Fri, 25 Sep 2026 04:32:39 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: SUuGK24oXQU/GjMT7Y8q1w==\r\nx-oss-hash-crc64ecma: 17165703185247305648\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D364AFBCCE3535B61907\r\nx-oss-server-time: 16\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2934\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2934,"size_decoded":3605,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"494b862b6e285d053f1a3313ed8f2ad7","sha1":"08d6ff4cb71b0cb2353c7d16a32616c46a69e6ca","sha256":"75ef6a155e9562e471f7b2113f37f8d24ab6b8664320f8e0dd274df9494d80d1","sha512":"e8bd0847598db50bdb0d2901aaa05c204f16b1c501807f05153974e27618f3032f08c95323dae1d5fa2303511385b5341af5f5b884b2ef7e3bd84c4b1b2ee113","ssdeep":"","tlshash":"78512ab6b29c4291d052adec3c9a6013a75ff1ee2029cfc4518159459399d76aee8202","first_seen":"2026-10-09T17:45:43.72114Z","last_seen":"2026-10-09T18:33:13.768013Z","times_seen":3,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/common/web/message/icon_message_pmd.svg?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:49.166Z","timestamp":1791570709166,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/common/web/message/icon_message_pmd.svg?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D; g_state={\"i_l\":1,\"i_ll\":1791570704718,\"i_b\":\"AUD+1QJhwLFQIgL25h/mMPSBZUZ0nELdT6H4yLr7+QE\",\"i_e\":{\"enable_itp_optimization\":24},\"i_et\":1791570704718}\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:49 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: br\r\ncf-ray: a47f76e44f792efa-OSL\r\ncf-cache-status: HIT\r\netag: W/\"B5F683FEFDC8A58FE763263AD8EF274E\"\r\nage: 27345\r\ncache-control: max-age=604800,stale-while-revalidate=86400,immutable,proxy-revalidate,public\r\npriority: u=4,i=?0\r\nlast-modified: Tue, 07 Jul 2026 06:36:47 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: tfaD/v3IpY/nYyY62O8nTg==\r\nx-oss-hash-crc64ecma: 12668672709788670394\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C843231938373659BE57\r\nx-oss-server-time: 14\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1383,"size_decoded":1379,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b5f683fefdc8a58fe763263ad8ef274e","sha1":"7f7b768c9253d77f865303d0d4508d6486b71b8f","sha256":"040abac16343f572f9e019e1638f70e934db351557fa33fc1e47d82340816e1a","sha512":"e264d1f26b94ae836109f5377e142caeeef93de0f797389dbf4e025cb8e8ed3793f8e78a10c902c0543017c26f61d0a5b916acf876241ca6b38363556ad8bc46","ssdeep":"","tlshash":"8321eeff13269a4990c28f0012e45fd9637ca545fdb802d9a7132905fd09ab3717caa9","first_seen":"2025-05-09T16:10:40.017339Z","last_seen":"2026-10-09T18:33:13.776786Z","times_seen":1050,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/0_RechargeCommonChunk.Dq048yTz.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.404Z","timestamp":1791570703404,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/0_RechargeCommonChunk.Dq048yTz.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/AsyncAsideIndex.DJTJPSZz.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76c04ece2efa-OSL\r\ncf-cache-status: HIT\r\nage: 24674\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: +bvuC5+zZ2f1xKamz+KDRQ==\r\nx-oss-hash-crc64ecma: 15550809571098317595\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D2AD75EC463936F8C61E\r\nx-oss-server-time: 4\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":233700,"size_decoded":68742,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (50218)","md5":"f9bbee0b9fb36767f5c4a6a6cfe28345","sha1":"96c071e8962d651b685b32642c3d07489353bf01","sha256":"928c5cd572a77499d103cc569b83fc40b63b1c28846732362528b26ea9e07de2","sha512":"38f24c0f2dfcd93d3e56130f0181050b5f08da5d6ebea1d515161c8184e89d40eada2e18e0e84ff96b7480df6da2b459f48a6ab33744488ade2dbe97e1b87ba9","ssdeep":"6144:lBbQalcai0+sWFaXJm9EcGlu7VOUNcZt5v9bpKVtnP/n2so3bopxLFhuTxL+:Nlcai0+sWFaXJRciu7VRcZt5v9bpKVt7","tlshash":"1934d78cf4bd616576745c8890fb05b70248bb82b401d4f4b1bf4f6673aab41e2e5b3a","first_seen":"2026-10-09T17:19:18.908711Z","last_seen":"2026-10-09T18:33:13.778954Z","times_seen":7,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/200/3/2000089/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.663Z","timestamp":1791570703663,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/200/3/2000089/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c1d8ba2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"5E5A56009D625884752390D69AB92AB4\"\r\nlast-modified: Sun, 27 Sep 2026 04:49:13 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: XlpWAJ1iWIR1I5DWmrkqtA==\r\nx-oss-hash-crc64ecma: 15452660628011867492\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D3662319383338C18AED\r\nx-oss-server-time: 15\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 21198\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":21198,"size_decoded":21942,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5e5a56009d625884752390d69ab92ab4","sha1":"126eedaddd5f8d6e42ca32c057633326ac9fa345","sha256":"43d37ea0c7c80d6630d4cab9e32487d86e0837a5ae88fbab7a0398bc829a8930","sha512":"f6436b6c10bde7ad7d53eed5b44e56b384ae9a45bef2af4a66361e87e9ee870a7799f85bea39749f8609010c98fc120c5b433218b405cdd2819369b0a7264947","ssdeep":"384:j0XITGRASyXEN8Fh8GfuqWf6fd3MNPmuo+lh7SN/vbZHQJPSIjzGSily3R:yMyASBoZu9yV3Kooh7Mb9iSIjVR","tlshash":"eb92d0218dcd076a12d38f536618fe9e797f5e24f3df653c89848603492184abe07ed6","first_seen":"2026-10-09T17:45:43.852958Z","last_seen":"2026-10-09T18:33:13.781687Z","times_seen":3,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/upload/img/2104909127191687170_x50.webp","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.486Z","timestamp":1791570703486,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/upload/img/2104909127191687170_x50.webp HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76c0cf322efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 18565\r\ncache-control: immutable,stale-while-revalidate=86400,public,max-age=86400\r\netag: \"DC85B1466518200F169B06AB076EF536\"\r\nlast-modified: Tue, 29 Sep 2026 12:20:23 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: 3IWxRmUYIA8WmwarB271Ng==\r\nx-oss-hash-crc64ecma: 8381370749481771418\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8EA8915F04930329818EE\r\nx-oss-server-time: 19\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 15184\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15184,"size_decoded":15893,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 510x150, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"dc85b1466518200f169b06ab076ef536","sha1":"00175020e19249d703b4f468686f503264e158f6","sha256":"545b3426d5c05218733b9b4f422ff1cc2194aa714a26eba18b7d8f2290bf5cc1","sha512":"6fdb9b2e5dbabf68e39a4c7c2327ac38c655e50b5f3c2b2e62030172bd49cc8102612f373dc6852660044e2b1671e281c7b7b664065e702a42c4180961c0eb19","ssdeep":"384:Q6grdNwzSo4DKiPTe12ElUpcShv1+T1Kh8tph5:Q6grd84DKiPTFE2pcTT1Ka1","tlshash":"5a62d142a37d6ed2601fc4778cb05396405516346d467fe0a9bd0deb7b32bb8423e16e","first_seen":"2026-10-09T17:45:43.400494Z","last_seen":"2026-10-09T18:33:13.783222Z","times_seen":3,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/upload/img/2103441922901995522.webp","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.086Z","timestamp":1791570703086,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/upload/img/2103441922901995522.webp HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76be4ce12efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24490\r\ncache-control: immutable,stale-while-revalidate=86400,public,max-age=86400\r\netag: \"6F828F27C30FE44EDA57715A45C1E0BF\"\r\nlast-modified: Fri, 25 Sep 2026 11:10:10 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: b4KPJ8MP5E7aV3FaRcHgvw==\r\nx-oss-hash-crc64ecma: 15710073046136095309\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D364AFBCCE35355C1207\r\nx-oss-server-time: 15\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7688\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7688,"size_decoded":8397,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6f828f27c30fe44eda57715a45c1e0bf","sha1":"5a889a9c9e33ea63c7112f112af7b94441830358","sha256":"5d9cc7649170e670588052761c24df568b3dc65c95898f8b02d84ad0e4a6502f","sha512":"3b3fa9f37e34098b913bfb710a8d612ebad3dfedc7b8d201205c08572c39c7f29c3108cf59fb6e66df99b2671d0b7c0f3dbf56e36d47883eed3e74a6f2869189","ssdeep":"192:w2g4UvpviIfVJBXW9hfCk3v18/SVDalj0Bqzj+:wH4U9iKHxyvfBDaRtz","tlshash":"74f19ead113f9d1bef44b4f8810863b825c5227b96c5c239f40c963a093342f92f715d","first_seen":"2026-10-09T17:45:43.469105Z","last_seen":"2026-10-09T18:33:13.785201Z","times_seen":4,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-1/common/_sprite/icon_btm_sw1.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.110Z","timestamp":1791570703110,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-1/common/_sprite/icon_btm_sw1.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76be6d0d2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 23458\r\ncache-control: max-age=604800,public\r\netag: \"C905FA0144CA8F13DBFDA569D810C9C1\"\r\nlast-modified: Fri, 25 Sep 2026 04:47:12 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: yQX6AUTKjxPb/aVp2BDJwQ==\r\nx-oss-hash-crc64ecma: 5096562879260296397\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D76C0A7E1F3033F8B6A8\r\nx-oss-server-time: 22\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 848\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":848,"size_decoded":1517,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c905fa0144ca8f13dbfda569d810c9c1","sha1":"47237edaeb09f2d485792bc9ebc1a607e86dc5fd","sha256":"d7b06c1faa1a7edc646cf5b731583a217133303e9b30f4e8640359b6d9ac47c7","sha512":"c503b03b7b960327bdbce24957ddae5648f69ebf5a6a6e8e5d64d31e2c907d36f58e337359417171d4f771a2887af14337800ae95fd651ce329fe3c0e3f011b3","ssdeep":"","tlshash":"a90196101f89d10edee07dac64b76214c9c90f86c2f62e5d6e05377296c00d801022eb","first_seen":"2026-10-09T17:45:43.428053Z","last_seen":"2026-10-09T18:33:13.787742Z","times_seen":4,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/libs/webPush@2.2.0.1/webPushSdk.produce.min.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.176Z","timestamp":1791570703176,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /libs/webPush@2.2.0.1/webPushSdk.produce.min.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76bedd632efa-OSL\r\ncf-cache-status: HIT\r\nage: 27343\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: aBJdoRTTaRwLLzDhQc55/Q==\r\nx-oss-hash-crc64ecma: 1166708658088788487\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C83F2319383736958057\r\nx-oss-server-time: 3\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":65947,"size_decoded":26137,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65532), with no line terminators","md5":"68125da114d3691c0b2f30e141ce79fd","sha1":"91e806bea4f6dce8512f4f4256c39747f7536363","sha256":"5f11ee8b12d8b4c5d7dddb00c6517280df2e1bf0fb5db094e2a12d62929ee3c5","sha512":"f7a033b950ce8483b91c03152486cbf7001b27d4a9a92fb97b0e4c699f89e598c6829ace105dec24da516df732e0a4a769e2c443229ffc6c2b4989029bf3504f","ssdeep":"768:porqwD5QO6hsA6KJsacRUZd3O3PegdmW4i9rpr294fLui9/yFGlq0VTH0t+QiRH0:275L6hZbJuOujS8JHuiAJ0obpOrKB","tlshash":"45534bceb18d753107e7b465c53b100277332815aa494268b6ece9e6bc7a1ce7113fba","first_seen":"2025-09-08T15:41:02.523794Z","last_seen":"2026-10-09T18:33:13.790236Z","times_seen":3413,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/layoutDesign/2082095762101497858.avif?swRuntimeCacheName=images","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.115Z","timestamp":1791570702115,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/layoutDesign/2082095762101497858.avif?swRuntimeCacheName=images HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a47f76b8386f2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 27345\r\ncache-control: immutable,stale-while-revalidate=86400,public,max-age=86400\r\netag: \"0D1E7FDE531761CDAA661DA41F8A0A42\"\r\nlast-modified: Tue, 28 Jul 2026 13:28:09 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: DR5/3lMXYc2qZh2kH4oKQg==\r\nx-oss-hash-crc64ecma: 15838709773511272833\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C83CEEA19D313476A03C\r\nx-oss-server-time: 3\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6075\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":6075,"size_decoded":6783,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"0d1e7fde531761cdaa661da41f8a0a42","sha1":"0e70a4b1e4a6e8736735a23cf6837630c65fed2b","sha256":"e02206eb31f5333fb4210ae639e2b5531c78cf5270b7117d39aa58adb490a8a6","sha512":"c678b7382fac7081b3f48a717427ab67b15b816d16d7c920d2ee718c24ba3c140cfc6625f3b9d3407dea1544f8dec8525c83ad509f844e972478811e82078791","ssdeep":"96:rGAj76oi+20X+Wqnf32fXEdtOeJLuKrVTYVLVgzmN9PzESZuXXn9gEvcV/QG:rG876sfXxqf3KXAOwLuKBMNVQESSZuX0","tlshash":"bac19d4a2a859d1bc706c33681917c9e06495720677afeec0fd4b5908e32374fba7b28","first_seen":"2026-10-09T17:19:18.894594Z","last_seen":"2026-10-09T18:33:13.79214Z","times_seen":7,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/p/3792/L1/SQ/hot/346/4/custom_VND.webp?p=1791191450","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.746Z","timestamp":1791570703746,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/p/3792/L1/SQ/hot/346/4/custom_VND.webp?p=1791191450 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76c2693a2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"9B34BACF74A239DCDBE54EB8DF24DDCC\"\r\nlast-modified: Sun, 27 Sep 2026 04:17:26 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: mzS6z3SiOdzb5U643yTdzA==\r\nx-oss-hash-crc64ecma: 3501807570915417094\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D36688D14B353458052C\r\nx-oss-server-time: 22\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19382\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":19382,"size_decoded":20125,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"9b34bacf74a239dcdbe54eb8df24ddcc","sha1":"878133798b64f29ba28e6917bbfb44b985a0536f","sha256":"1078a68d4cf3ac301c11f9b942f70da70df2ab95f98ad45fb27d6a68c277d2b7","sha512":"304dce926c2338e1eb962b106ee1d60f28f640f6ad71af0b68694765201fd49662da25bce70aaeb4bc9291aa5716fd4fe1614d34021af8e26a69cd2a938a4400","ssdeep":"384:y4XkKhQ3wxHLg6hAs3znAJcLaICegsMeQaKyjdF+ZgUY1sKt3ZO+UzoEmLo3e:y40uQwJL1hBznLLaxegJebr+ZgU0x3US","tlshash":"a792e19619b63a37cba7931c9010b478009982f772539e3a2230dd35ab5333395ee0cb","first_seen":"2026-10-09T17:45:43.839481Z","last_seen":"2026-10-09T18:33:13.794681Z","times_seen":4,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ytbacksexo.xyz/hall/api/agent/promote/getIpBindInfo","fqdn":"ytbacksexo.xyz","domain":"ytbacksexo.xyz","tld":"xyz"},"ip":{"addr":"8.233.17.31","port":443,"asn":3356,"as":"LEVEL3","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:44.458Z","timestamp":1791570704458,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ytbacksexo.xyz","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Tue, 29 Sep 2026 13:10:22 GMT","end":"Mon, 28 Dec 2026 14:06:17 GMT"},"fingerprint":{"sha1":"04:0A:47:19:B0:39:99:10:59:DF:86:B3:5D:7C:0A:9C:BD:E2:E6:E6","sha256":"31:E0:07:6A:95:AF:27:B6:02:96:5F:18:19:44:AA:81:D9:DF:02:17:C7:1E:25:ED:01:84:C0:20:BB:82:4E:FB"}}},"request":{"raw":"OPTIONS /hall/api/agent/promote/getIpBindInfo HTTP/1.1\r\nHost: ytbacksexo.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: appsystem,appversion,browserfingerid,browsertype,clienttimezone,content-type,currency,device,devicebrand,devicemodel,domain,language,operatingsystem,physicaldevicemodel,platformtype,sitecode,timestamp,token,webauthndomain,x-custom-referer,x-data-mode,x-device,x-object-id,x-request-id,x-version\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 200 \r\ndate: Fri, 09 Oct 2026 18:31:44 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 0\r\nset-cookie: acw_tc=0a0ccbbf17915707048092601e7629d92c9c4bcdb14a3b88e1591c270179ca;path=/;HttpOnly;Max-Age=1800\r\nx-saas-server-id: 8576b68756-bzhs5|a5b3b6cb4fd8340d6eda622685bde084\r\naccess-control-allow-methods: *\r\naccess-control-max-age: 1728000\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: appsystem,appversion,browserfingerid,browsertype,clienttimezone,content-type,currency,device,devicebrand,devicemodel,domain,language,operatingsystem,physicaldevicemodel,platformtype,sitecode,timestamp,token,webauthndomain,x-custom-referer,x-data-mode,x-device,x-object-id,x-request-id,x-version\r\naccess-control-expose-headers: X-Trace-ID, newjwt, token\r\nvia: 1.1 google\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":[{"name":"acw_tc","value":"0a0ccbbf17915707048092601e7629d92c9c4bcdb14a3b88e1591c270179ca","quoted":false,"path":"/","max_age":1800,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"acw_tc=0a0ccbbf17915707048092601e7629d92c9c4bcdb14a3b88e1591c270179ca;path=/;HttpOnly;Max-Age=1800"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":0,"size_decoded":908,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-09T20:29:43.461907Z","times_seen":18980891,"resource_available":true,"data":null}},"time_used":533,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":533,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ytbacksexo.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-1/common/_sprite/icon_dt_1yeb.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.090Z","timestamp":1791570703090,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-1/common/_sprite/icon_dt_1yeb.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76be4ce92efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24490\r\ncache-control: max-age=604800,public\r\netag: \"C3DB77206D839968F436B470E28783AB\"\r\nlast-modified: Fri, 25 Sep 2026 04:47:12 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: w9t3IG2DmWj0NrRw4oeDqw==\r\nx-oss-hash-crc64ecma: 3165300906541928178\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D364AFBCCE3535FB1107\r\nx-oss-server-time: 17\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 960\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":960,"size_decoded":1629,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c3db77206d839968f436b470e28783ab","sha1":"b21f7a5052f853a83c2b5c51bdd245b6f0f60716","sha256":"423dbb616657f6a05f986f10f0776100196254ac9129ab49e37f358b3661f51e","sha512":"9f38911a90e2d9f9971cfdf8048bcb8d8f3750c340cfa655caa9d96e826393889ff91bebb584c0e695953b8914777508a5784feb0fff265c2781434934fee942","ssdeep":"","tlshash":"1e11c82d91f681e6c855be809b3e27c017d78130addae57284ed102010d99b2bedbc26","first_seen":"2026-10-09T17:45:43.819628Z","last_seen":"2026-10-09T18:33:13.797584Z","times_seen":4,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/index.BruU-pvi.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.433Z","timestamp":1791570703433,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/index.BruU-pvi.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/GlobalEventListenerIndex.BYsJMIjY.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76c06ef32efa-OSL\r\ncf-cache-status: HIT\r\nage: 24674\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: dbxUaVF9H61tGFTG074rPQ==\r\nx-oss-hash-crc64ecma: 17177238314246614469\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D2ADA05E363636194084\r\nx-oss-server-time: 19\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2546,"size_decoded":1923,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (2545)","md5":"75bc5469517d1fad6d1854c6d3be2b3d","sha1":"cd570a7e3b0b275b34e68aede234a1c37983bb18","sha256":"5faf656bcef6f186a26efa238da30b515fa8ad342bfb6654b2471b6e71c04160","sha512":"efb6abdb8549d560d29dfd9379911c48f7d72b1d6334634746cbfc1613fe350bcc9b1bb003d52cba32bb82af97d5f3cd417729bc11d9e215acc2b8b99ace03a2","ssdeep":"","tlshash":"f351630ef3d872b439e9149d812196771286bd256d2890fce07f4f51db1a087e52e469","first_seen":"2026-10-09T17:19:18.756322Z","last_seen":"2026-10-09T18:33:13.802753Z","times_seen":7,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/common/upload/2092524560648949762.webp","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:46.816Z","timestamp":1791570706816,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /common/upload/2092524560648949762.webp HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D; g_state={\"i_l\":1,\"i_ll\":1791570704718,\"i_b\":\"AUD+1QJhwLFQIgL25h/mMPSBZUZ0nELdT6H4yLr7+QE\",\"i_e\":{\"enable_itp_optimization\":24},\"i_et\":1791570704718}\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:46 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76d59d772efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 25651\r\ncache-control: immutable,stale-while-revalidate=86400,public,max-age=86400\r\netag: \"7A6EB036ECF970A0D484A3545862D756\"\r\nlast-modified: Wed, 26 Aug 2026 08:08:31 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: em6wNuz5cKDUhKNUWGLXVg==\r\nx-oss-hash-crc64ecma: 7107222526779352141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8CEDFC05EDB333518BAE3\r\nx-oss-server-time: 13\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 156292\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":156292,"size_decoded":157002,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7a6eb036ecf970a0d484a3545862d756","sha1":"99def03e99cfcd828fca4360a09389916cb6d4b0","sha256":"a8fef4eb7ecc1b2e11f3bbf66e0b88432af7fb8c8540e94a93cc56a25b18d839","sha512":"b9656b0decb8693ecf078093d7e7f8d9fa830b128ba7f9a5a7edef2f211d1d379052cb61186e6fe59c1be85ff4da3635b9d48f5d4a4b48ae64a52d5cc18db4f4","ssdeep":"3072:TMqRqc1Lx4gJRHgvrXLXKD6jfeQiLHAY3okYOvD2RUuoepxD:AUqc1x4kRHgvrXbo6jfniLgY3okmroev","tlshash":"80e3120d06d6748ae913bcf88122455b758fe97502a6737c342e732e399904dda3fe2b","first_seen":"2026-10-09T17:45:43.777284Z","last_seen":"2026-10-09T18:33:13.806228Z","times_seen":4,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":17,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"140.150.33.90/agespeed.txt?t=1791570708931","fqdn":"140.150.33.90","domain":"140.150.33.90","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:48.940Z","timestamp":1791570708940,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /agespeed.txt?t=1791570708931 HTTP/1.1\r\nHost: 140.150.33.90\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nConnection: keep-alive\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-09T20:29:43.461907Z","times_seen":18980891,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-1/common/_sprite/icon_btm_yh1.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.106Z","timestamp":1791570703106,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-1/common/_sprite/icon_btm_yh1.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76be6d062efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 23458\r\ncache-control: max-age=604800,public\r\netag: \"5EE36AFB2602B1FE4F9681ACDA10BFDC\"\r\nlast-modified: Fri, 25 Sep 2026 04:55:08 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: XuNq+yYCsf5PloGs2hC/3A==\r\nx-oss-hash-crc64ecma: 16424811152150534189\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D76C34AB6E323585AF77\r\nx-oss-server-time: 3\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 484\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":484,"size_decoded":1153,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5ee36afb2602b1fe4f9681acda10bfdc","sha1":"5e081b3370925e524f0452602cb28082399cc554","sha256":"e6ffff5c524b1513a82dbe784ea3e262c7c5046f4423130688b4e99dc707ee9b","sha512":"77cadca4f3abbc8ae88994fbe7def871facccfd8623a682a1c0af20a0f6805daf801d0397a8ac5a556fa7bc35daed4ef40f84105a2d961bd497c004c3b200aa6","ssdeep":"","tlshash":"60f05425d28f2ec1cd19c6f632e6946a0757c20922fa2b15d7ca00c7b44750141b4f75","first_seen":"2026-10-09T17:45:43.600527Z","last_seen":"2026-10-09T18:33:13.808663Z","times_seen":4,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/common/common/home/img_game_tj1_zj.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.483Z","timestamp":1791570703483,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/common/common/home/img_game_tj1_zj.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c0bf292efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: max-age=604800,public\r\netag: \"89E6B52266A7F59B6D4577D4386F5CB6\"\r\nlast-modified: Wed, 23 Sep 2026 00:36:34 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: iea1Iman9ZttRXfUOG9ctg==\r\nx-oss-hash-crc64ecma: 14499579524150722030\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D36694539438305ABB99\r\nx-oss-server-time: 21\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 982\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":982,"size_decoded":1652,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"89e6b52266a7f59b6d4577d4386f5cb6","sha1":"74b20bd9cc0373d4b427433341ec7d957e9a0345","sha256":"e1661304019519f9b7eedf804ff08a764615fa6022763faa37d2140ba4ffd335","sha512":"99d52848aefffaa429af36d1b8fd3eca6162c514e965c3c92e58143e0f82ad1a98faa11a4d31706cbbcf1202a8a38341bf749af2fe12a4e16d318395de9aa874","ssdeep":"","tlshash":"81110c99072553728df92f3e1a6be61632742029c40ef301c60306f555f04a94ebe710","first_seen":"2026-10-03T13:22:48.478446Z","last_seen":"2026-10-09T18:33:13.810587Z","times_seen":21,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ytbacksexo.xyz/hall/api/agent/promote/getIpBindInfo","fqdn":"ytbacksexo.xyz","domain":"ytbacksexo.xyz","tld":"xyz"},"ip":{"addr":"8.233.17.31","port":443,"asn":3356,"as":"LEVEL3","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:44.456Z","timestamp":1791570704456,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ytbacksexo.xyz","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Tue, 29 Sep 2026 13:10:22 GMT","end":"Mon, 28 Dec 2026 14:06:17 GMT"},"fingerprint":{"sha1":"04:0A:47:19:B0:39:99:10:59:DF:86:B3:5D:7C:0A:9C:BD:E2:E6:E6","sha256":"31:E0:07:6A:95:AF:27:B6:02:96:5F:18:19:44:AA:81:D9:DF:02:17:C7:1E:25:ED:01:84:C0:20:BB:82:4E:FB"}}},"request":{"raw":"POST /hall/api/agent/promote/getIpBindInfo HTTP/1.1\r\nHost: ytbacksexo.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: vi\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nContent-Length: 62\r\nReferer: https://ad852.xyz/\r\nx-object-id: {\"uid\":\"\",\"browserLanguage\":\"en-US\",\"init\":{\"device\":\"\",\"created\":1791570702472,\"version\":1791251963000}}\r\nplatformType: 5\r\nx-device: 1-5\r\nx-data-mode: plain\r\nx-request-id: 6d4b6ef5-41c4-45aa-85bb-3eb73135ae56\r\ndevice: 8034c51c-91ec-430d-af2a-41881722443b\r\ncurrency: VND\r\ntimestamp: 1791570703\r\nsiteCode: 3792\r\nlanguage: vi\r\ntoken: b2e3d672-9d88-47a7-81b4-9d7ffc62054f\r\ndeviceModel: Firefox v134.0\r\nphysicalDeviceModel: unknown\r\noperatingSystem: Windows\r\ndeviceBrand: unknown\r\nbrowserType: Firefox v134.0\r\nappSystem: Windows 10\r\ndomain: ad852.xyz\r\nwebauthnDomain: ad852.xyz\r\nclienttimezone: 0\r\nx-custom-referer: https://ad852.xyz/\r\nx-version: 7.5.141\r\nappVersion: v7.5.141\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nbrowserfingerid: \r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":62,"data":"{\"agentName\":\"\",\"channelId\":0,\"currency\":\"\",\"time\":1791570703}"}},"response":{"raw":"HTTP/3 200 \r\ndate: Fri, 09 Oct 2026 18:31:45 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 139\r\nset-cookie: acw_tc=0a094ea017915707053437426e2f6b6a7c4961634d11cf58c68b3f8502d98f;path=/;HttpOnly;Max-Age=1800\r\nx-trace-id: 1295586e84cb4458\r\nx-env-go-biz-agent-server: 0\r\ncache-control: no-cache\r\nx-saas-server-id: 8576b68756-xsmlc|54386cd97f638e7aecf8405ca4b0682b\r\naccess-control-allow-methods: *\r\naccess-control-max-age: 1728000\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Trace-ID, newjwt, token\r\nvia: 1.1 google\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":[{"name":"acw_tc","value":"0a094ea017915707053437426e2f6b6a7c4961634d11cf58c68b3f8502d98f","quoted":false,"path":"/","max_age":1800,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"acw_tc=0a094ea017915707053437426e2f6b6a7c4961634d11cf58c68b3f8502d98f;path=/;HttpOnly;Max-Age=1800"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":139,"size_decoded":815,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"24ae394db66f0935b0145154c6b0324e","sha1":"511abf106dc10e538b0f755712273407d1c9ffd7","sha256":"726aeebf7cd89f416fe70db7ef6ad15b22775573bc5332ffae2366fe55f588d2","sha512":"18a6248d31f7b010e08b5894ad1a435533179ad728ecf0ccbebed910b0f6801853d821dd855ac7a9a27046ca03b50cbca75f62954e84952448b9ce367b5ee753","ssdeep":"","tlshash":"cdc02b4111784271ca01139c3196d1e8a1190306796ad7a9dc0f0c1480bd0aaa110338","first_seen":"2026-10-09T18:33:13.812521Z","last_seen":"2026-10-09T18:33:13.812521Z","times_seen":1,"resource_available":true,"data":null}},"time_used":528,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":528,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ytbacksexo.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/common/upload/2096447614452404226.webp","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:46.815Z","timestamp":1791570706815,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /common/upload/2096447614452404226.webp HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D; g_state={\"i_l\":1,\"i_ll\":1791570704718,\"i_b\":\"AUD+1QJhwLFQIgL25h/mMPSBZUZ0nELdT6H4yLr7+QE\",\"i_e\":{\"enable_itp_optimization\":24},\"i_et\":1791570704718}\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:46 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76d59d752efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 25651\r\ncache-control: immutable,stale-while-revalidate=86400,public,max-age=86400\r\netag: \"8ACD422333006EC39ABCCEBBC4F76E88\"\r\nlast-modified: Sun, 06 Sep 2026 03:57:31 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: is1CIzMAbsOavM67xPduiA==\r\nx-oss-hash-crc64ecma: 12682929617961912050\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8CEDFFE67F331370DDFBA\r\nx-oss-server-time: 24\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 449132\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":449132,"size_decoded":449843,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8acd422333006ec39abccebbc4f76e88","sha1":"cdb558b7f09029f40d415ecd09c0e35f3e8f7ff7","sha256":"0550b76db1550295d42cf1c1a16b91afe14715f0e48935c1f15c28b69fca246c","sha512":"a06ff830d1075944b8c5fade2a9104bd8dfc1f62c69ddeac91726d59d1ce89a87d7323f920b71e7ee95224de19c8512d6e755911f717babc6d88e820ff1c262e","ssdeep":"12288:81HuAtmE4bEz698JIjnznxUBlpW5xknyPodeQHQ+tpHu5X:cb94bKQaI/ncluxJowuQGG","tlshash":"f4a423182729d063e175843d9b70b52b9a9348be427e0d738246ec61f4f2d35bb6cf25","first_seen":"2026-10-09T17:45:43.841823Z","last_seen":"2026-10-09T18:33:13.819654Z","times_seen":4,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webpushstat-sgp.engagelab.com/v4/web/report","fqdn":"webpushstat-sgp.engagelab.com","domain":"engagelab.com","tld":"com"},"ip":{"addr":"43.163.81.198","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:46.867Z","timestamp":1791570706867,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.engagelab.com","organization":""},"issuer":{"commonName":"RapidSSL TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 25 Aug 2026 00:00:00 GMT","end":"Thu, 11 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"2D:37:4A:17:47:09:76:A5:C3:14:DA:C6:FA:75:C8:68:99:90:1A:D0","sha256":"5A:9B:4F:D1:E3:1F:F2:80:4A:C1:E3:15:B5:C1:05:A0:28:53:24:47:F0:25:6B:88:22:2B:1E:BD:C3:5F:F7:F1"}}},"request":{"raw":"OPTIONS /v4/web/report HTTP/1.1\r\nHost: webpushstat-sgp.engagelab.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 204 No Content\r\nServer: nginx\r\nDate: Fri, 09 Oct 2026 18:31:47 GMT\r\nConnection: keep-alive\r\nAccess-Control-Allow-Headers: authorization,content-type\r\nAccess-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE\r\nAccess-Control-Allow-Origin: *\r\nVary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":332,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-09T20:29:43.461907Z","times_seen":18980891,"resource_available":true,"data":null}},"time_used":996,"timings":{"blocked":0,"dns":0,"connect":248,"send":0,"wait":249,"receive":0,"ssl":499},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_PromoteChunk.BvzSHz24.css","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.911Z","timestamp":1791570702911,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/1_PromoteChunk.BvzSHz24.css HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: text/css\r\ncontent-encoding: br\r\ncf-ray: a47f76bd2bef2efa-OSL\r\ncf-cache-status: HIT\r\nage: 27344\r\ncache-control: max-age=31622400\r\npriority: u=2,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:01 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: lx5Wj8RtOhyd3Z6tkkvCvA==\r\nx-oss-hash-crc64ecma: 18166894420361356767\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C83E7594F93835B2D911\r\nx-oss-server-time: 3\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":238471,"size_decoded":30800,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"971e568fc46d3a1c9ddd9ead924bc2bc","sha1":"68a74b63ea099f98fff56fc4e3f4c99ca4dadd56","sha256":"3dc7a51bb91d11c4e2bb80e10a793f67dedbb0180dc39dcfe43a43eeb45fc005","sha512":"3b9a64ed31121ddad808328a58f7110470442a07cef07060b5ccdb77e3c8d2671a0a1ef03a6495b651ea5683f9c869733fc2c90bf0ef8922fcc239c08abe4e80","ssdeep":"1536:Jah6M/g3fzlEPTWnij/025++cYocnGQorsRKS8s9gMxipLNtdDqi1GzIp1tovMYM:Q6MlTXj/0CxipLNtIlkHccdwISQY86A","tlshash":"a834b79e5e70723ae82fe533bee5d7c86154b020c51226d6fa334d2d4bc6bb638b1119","first_seen":"2026-10-07T11:29:32.624479Z","last_seen":"2026-10-09T18:33:13.840553Z","times_seen":5,"resource_available":true,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-1/common/common/bg_pattern_tile.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.046Z","timestamp":1791570703046,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-1/common/common/bg_pattern_tile.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76be0c882efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24490\r\ncache-control: max-age=604800,public\r\netag: \"4F1E4E1EA7E91F5FB5D753540B49CA3D\"\r\nlast-modified: Fri, 25 Sep 2026 04:53:38 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: Tx5OHqfpH1+111NUC0nKPQ==\r\nx-oss-hash-crc64ecma: 5324194202656068037\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D364A87B9A393199F04B\r\nx-oss-server-time: 2\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 134\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":134,"size_decoded":802,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4f1e4e1ea7e91f5fb5d753540b49ca3d","sha1":"a1bb2aa835448eb5dc277ada1d6570e6b5965775","sha256":"d6142bccb69c7d5d771ff2b74b49dcc3eaeeacc129204234fd5e99e4010949d0","sha512":"3228f9c07832403492bda6fdc66c1b38853fc6dcd4afcda1324cae4c8fd20c5ecea9bc2517c168d1482c1daafb7857a0d1f22825f537530a343e4a55e21a9033","ssdeep":"","tlshash":"07c09290125a6962e80f5cb467bb8abac563408852b1ac800eaae5b431106362a778a8","first_seen":"2024-08-11T19:54:07Z","last_seen":"2026-10-09T18:33:13.856458Z","times_seen":21,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-1/common/home/btn_dtfl_yxcd1.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.077Z","timestamp":1791570703077,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-1/common/home/btn_dtfl_yxcd1.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76be3cca2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24490\r\ncache-control: max-age=604800,public\r\netag: \"3C37CC6B2B3C0DD674AB78306B3022FA\"\r\nlast-modified: Fri, 25 Sep 2026 04:52:14 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: PDfMays8DdZ0q3gwazAi+g==\r\nx-oss-hash-crc64ecma: 9412204369323697064\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D364A87B9A393137F14B\r\nx-oss-server-time: 15\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1052\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":1052,"size_decoded":1722,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"3c37cc6b2b3c0dd674ab78306b3022fa","sha1":"cc399910dab45ba3e439d6bca8b0b40ade8e15f8","sha256":"fed6222d213b9b8c904a003a419d474fc9bff490f57611a595c8a96b095f99fe","sha512":"f0e4a374a2e3cf9750c82a9fd345482d25666b89aaa821249d56f8db0c630809c3add246aef1d3b8ad56a7979226ebe09394866d30a6309e5f23ee710dd9e0d8","ssdeep":"","tlshash":"9911a833e89c9256fbf9f9b1586b11aba4f444f06ca05487044649fcf56d362b030765","first_seen":"2026-10-09T17:45:43.632903Z","last_seen":"2026-10-09T18:33:13.859018Z","times_seen":4,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/vendors/vendor-swiper.BQ_VG6mx.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.410Z","timestamp":1791570703410,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/vendors/vendor-swiper.BQ_VG6mx.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/AsyncAsideIndex.DJTJPSZz.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76c04ee12efa-OSL\r\ncf-cache-status: HIT\r\nage: 27342\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: 2U+OpJ0MX5V37gohapDrDg==\r\nx-oss-hash-crc64ecma: 6952732722908316628\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C840669A4C3532AF7649\r\nx-oss-server-time: 3\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":111837,"size_decoded":34414,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"d94f8ea49d0c5f9577ee0a216a90eb0e","sha1":"4e3973ba9347e48e59425e410ddfb6523e15c340","sha256":"eefe97f89ebb89a9edeb07ca29c2c8465e3b025bcf1a3eb7612e298122a0eafa","sha512":"d063bf53ad40fc4bd039e32ff6e1196c547ba6b91a69e29b89bb830a63aecc4e8fa876a58e56234432d0a4f2f78e0becb10308d6be424f5c67abebbc0e576779","ssdeep":"1536:wTfptYZ8Wdd23B39snwDmvj+P40Ie27vTNjdPKoFxq/4BlxvHr+CEIkpXiA6wKb3:wza23B3K+PuxHNLq/87RgPG","tlshash":"e3b30989a224757742fb1ada83758201b2b04854f809d4e4b0fd9d7f497e99803aeffd","first_seen":"2026-10-09T17:19:19.151562Z","last_seen":"2026-10-09T18:33:13.862338Z","times_seen":7,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/315/3/3150049/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.657Z","timestamp":1791570703657,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/315/3/3150049/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c1d8ab2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"C1C74AF28B912A5CAE388CC495111E1C\"\r\nlast-modified: Sun, 27 Sep 2026 04:54:04 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: wcdK8ouRKlyuOIzElREeHA==\r\nx-oss-hash-crc64ecma: 9247638227402969830\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D366AFBCCE3535662A07\r\nx-oss-server-time: 14\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 17354\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":17354,"size_decoded":18097,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c1c74af28b912a5cae388cc495111e1c","sha1":"86401a98b1dcff37fbf928f9fe6f4ad27b75183e","sha256":"7306d7d36c8d749940a9e0899e0f5d0c61eb23bc28dc4fb439c79131bbf7164d","sha512":"68a662532e0f9bf6ee231848a9046c1d3f4e9cfe29c777e64079f1de4ce083d380fbb790b12cd7599e13855d68cf05e642e97e087f197a89031cefaf32d3664a","ssdeep":"384:adfstJ+Z+lp2ip7XXY5LdNQgB7AcaNy4/8924kar9:FJU+b5HY7NQgB7sgD24kar9","tlshash":"3272d037065e8e108b6e7804bb2fa5b29bc5050ae7403df1c794992e79645eefa09c33","first_seen":"2026-10-09T17:45:43.77967Z","last_seen":"2026-10-09T18:33:13.865774Z","times_seen":4,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/369/3/3690030/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.658Z","timestamp":1791570703658,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/369/3/3690030/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c1d8ac2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"EE7DC6424D454AF04B0BD40C92F69796\"\r\nlast-modified: Sun, 27 Sep 2026 04:21:10 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: 7n3GQk1FSvBLC9QMkvaXlg==\r\nx-oss-hash-crc64ecma: 634275205021993032\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D3664005843436777882\r\nx-oss-server-time: 15\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 23248\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23248,"size_decoded":23990,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ee7dc6424d454af04b0bd40c92f69796","sha1":"065f4c249ad37c334e90fb5c4636508a3a1c2352","sha256":"f402c44dd783fdef0140f36b1f5d91e9c522f098b9f40257988142758f335af4","sha512":"b08b3aea53c9d8cb682919a45913b6658aa2313ebefb1aec8a057d80a9b24dc23af8c3072a9be936ef989e8b984034b02dfdc09284d1383a7870359f5c34c377","ssdeep":"384:nKpOdH8tdiltkdC1hyol2JHHrSqM5s+t40apOYV3rGQAn7:nuOudigCwoB5j4T1V7GQU","tlshash":"bba2e1256da5f7b0c8cccff156992f9171bd3dc852c92b4af5ca0166188b3a058b3e0e","first_seen":"2026-10-09T17:45:43.505654Z","last_seen":"2026-10-09T18:33:13.868532Z","times_seen":4,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/315/3/3150049/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.758Z","timestamp":1791570703758,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/315/3/3150049/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76c2795d2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"C1C74AF28B912A5CAE388CC495111E1C\"\r\nlast-modified: Sun, 27 Sep 2026 04:54:04 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: wcdK8ouRKlyuOIzElREeHA==\r\nx-oss-hash-crc64ecma: 9247638227402969830\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D366AFBCCE3535662A07\r\nx-oss-server-time: 14\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 17354\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17354,"size_decoded":18097,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c1c74af28b912a5cae388cc495111e1c","sha1":"86401a98b1dcff37fbf928f9fe6f4ad27b75183e","sha256":"7306d7d36c8d749940a9e0899e0f5d0c61eb23bc28dc4fb439c79131bbf7164d","sha512":"68a662532e0f9bf6ee231848a9046c1d3f4e9cfe29c777e64079f1de4ce083d380fbb790b12cd7599e13855d68cf05e642e97e087f197a89031cefaf32d3664a","ssdeep":"384:adfstJ+Z+lp2ip7XXY5LdNQgB7AcaNy4/8924kar9:FJU+b5HY7NQgB7sgD24kar9","tlshash":"3272d037065e8e108b6e7804bb2fa5b29bc5050ae7403df1c794992e79645eefa09c33","first_seen":"2026-10-09T17:45:43.77967Z","last_seen":"2026-10-09T18:33:13.865774Z","times_seen":4,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/register.impl.Cio1qJTM.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.904Z","timestamp":1791570702904,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/register.impl.Cio1qJTM.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/commonChunk.0oGKmx_H.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76bd1be92efa-OSL\r\ncf-cache-status: HIT\r\nage: 27344\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: fDxVYyStR0JoPR86GAw0lQ==\r\nx-oss-hash-crc64ecma: 11436079089921708028\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C83E2319383736307A57\r\nx-oss-server-time: 3\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4070,"size_decoded":2554,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (4069)","md5":"7c3c556324ad4742683d1f3a180c3495","sha1":"d927eb35601e18c47a65dd0d9fb7b4f843c7149d","sha256":"17aefb2de129edd94a10d13b0ef46e2b993f67f3ae950332ccfe004a7ab68ecf","sha512":"aae71d6be648b653cb2f3e4baa300a6eb0d65c9fd2eaef2bdd1ed750c7dc20e125692fa2f7e06a92e6a48cbf982b8340c6999df0e9de39f73074503c71b7ac78","ssdeep":"","tlshash":"c581e84e6b2c80312aa485e2993f6fa3557611253d488094f63ece90f60d4c763a87bf","first_seen":"2026-10-09T17:19:18.961631Z","last_seen":"2026-10-09T18:33:13.870492Z","times_seen":7,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/libs/browser-media-match@0.0.6/index.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.119Z","timestamp":1791570702119,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /libs/browser-media-match@0.0.6/index.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76b838702efa-OSL\r\ncf-cache-status: HIT\r\nage: 27347\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: brxcA4Gn1egzJNj0T74FWg==\r\nx-oss-hash-crc64ecma: 13106139430498415699\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C83AE702E23035CCC042\r\nx-oss-server-time: 3\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3248,"size_decoded":2003,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (3248), with no line terminators","md5":"6ebc5c0381a7d5e83324d8f44fbe055a","sha1":"716c0c49b5eed05fc5752e658e280a37b2eca14a","sha256":"048412edb70558ba3a98abb4c3b99982679f8a941df859d41b2f18e0f56fde56","sha512":"8ccc49138cb761ce38fe430bb63386fb187d6d8b25ca56c4cfabc915fd81b5eb38356c4cf7d3f522aac5fff047327db27e99f5141bef65c3cbd72c9e32d462e4","ssdeep":"","tlshash":"6e611f69767ab5194616b0b0998fd009bde9ad3613cc4845822d88f4f8799f8473fdcc","first_seen":"2025-06-26T13:19:27.401603Z","last_seen":"2026-10-09T19:17:20.721293Z","times_seen":16363,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/upload/img/2086060536948338689.png","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.226Z","timestamp":1791570702226,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/upload/img/2086060536948338689.png HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: image/png\r\npriority: u=6,i=?0\r\ncf-ray: a47f76b8e91a2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 27986\r\ncache-control: immutable,stale-while-revalidate=86400,public,max-age=86400\r\netag: \"5991FCCAB105B5351AEA86EB5A84D720\"\r\nlast-modified: Sat, 08 Aug 2026 12:02:44 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: WZH8yrEFtTUa6obrWoTXIA==\r\nx-oss-hash-crc64ecma: 4333458525956311755\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C5BBEEA19D3835E4351B\r\nx-oss-server-time: 7\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 94642\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":94642,"size_decoded":95352,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit colormap, non-interlaced","md5":"5991fccab105b5351aea86eb5a84d720","sha1":"001bff984bc35c9e40baae3fa6a75028ff7a5b2a","sha256":"c9f99e370f66964ee79cf633512dbb2230bfc4c74f7be85ecf87970d5a0037f5","sha512":"7a60b55e32f10d04bcd421b8156aa5db68394f8654e32375d2aec342f361704635ed04d3d75d2427d91b3aab9812d89d2e5204ba83776d0a8306d1d1b709ab7b","ssdeep":"1536:gL+TB1lhP6WmfaBWc70QdxSMQgV5R3may6qdk0JO/gNd63N/wNl84EqmvKoLH/A9:3TB1qfaBBVoMd1ry6q60PduRWPEqIr7w","tlshash":"13931228df9b0e57d393d70fa506d320101532246bb9aee603ba2dcd7a1b7a5d143e43","first_seen":"2026-10-09T17:19:18.751848Z","last_seen":"2026-10-09T18:33:13.873615Z","times_seen":7,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_SearchGameChunk.Q0GtNZtd.css","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.915Z","timestamp":1791570702915,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/1_SearchGameChunk.Q0GtNZtd.css HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: text/css\r\ncontent-encoding: br\r\ncf-ray: a47f76bd3bf92efa-OSL\r\ncf-cache-status: HIT\r\nage: 27344\r\ncache-control: max-age=31622400\r\npriority: u=2,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:01 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: fYccQLVHULpDNnyijtRRtA==\r\nx-oss-hash-crc64ecma: 2781807794932132279\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C83E637FD233310AAB01\r\nx-oss-server-time: 3\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43318,"size_decoded":7975,"mime_type":"text/css","magic":"ASCII text, with very long lines (43317)","md5":"7d871c40b54750ba43367ca28ed451b4","sha1":"2152fdb5f41c4b66207e040c97d6ebf44cbf6aa4","sha256":"01b790a625bbfe46a2d98796705846e204954f5c91f8dd2b9c4b1c9e4bbad4a5","sha512":"c36106d4898ecbedbd36c3e9f68abfb2f26276efdff3622903e2d316a61d527422e9f1c8efffd04a3af4290589f8c9fccf5fe8960097bfb837595a913a1c6fdc","ssdeep":"768:n5JD6h4H0Coojen7HrwKP7Yg2opVcqgCvItGOOqhKqVkX0UknEY6IGj/FgCXVVUB:n5JD6h4o3rjXV3cavItGO5hKqVklpA","tlshash":"5913c8164930f63a992b97353af4eb8c94446420ea236712fb539e2f87d77b20631378","first_seen":"2026-09-27T17:53:43.384757Z","last_seen":"2026-10-09T18:33:13.879992Z","times_seen":5,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webpushstat-sgp.engagelab.com/v4/web/report","fqdn":"webpushstat-sgp.engagelab.com","domain":"engagelab.com","tld":"com"},"ip":{"addr":"43.163.81.198","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:46.864Z","timestamp":1791570706864,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.engagelab.com","organization":""},"issuer":{"commonName":"RapidSSL TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 25 Aug 2026 00:00:00 GMT","end":"Thu, 11 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"2D:37:4A:17:47:09:76:A5:C3:14:DA:C6:FA:75:C8:68:99:90:1A:D0","sha256":"5A:9B:4F:D1:E3:1F:F2:80:4A:C1:E3:15:B5:C1:05:A0:28:53:24:47:F0:25:6B:88:22:2B:1E:BD:C3:5F:F7:F1"}}},"request":{"raw":"POST /v4/web/report HTTP/1.1\r\nHost: webpushstat-sgp.engagelab.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nContent-Length: 139\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nAuthorization: Basic MTgwNjIyMzQ5MTo2ZTdmMmI1OWIwNDJkMzYyNWNkZTE4ZjBjM2FlNGZjOQ==\r\nConnection: keep-alive\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":139,"data":"{\"platform\":\"b\",\"uid\":1806223491,\"app_key\":\"9ec737c30e02452cba9b30ce\",\"channel\":\"\",\"content\":[{\"type\":\"active_launch\",\"itime\":1791570706}]}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 09 Oct 2026 18:31:47 GMT\r\nContent-Type: application/json\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nVary: Origin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":941,"mime_type":"application/json","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-09T20:29:43.461907Z","times_seen":18980891,"resource_available":true,"data":null}},"time_used":175,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":175,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-1/common/home/btn_dtfl_yxcd.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.079Z","timestamp":1791570703079,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-1/common/home/btn_dtfl_yxcd.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76be3ccf2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 3074\r\ncache-control: max-age=604800,public\r\netag: \"C5E222F2EE7E00D2E366537A28FD41CB\"\r\nlast-modified: Fri, 25 Sep 2026 04:47:12 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: xeIi8u5+ANLjZlN6KP1Byw==\r\nx-oss-hash-crc64ecma: 7045450534951978358\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC9270C75AAC53738487A5F\r\nx-oss-server-time: 18\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 880\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":880,"size_decoded":1548,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c5e222f2ee7e00d2e366537a28fd41cb","sha1":"f650e9afa2f3cc79d50aaef078caa10588f0e720","sha256":"cb37d2488be81c05ebc0a6dc2c5f9afa9be0f0d066a497662de062623036d8e7","sha512":"d11ba28f1167956a9c4ca12cce503851284a9726756d2cf0dab0bb01b6710ac6f2e2325701e0b76aa929a1ca3e95721e5bddfee340c965868b01beb3a1160fb3","ssdeep":"","tlshash":"8111b7a18ea32625d8079960148de1324846c0ad4969ecc2c11a02c438558191072b7c","first_seen":"2026-10-09T17:45:43.605441Z","last_seen":"2026-10-09T18:33:13.881945Z","times_seen":4,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-common/common/common/icon_topnav_vip.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.361Z","timestamp":1791570703361,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-common/common/common/icon_topnav_vip.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76bffe6d2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 3212\r\ncache-control: max-age=604800,public\r\netag: \"F64EA82C17BD710D0D281101173C57B7\"\r\nlast-modified: Fri, 25 Sep 2026 04:47:12 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: 9k6oLBe9cQ0NKBEBFzxXtw==\r\nx-oss-hash-crc64ecma: 17730579326017043829\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC92682637FD23034296876\r\nx-oss-server-time: 11\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3644\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":3644,"size_decoded":4314,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f64ea82c17bd710d0d281101173c57b7","sha1":"d26d0cf1ce1c332252d5c5088c8ae325f48c7851","sha256":"d1d6272546881be25fe4368cd3a5861d7c508f3460a4a4f4b956553fb737bb98","sha512":"74b23f1c99c030c053720d735945799192e3647da29fd4a4b8b12d5b214f58f86c158bb1d4f6a52a32e9b5d05235bf5a690dd3bd892bcf475edec46c99462117","ssdeep":"","tlshash":"5e715c5a6e638a959826551a12d0a88c8c15d43a4f6cca99678f0f47107d64efbd184c","first_seen":"2026-10-09T17:45:43.440626Z","last_seen":"2026-10-09T18:33:13.88443Z","times_seen":4,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_SearchGameChunk.BjzR6crl.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.399Z","timestamp":1791570703399,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/1_SearchGameChunk.BjzR6crl.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/AsyncAsideIndex.DJTJPSZz.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76c03ec82efa-OSL\r\ncf-cache-status: HIT\r\nage: 27342\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: PTMkLcwpChEt6DOeow+toA==\r\nx-oss-hash-crc64ecma: 14524887261925086341\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C8400A930635385CAD51\r\nx-oss-server-time: 2\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":118258,"size_decoded":33672,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (50182)","md5":"3d33242dcc290a112de8339ea30fada0","sha1":"83fff0b8d1f099b53dc48a8c7d7246484965a9a2","sha256":"be14fc6c652cc4c6c0ea575090bd88fddfeb844f63e438191df094a0ec9c236b","sha512":"4416088db8968244a530ab34972d2505c820b1f3f48ba3110e317e5d8da8f660d59ab385909541474f58e0123596d7a96b886e26467cbd3cfb8ce2ea6f994d37","ssdeep":"3072:lrtLcWmNVfBq6DSZXfoyd22PHGnQ+Mnc29Oc0OLD:lrJcWn/msO+D","tlshash":"a2c35c89b299b538b7fa5cd570a020c0b5345b066401d9fce0fb9d2523dfea4b7a6378","first_seen":"2026-10-09T17:19:19.088613Z","last_seen":"2026-10-09T18:33:13.886134Z","times_seen":7,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_EmbeddedGameChunk.Uh0kqRXD.css","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.578Z","timestamp":1791570702578,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/1_EmbeddedGameChunk.Uh0kqRXD.css HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: text/css\r\ncontent-encoding: br\r\ncf-ray: a47f76bb1a452efa-OSL\r\ncf-cache-status: HIT\r\nage: 27346\r\ncache-control: max-age=31622400\r\npriority: u=2,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:01 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: KOsth3aNjGcObYOHLuVMog==\r\nx-oss-hash-crc64ecma: 4401646764632444704\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C83C637FD23331848B01\r\nx-oss-server-time: 3\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":18957,"size_decoded":4004,"mime_type":"text/css","magic":"ASCII text, with very long lines (18956)","md5":"28eb2d87768d8c670e6d83872ee54ca2","sha1":"2c5f56d818cbc915c69ccd32ca6813fc85c26bf8","sha256":"fec3a536db8c6d4b64b0f407f92c0c5af630ebfec44a3e926e80bd9ec9d35915","sha512":"e14b50ecc704b6422e67a8aa99c31090194fb554cf44079aae7b3ef00501e532d1cb18898e0c0671e1328139927a208ceac466dd4f0a7f446462a69183c1bfc0","ssdeep":"384:H6RiDsAe1XJ+GFRqJfts1MaCZ7qZCnaC8ZEqgec6C7C86cegu6TARG3+SNqGKHsX:vDBQwss7qZCaC8ZEqgec6C7C86cegu6/","tlshash":"c7821c296548fc6ffd4bf7bd23a82128106ca4c2f5521e7c75f33d689897ae11e62430","first_seen":"2026-10-07T10:12:18.4068Z","last_seen":"2026-10-09T18:33:13.892908Z","times_seen":11,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-common/common/_sprite/icon_dtfl_dz_1.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.097Z","timestamp":1791570703097,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-common/common/_sprite/icon_dtfl_dz_1.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76be5cfa2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24490\r\ncache-control: max-age=604800,public\r\netag: \"2028BAFFCAC856F318C875A0F18F26FF\"\r\nlast-modified: Fri, 25 Sep 2026 04:47:12 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: ICi6/8rIVvMYyHWg8Y8m/w==\r\nx-oss-hash-crc64ecma: 3361106720449945998\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D364AFBCCE3535FA1207\r\nx-oss-server-time: 9\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2808\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2808,"size_decoded":3477,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2028baffcac856f318c875a0f18f26ff","sha1":"7740f93af71f6f060c27ca136796401bba1faf43","sha256":"7a723170d15833ab831cf3bc50d3e8c6366e82f47be156859437645ffdc5978b","sha512":"ed3163b3758104c56137b133c2156d3b252f228ee7a5204216fe1b34647277cd1ea81467daa87ecccabd7c6c784abf6bd40a16f2c83bc4e5e0542f1a2670d432","ssdeep":"","tlshash":"c0513aa600356f6d880a2ceb79e661349b4641adea4cb91a06b28533ff229f1442f07c","first_seen":"2026-10-09T17:45:43.449906Z","last_seen":"2026-10-09T18:33:13.89995Z","times_seen":4,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/upload/img/2104828404310900738.webp","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.890Z","timestamp":1791570703890,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/upload/img/2104828404310900738.webp HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c34a552efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 27341\r\ncache-control: immutable,stale-while-revalidate=86400,public,max-age=86400\r\netag: \"A49FB643610EB959170C2053374D8AB0\"\r\nlast-modified: Tue, 29 Sep 2026 06:59:45 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: pJ+2Q2EOuVkXDCBTN02KsA==\r\nx-oss-hash-crc64ecma: 6129279006791597757\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C842F1D29D3732C20FDF\r\nx-oss-server-time: 54\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 222594\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":222594,"size_decoded":223304,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a49fb643610eb959170c2053374d8ab0","sha1":"9c70eb25d95b793bef7be7df02b251b13cb18e55","sha256":"a05b29ff450fd013b229c11c0e0df6cf44883ae983a6ee2498331b5eb0b6e34c","sha512":"eb3a897697a1f029dbf8d6dd56388b7dc6b02fc2ab202d08407c7d78537354ce8fcce13aba3ef29de457fde595f77c1655201f7755a38cb89e2967e82244da09","ssdeep":"6144:OYK6P1QCagTUrkkv90U9pEyRnskjmBiA/71dS0:Od6P2FjrkVyeKmBiAhd1","tlshash":"6624121c4c82c928e156d5b3752e982ef633b851ab6ed8d62c53350774eb3b2b44f94c","first_seen":"2026-10-09T17:45:43.722664Z","last_seen":"2026-10-09T18:33:13.908446Z","times_seen":4,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":15,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/common/common/event/kjrk_icon_guanbi.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:46.814Z","timestamp":1791570706814,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/common/common/event/kjrk_icon_guanbi.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D; g_state={\"i_l\":1,\"i_ll\":1791570704718,\"i_b\":\"AUD+1QJhwLFQIgL25h/mMPSBZUZ0nELdT6H4yLr7+QE\",\"i_e\":{\"enable_itp_optimization\":24},\"i_et\":1791570704718}\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:46 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76d58d732efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 18564\r\ncache-control: max-age=604800,public\r\netag: \"95F85555C88FD9F70D809AD52907B1F4\"\r\nlast-modified: Wed, 07 Oct 2026 02:11:49 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: lfhVVciP2fcNgJrVKQex9A==\r\nx-oss-hash-crc64ecma: 17228192142490770148\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8EA8DAFCCE63630F765F7\r\nx-oss-server-time: 17\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 766\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":766,"size_decoded":1436,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"95f85555c88fd9f70d809ad52907b1f4","sha1":"25e64c7a81ea9fdcf60d9031ebefe8e70b08390f","sha256":"2dff8ae4271d8a192cde534f16824eddb3e1dc2bf56ef5883ba50d84a210bfb7","sha512":"e21d5bcdcd9a4ee19e33603ddb1c5240834ec6931b1590bf91bd5841859305e626110c8cd631ce3bf3b26cb7c4e813fca361193fb96e1c77b74af83b89676fd7","ssdeep":"","tlshash":"8b016a0405452452eb0c3f13254db7156165bb345270cd8b0ddd08b337b8e59577dcf8","first_seen":"2026-10-03T08:51:34.680237Z","last_seen":"2026-10-09T18:33:13.914291Z","times_seen":23,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"d9qj2d9ngy.vuprppwldvo.com/agespeed.txt?t=1791570708930","fqdn":"d9qj2d9ngy.vuprppwldvo.com","domain":"vuprppwldvo.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:48.939Z","timestamp":1791570708939,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /agespeed.txt?t=1791570708930 HTTP/1.1\r\nHost: d9qj2d9ngy.vuprppwldvo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nConnection: keep-alive\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-09T20:29:43.461907Z","times_seen":18980891,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/0_EntryLoginRegisterChunk.Cb8YE-N0.css","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.572Z","timestamp":1791570702572,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/0_EntryLoginRegisterChunk.Cb8YE-N0.css HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: text/css\r\ncontent-encoding: br\r\ncf-ray: a47f76bb0a412efa-OSL\r\ncf-cache-status: HIT\r\nage: 27346\r\ncache-control: max-age=31622400\r\npriority: u=2,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:01 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: Qa229h6daH5H+Qwx/S7eJw==\r\nx-oss-hash-crc64ecma: 11081247039279855971\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C83CE9CC4C3133B6BEC4\r\nx-oss-server-time: 5\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":116981,"size_decoded":18243,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"41adb6f61e9d687e47f90c31fd2ede27","sha1":"b3a7c16befd78d6702b240779ca104687843b9f0","sha256":"0471f7e72ed75e733f21ee0469abc2f81703add56783487ae2c5109944820819","sha512":"d047140bbbfa7deec29a376364e15eba169d99ff586daded67811fe89715a84290e4b1c83341cd28ca2576df214c8bdcce9aa88788a561d6142b4b78a1ca6204","ssdeep":"1536:mSucbj+NtV47bD2OZaJedXY7Whu8cDw1Lc/TWC/VKuz8AoM6m+RcuLxErZhv0Ruh:mSucbAV47bD2Iu8cM1LcLWY","tlshash":"c6b3e719aa70b13b9c2bd136edf2f7e85086f010d61202d2ee536d1e47cebb61971719","first_seen":"2026-10-07T11:47:53.578961Z","last_seen":"2026-10-09T18:33:13.918248Z","times_seen":11,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/index.DA9GMHKq.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.902Z","timestamp":1791570702902,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/index.DA9GMHKq.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/commonChunk.0oGKmx_H.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76bd1be12efa-OSL\r\ncf-cache-status: HIT\r\nage: 27344\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: AUGBlD2jyne+Lkju7VDI4g==\r\nx-oss-hash-crc64ecma: 13113393975363667319\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C83E23193837360A7A57\r\nx-oss-server-time: 3\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6394,"size_decoded":3490,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (6393)","md5":"014181943da3ca77be2e48eeed50c8e2","sha1":"5d68b295874874e9b430e1512d7f279363bee07d","sha256":"6231bb7634726c6cfe599093e8b918a809fbab6bbd5fa70ad612deea26d63b5b","sha512":"8280b7bd422e89a37809aefc1c380c8a10e55d748830c361eaa44a4c34abb9a47b044bff46a1812302f6885ae12f6e9053633625624f9b6844849da4d00b8428","ssdeep":"192:L26q2KYUNw3NJRLzDVWS+AKGxK34+f5M21Nrhf0MgADxYYd:L26q2zUNANfHVQ6c34CC2rrhf0MgADxJ","tlshash":"d7d10989d0b5b07638f98dcde0b413625020b8547982c8f061f76f6ab247286e3bfb5d","first_seen":"2026-10-09T17:19:19.087643Z","last_seen":"2026-10-09T18:33:13.922445Z","times_seen":7,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_MineChunk.DK19R5qV.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.401Z","timestamp":1791570703401,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/1_MineChunk.DK19R5qV.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/AsyncAsideIndex.DJTJPSZz.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76c03eca2efa-OSL\r\ncf-cache-status: HIT\r\nage: 27342\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: 1mn1xCwQ+loWH0fsTmTOMA==\r\nx-oss-hash-crc64ecma: 9061189704224365905\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C840EEA19D3134EAD93C\r\nx-oss-server-time: 3\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":116304,"size_decoded":36303,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (64459)","md5":"d669f5c42c10fa5a161f47ec4e64ce30","sha1":"944921367320663545e68d4cb95a3bbd574de310","sha256":"dba1270162ac1fc5167a6000d93d07529756854e06572cba6692cbfc5e9f05a2","sha512":"b15c53122aee281fdbc93d6aee2d88c41e8c87744bd92d42b73250d49416d6004f4943c7b6b14cee320cd2997cc7a42145882a5b3fce9e09cac96ecc37adcbd4","ssdeep":"3072:lruj+LSJdYSV8H40DBxaeID13pJ78DOr6OCGDbteldFGVJE9:lruj+LILJQE6OCGV+FG09","tlshash":"16b34a81b25ba1b5abaa2d9ca0344875465c1f85ea41dcf8f27f4b2153f6b11f3e0b21","first_seen":"2026-10-09T17:19:19.07579Z","last_seen":"2026-10-09T18:33:13.923938Z","times_seen":7,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"wss://conn.webpush.theengagelab.com/","fqdn":"conn.webpush.theengagelab.com","domain":"theengagelab.com","tld":"com"},"ip":{"addr":"43.134.137.157","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:46.096Z","timestamp":1791570706096,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.webpush.theengagelab.com","organization":""},"issuer":{"commonName":"RapidSSL TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 07 May 2026 00:00:00 GMT","end":"Sat, 21 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"CF:43:D4:33:C6:77:40:E1:A8:79:10:1A:3A:DA:E1:9C:70:B5:1B:EC","sha256":"D1:4F:71:7C:73:4A:0C:A4:15:EF:41:41:B5:F8:DF:41:F4:2C:47:8A:D4:DA:BE:15:E6:37:7A:67:F8:4A:64:AB"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: conn.webpush.theengagelab.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://ad852.xyz\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: JEfeQ1NH1m1iO4GULP4uVw==\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nServer: nginx\r\nDate: Fri, 09 Oct 2026 18:31:46 GMT\r\nConnection: upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Accept: 6nR8to3YXlZ2dBrdkglV64O+8uQ=\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"WebSocket","description":"WebSocket is a communication protocol that provides full-duplex communication channels over a single, long-lived connection, enabling interactive communication between web browsers and servers.","website":"https://en.wikipedia.org/wiki/WebSocket","common_platform_enumeration":"","icon":"WebSocket.svg","categories":["Miscellaneous"]}],"data":{"size":0,"size_decoded":181,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-09T20:29:43.461907Z","times_seen":18980891,"resource_available":true,"data":null}},"time_used":525,"timings":{"blocked":0,"dns":0,"connect":174,"send":0,"wait":174,"receive":0,"ssl":178},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-09T18:31:34.926Z","timestamp":1791570694926,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 09 Oct 2026 18:31:41 GMT\r\ncontent-type: text/html\r\ncf-ray: a47f76b50b5356b5-OSL\r\ncf-cache-status: HIT\r\ncache-control: s-maxage=600,public,max-age=0\r\ncontent-encoding: gzip\r\nlast-modified: Fri, 09 Oct 2026 18:21:48 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: TPgbJJL/KgrKQRmH92T31A==\r\nx-oss-hash-crc64ecma: 11347169681093704032\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC9320C75EC46333404536E\r\nx-oss-server-time: 1\r\nx-oss-storage-class: Standard\r\nstrict-transport-security: max-age=15552000\r\nset-cookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; HttpOnly; SameSite=None; Secure; Path=/; Domain=ad852.xyz; Expires=Fri, 09 Oct 2026 19:01:41 GMT\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5","quoted":false,"path":"/","domain":"ad852.xyz","expires":"2026-10-09T19:01:41Z","raw_expires":"Fri, 09 Oct 2026 19:01:41 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; HttpOnly; SameSite=None; Secure; Path=/; Domain=ad852.xyz; Expires=Fri, 09 Oct 2026 19:01:41 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":139339,"size_decoded":38452,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (64144), with no line terminators","md5":"4cf81b2492ff2a0aca411987f764f7d4","sha1":"dca9976a05a12c6f6f403506a01ab9a841c18a4e","sha256":"5483d3260616276ad141fd46e51dcd67aaece59dc9391a2385b582f9e0ac3d89","sha512":"0dfd8ac3264466a0bcde99e1c6e95b9486ce5b07235dc78b472345b1ef00188fd68f1d7fdfe3a5e175b7e287779183dbb630ea5deea73bdccbec1de6e80052e5","ssdeep":"1536:ZRC810a5Bia/1oISsWDeUMiONaDDF2Xfq2MOycV/5RwOsFP2wzVfwPdzB3n/tluv:Z081/ztoISLiUMrazuR/tluM8","tlshash":"82d3c4365ba6588afb33442b946be24ae63d35d7700384f08e6c9f9cb445d85f3132b9","first_seen":"2026-10-09T18:33:13.928397Z","last_seen":"2026-10-09T18:33:13.928397Z","times_seen":1,"resource_available":true,"data":null}},"time_used":6963,"timings":{"blocked":-1,"dns":265,"connect":1,"send":0,"wait":278,"receive":0,"ssl":6418},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/200/3/2000089/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.773Z","timestamp":1791570703773,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/200/3/2000089/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76c299952efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"5E5A56009D625884752390D69AB92AB4\"\r\nlast-modified: Sun, 27 Sep 2026 04:49:13 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: XlpWAJ1iWIR1I5DWmrkqtA==\r\nx-oss-hash-crc64ecma: 15452660628011867492\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D3662319383338C18AED\r\nx-oss-server-time: 15\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 21198\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":21198,"size_decoded":21942,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5e5a56009d625884752390d69ab92ab4","sha1":"126eedaddd5f8d6e42ca32c057633326ac9fa345","sha256":"43d37ea0c7c80d6630d4cab9e32487d86e0837a5ae88fbab7a0398bc829a8930","sha512":"f6436b6c10bde7ad7d53eed5b44e56b384ae9a45bef2af4a66361e87e9ee870a7799f85bea39749f8609010c98fc120c5b433218b405cdd2819369b0a7264947","ssdeep":"384:j0XITGRASyXEN8Fh8GfuqWf6fd3MNPmuo+lh7SN/vbZHQJPSIjzGSily3R:yMyASBoZu9yV3Kooh7Mb9iSIjVR","tlshash":"eb92d0218dcd076a12d38f536618fe9e797f5e24f3df653c89848603492184abe07ed6","first_seen":"2026-10-09T17:45:43.852958Z","last_seen":"2026-10-09T18:33:13.781687Z","times_seen":3,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/common/web/common/comm_icon_fh.svg?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:49.165Z","timestamp":1791570709165,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/common/web/common/comm_icon_fh.svg?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D; g_state={\"i_l\":1,\"i_ll\":1791570704718,\"i_b\":\"AUD+1QJhwLFQIgL25h/mMPSBZUZ0nELdT6H4yLr7+QE\",\"i_e\":{\"enable_itp_optimization\":24},\"i_et\":1791570704718}\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:49 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: br\r\ncf-ray: a47f76e44f782efa-OSL\r\ncf-cache-status: HIT\r\netag: W/\"23D59641962D6A3F83C4496092E45C41\"\r\nage: 27451\r\ncache-control: max-age=604800,stale-while-revalidate=86400,immutable,proxy-revalidate,public\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 23 Sep 2026 00:37:48 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: I9WWQZYtaj+DxElgkuRcQQ==\r\nx-oss-hash-crc64ecma: 7372257561462768315\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C7D9447B51363178B9EF\r\nx-oss-server-time: 3\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":434,"size_decoded":1005,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"23d59641962d6a3f83c4496092e45c41","sha1":"b574f76a0712e92b6582c35cf5ec7d02ffde932d","sha256":"6cfeed773273abdcdc40f5c8e153214d253c2836fb1f8d3a4be65444f07bd58c","sha512":"8701b70dd6c719975f99dee26bea48c7883e86a144c80584350784714683a19ce80219ea095a0feac7957eb97d34644d1b902279790893cf1bfaf05ef4e0fb8a","ssdeep":"","tlshash":"67e0abf39328b63a69488f941ba47445221ae2419af009ccfb4004220ea7c63643459e","first_seen":"2025-04-07T01:42:52.839748Z","last_seen":"2026-10-09T18:33:13.931371Z","times_seen":3718,"resource_available":false,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ytbacksexo.xyz/hall/api/netstat/attribution/match","fqdn":"ytbacksexo.xyz","domain":"ytbacksexo.xyz","tld":"xyz"},"ip":{"addr":"8.233.17.31","port":443,"asn":3356,"as":"LEVEL3","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:44.493Z","timestamp":1791570704493,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ytbacksexo.xyz","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Tue, 29 Sep 2026 13:10:22 GMT","end":"Mon, 28 Dec 2026 14:06:17 GMT"},"fingerprint":{"sha1":"04:0A:47:19:B0:39:99:10:59:DF:86:B3:5D:7C:0A:9C:BD:E2:E6:E6","sha256":"31:E0:07:6A:95:AF:27:B6:02:96:5F:18:19:44:AA:81:D9:DF:02:17:C7:1E:25:ED:01:84:C0:20:BB:82:4E:FB"}}},"request":{"raw":"POST /hall/api/netstat/attribution/match HTTP/1.1\r\nHost: ytbacksexo.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: vi\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain\r\nContent-Length: 448\r\nReferer: https://ad852.xyz/\r\nx-object-id: {\"uid\":\"\",\"browserLanguage\":\"en-US\",\"init\":{\"device\":\"\",\"created\":1791570702472,\"version\":1791251963000}}\r\nplatformType: 5\r\nx-device: 1-5\r\nx-data-mode: chipher\r\nx-request-id: 9858ec61-67df-4ef8-ba02-d81e0b2ca26e\r\ndevice: 8034c51c-91ec-430d-af2a-41881722443b\r\ncurrency: VND\r\ntimestamp: 1791570703\r\nsiteCode: 3792\r\nlanguage: vi\r\ntoken: b2e3d672-9d88-47a7-81b4-9d7ffc62054f\r\ndeviceModel: Firefox v134.0\r\nphysicalDeviceModel: unknown\r\noperatingSystem: Windows\r\ndeviceBrand: unknown\r\nbrowserType: Firefox v134.0\r\nappSystem: Windows 10\r\ndomain: ad852.xyz\r\nwebauthnDomain: ad852.xyz\r\nclienttimezone: 0\r\nx-custom-referer: https://ad852.xyz/\r\nx-version: 7.5.141\r\nappVersion: v7.5.141\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nbrowserfingerid: \r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":448,"data":"37s3d38l9xZ5q4eqnb3ooSE0KB3ZLD0lhBzE1hvLZVoegXCjgre+ooGp/z/KeqClfOA8vTRzqPLADrxR43YcuoGtDhA0iwduGkDqec0eLnbK1SZDoh9PgQkWo39jdcejMuFjv2DojGfHtzQP2D4+mJF/eZCKM0A1Zfttt8pp4hanhIXgvMZxp2qN1WTCGr7+dB+joW0Qk6I3ujnDJvDjwY2ezhNheypZHA/plJAOa1Fgbd/VfO0uAV/YNlzNK4UWkCUcapYiuVSx+AfJF+jy4TDy710iZk41wMOXS2+U8uLhhn5CLhyysBWjkGP7VSXUdYv21gYJUUXES7rtfj0Io4qkPC6OkTnz7AOnWA8deQrWdE+LAj5vt23OqH9xElGxyvC0eIy7t6l4A52XIu26Ui6B4rYUt10KD63IAnTXNV35/f/NkZmDjWprnfKiWwXr"}},"response":{"raw":"HTTP/3 200 \r\ndate: Fri, 09 Oct 2026 18:31:45 GMT\r\ncontent-type: text/plain; charset=utf-8\r\ncontent-length: 128\r\nset-cookie: acw_tc=0a094ea817915707053765466e5e30860fbda3dcaba112de3d1c22ade83da4;path=/;HttpOnly;Max-Age=1800\r\nx-trace-id: bf3bae2de33149ba\r\nx-env-go-biz-netstat: 0\r\ncache-control: no-cache\r\nx-saas-server-id: 8576b68756-mkrcc|2ce0b344ed18b33a3c2f2638e779770c\r\naccess-control-allow-methods: *\r\naccess-control-max-age: 1728000\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Trace-ID, newjwt, token\r\nvia: 1.1 google\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":[{"name":"acw_tc","value":"0a094ea817915707053765466e5e30860fbda3dcaba112de3d1c22ade83da4","quoted":false,"path":"/","max_age":1800,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"acw_tc=0a094ea817915707053765466e5e30860fbda3dcaba112de3d1c22ade83da4;path=/;HttpOnly;Max-Age=1800"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":128,"size_decoded":793,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"5f4d4ac52d076636732b4f271100903b","sha1":"2867e674406019bf62e41ad532ede9abd5334a55","sha256":"2142bf5dc12617d09ac4a949093e9cecb79fd576266cbd8563a759e6e67b514b","sha512":"0cfcbca256cf4168310aea6fa43c6774284cfa1ce5b73f54efd2c476d8bb4de3fcd099441ba11f28d6093194e78406ddb6b3c1a84f6372937d0955947f829222","ssdeep":"","tlshash":"f9b02bc07130007b7c568c083605cf00a800dd08a0c13c144e8472d014281384d47457","first_seen":"2026-10-09T18:33:13.93275Z","last_seen":"2026-10-09T18:33:13.93275Z","times_seen":1,"resource_available":true,"data":null}},"time_used":528,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":528,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ytbacksexo.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/0_EntryLoginRegisterChunk.ClHJ9qmi.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.903Z","timestamp":1791570702903,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/0_EntryLoginRegisterChunk.ClHJ9qmi.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/commonChunk.0oGKmx_H.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76bd1be72efa-OSL\r\ncf-cache-status: HIT\r\nage: 24676\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: JGTHBQAjPcqcF902Pwx3tw==\r\nx-oss-hash-crc64ecma: 850197151913432186\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D2A975EC463936579A1E\r\nx-oss-server-time: 34\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":467357,"size_decoded":141691,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (64563)","md5":"2464c70500233dca9c17dd363f0c77b7","sha1":"576e34fdb8b4797015cdd13443781fe000227ae0","sha256":"0bd7299f58b9ccf139c2c53e97ac83e460f513a98ef9d17f2c49bcb2b3fb0ca5","sha512":"411df9be6a8288379176c7ca211b99bac62da7357f53d53bdda9083ea5c69d57c8a076e06d1e92aea0f7ee0d39326ce83d51a71f1d7431b68d572e4e8db69af8","ssdeep":"12288:k+vAAcUxV26e6xI1j66Mm+SjQbTaYlT2SO0lChBsg:jvAAcUx06p/SjQbTFTG","tlshash":"d3a43b88b1bea5b5bbbc6ce860b6052221187f166405d4f0f1bfaf55339ae40f1e1b35","first_seen":"2026-10-09T17:19:18.818097Z","last_seen":"2026-10-09T18:33:13.934917Z","times_seen":7,"resource_available":true,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ytbacksexo.xyz/hall/api/gohal/getClientConfig?siteCode=3792\u0026token=b2e3d672-9d88-47a7-81b4-9d7ffc62054f\u0026currency=VND\u0026language=vi\u0026platformType=5\u0026osType=4","fqdn":"ytbacksexo.xyz","domain":"ytbacksexo.xyz","tld":"xyz"},"ip":{"addr":"8.233.17.31","port":443,"asn":3356,"as":"LEVEL3","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.926Z","timestamp":1791570702926,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ytbacksexo.xyz","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Tue, 29 Sep 2026 13:10:22 GMT","end":"Mon, 28 Dec 2026 14:06:17 GMT"},"fingerprint":{"sha1":"04:0A:47:19:B0:39:99:10:59:DF:86:B3:5D:7C:0A:9C:BD:E2:E6:E6","sha256":"31:E0:07:6A:95:AF:27:B6:02:96:5F:18:19:44:AA:81:D9:DF:02:17:C7:1E:25:ED:01:84:C0:20:BB:82:4E:FB"}}},"request":{"raw":"OPTIONS /hall/api/gohal/getClientConfig?siteCode=3792\u0026token=b2e3d672-9d88-47a7-81b4-9d7ffc62054f\u0026currency=VND\u0026language=vi\u0026platformType=5\u0026osType=4 HTTP/1.1\r\nHost: ytbacksexo.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: appsystem,appversion,browserfingerid,browsertype,clienttimezone,currency,device,devicebrand,devicemodel,domain,language,operatingsystem,physicaldevicemodel,platformtype,sitecode,timestamp,token,webauthndomain,x-custom-referer,x-data-mode,x-device,x-object-id,x-request-id,x-version\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 0\r\nset-cookie: acw_tc=0a0ccbb317915707036323665e5ce9525984290667a0d465872620aa39983d;path=/;HttpOnly;Max-Age=1800\r\nx-saas-server-id: 8576b68756-nskg8|a929bb549fa2a3800d85f8e160fbc67a\r\naccess-control-allow-methods: *\r\naccess-control-max-age: 1728000\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: appsystem,appversion,browserfingerid,browsertype,clienttimezone,currency,device,devicebrand,devicemodel,domain,language,operatingsystem,physicaldevicemodel,platformtype,sitecode,timestamp,token,webauthndomain,x-custom-referer,x-data-mode,x-device,x-object-id,x-request-id,x-version\r\naccess-control-expose-headers: X-Trace-ID, newjwt, token\r\nvia: 1.1 google\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"acw_tc","value":"0a0ccbb317915707036323665e5ce9525984290667a0d465872620aa39983d","quoted":false,"path":"/","max_age":1800,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"acw_tc=0a0ccbb317915707036323665e5ce9525984290667a0d465872620aa39983d;path=/;HttpOnly;Max-Age=1800"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":0,"size_decoded":915,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-09T20:29:43.461907Z","times_seen":18980891,"resource_available":true,"data":null}},"time_used":888,"timings":{"blocked":-1,"dns":80,"connect":12,"send":0,"wait":532,"receive":0,"ssl":261},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ytbacksexo.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/200/3/2000106/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.663Z","timestamp":1791570703663,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/200/3/2000106/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c1d8b42efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"A82B7107810E544BB4BFB58F0786A4CE\"\r\nlast-modified: Sun, 27 Sep 2026 04:46:23 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: qCtxB4EOVEu0v7WPB4akzg==\r\nx-oss-hash-crc64ecma: 10963688386425969096\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D366945394383060BD99\r\nx-oss-server-time: 19\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19580\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19580,"size_decoded":20324,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a82b7107810e544bb4bfb58f0786a4ce","sha1":"edf0861b00a325e5f294c0671a3c1f3e3b9bb673","sha256":"a1821af411a4ee0556a27ae43619e2d5319b4d474d8fdb8a0c985c95bae0929c","sha512":"b673349265bd923378182ffbd190c38583b89e1865c57f965647e643dedf1e70eea779c23c777dd7211dbbbf2c8eb0a26b37284978ef425bd5b5bb7fa89e0a58","ssdeep":"384:6dAqfNVKpVSanLu/dUV79R0koAktFPL3PPAFTnfUoulZID3+w:6jFaLAip09A2PLn0TzB35","tlshash":"7492cf44bffdf1997025fc720f8e65dda0f248384d31ce067566aca63998ca39a3116a","first_seen":"2026-10-09T17:45:43.483506Z","last_seen":"2026-10-09T18:33:13.935994Z","times_seen":3,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-1/common/home/img_dt_pmd_xx.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.364Z","timestamp":1791570703364,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-1/common/home/img_dt_pmd_xx.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c00e6f2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 18565\r\ncache-control: max-age=604800,public\r\netag: \"C445DA49EB44EB7F9949478C23D888DF\"\r\nlast-modified: Fri, 25 Sep 2026 04:47:12 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: xEXaSetE63+ZSUeMI9iI3w==\r\nx-oss-hash-crc64ecma: 5926414366513071604\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8EA89DA989C3334E99967\r\nx-oss-server-time: 12\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 874\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":874,"size_decoded":1543,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c445da49eb44eb7f9949478c23d888df","sha1":"82dc988421843b97c11d51f33dc9af12139bf632","sha256":"3b2cd292e834837fd2c9a948a1de5f26def9d8e9eeaf21053dbc3de320dbbcd3","sha512":"65018e78d8862577010993a203e8480a9fd8cf7cc1a71740629fcd725069a284a320050df84033cbd603a9fa185cb1cd39faa9c5635df6946fca25be4cb926d2","ssdeep":"","tlshash":"fb11da9b5f971b9387145c146810ac9bb753d4e408ec91ff7b5c167132b9f235b01647","first_seen":"2026-10-09T17:45:43.451413Z","last_seen":"2026-10-09T18:33:13.93835Z","times_seen":4,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/200/3/2000065/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.654Z","timestamp":1791570703654,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/200/3/2000065/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c1d8a72efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"3E928343D231D93A3E474C616B4FB762\"\r\nlast-modified: Sun, 27 Sep 2026 04:19:41 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: PpKDQ9Ix2To+R0xha0+3Yg==\r\nx-oss-hash-crc64ecma: 13228649966953716286\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D36658FFB5363860652E\r\nx-oss-server-time: 17\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12236\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":12236,"size_decoded":12980,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"3e928343d231d93a3e474c616b4fb762","sha1":"8a5d190b349c9d644258e4d2d8cc86f486ba4dee","sha256":"0343dcc62819c56937a0fdbaf157e24b37e1c342eaf71ab81d01a53f49c6c597","sha512":"d9666eb9b76d040662a5f9e058434a1c8cf36f8479384af90f3d1782bd3434cb0d49a7c37bc28338c732ae353eb56f104820e09e94d492f4c5b13904fc8bdd0f","ssdeep":"192:+A69xkWNMagstwfubM9dGiUPwSdHdLQl/QRxNdilvcbfSu1FbpR3JeYpUH6:+RmOMEFAdMPwSdt53dX39Vpi6","tlshash":"f342cf3dcf21429294b4da07604f355866ed0f6a1f6768886be6462bfc8c76a9b68301","first_seen":"2026-10-09T17:45:43.661028Z","last_seen":"2026-10-09T18:33:13.939843Z","times_seen":4,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/upload/img/2086060536948338689.png","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:45.781Z","timestamp":1791570705781,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/upload/img/2086060536948338689.png HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D; g_state={\"i_l\":1,\"i_ll\":1791570704718,\"i_b\":\"AUD+1QJhwLFQIgL25h/mMPSBZUZ0nELdT6H4yLr7+QE\",\"i_e\":{\"enable_itp_optimization\":24},\"i_et\":1791570704718}\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:45 GMT\r\ncontent-type: image/png\r\npriority: u=6,i=?0\r\ncf-ray: a47f76cf19482efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 27990\r\ncache-control: immutable,stale-while-revalidate=86400,public,max-age=86400\r\netag: \"5991FCCAB105B5351AEA86EB5A84D720\"\r\nlast-modified: Sat, 08 Aug 2026 12:02:44 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: WZH8yrEFtTUa6obrWoTXIA==\r\nx-oss-hash-crc64ecma: 4333458525956311755\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C5BBEEA19D3835E4351B\r\nx-oss-server-time: 7\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 94642\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":94642,"size_decoded":95352,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit colormap, non-interlaced","md5":"5991fccab105b5351aea86eb5a84d720","sha1":"001bff984bc35c9e40baae3fa6a75028ff7a5b2a","sha256":"c9f99e370f66964ee79cf633512dbb2230bfc4c74f7be85ecf87970d5a0037f5","sha512":"7a60b55e32f10d04bcd421b8156aa5db68394f8654e32375d2aec342f361704635ed04d3d75d2427d91b3aab9812d89d2e5204ba83776d0a8306d1d1b709ab7b","ssdeep":"1536:gL+TB1lhP6WmfaBWc70QdxSMQgV5R3may6qdk0JO/gNd63N/wNl84EqmvKoLH/A9:3TB1qfaBBVoMd1ry6q60PduRWPEqIr7w","tlshash":"13931228df9b0e57d393d70fa506d320101532246bb9aee603ba2dcd7a1b7a5d143e43","first_seen":"2026-10-09T17:19:18.751848Z","last_seen":"2026-10-09T18:33:13.873615Z","times_seen":7,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":17,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/vendorChunk.DPuxujPK.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.105Z","timestamp":1791570702105,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/vendorChunk.DPuxujPK.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76b8285b2efa-OSL\r\ncf-cache-status: HIT\r\nage: 25005\r\ncache-control: max-age=31622400\r\npriority: u=1,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: Nb/o4siWKxsiZudczvhyQA==\r\nx-oss-hash-crc64ecma: 15471773573976843297\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D160E702E233373DF8BD\r\nx-oss-server-time: 12\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":225525,"size_decoded":86369,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65534), with no line terminators","md5":"35bfe8e2c8962b1b2266e75ccef87240","sha1":"22fce2635b65d33f39be2618da2c5ebb32fd8632","sha256":"cfe26b2f4ff209464c919e8fa7ac5750a69d224d50c8ce57ae248bffddbaa7be","sha512":"30e2a89825912f21c1c0a544e5081578cda489cf6f8e4f648ff44bd2c29d31caee857f931c231b25c13bfce9d74d3b23264b57121175041da733250907672ea2","ssdeep":"3072:Hum+HqCBgtMfZ6keiFbcRwoShyqoTu4O2SwJ5HplAqB:9+9gMfZ6keGcLCIu4O21J5JlAqB","tlshash":"03242add71e6f06143f764a1807f100bf23a6d54a88d9094f2a9d4ea3c7498a52bbf3d","first_seen":"2026-10-09T17:19:18.783666Z","last_seen":"2026-10-09T18:33:13.941399Z","times_seen":7,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/websocket.impl.DrPzdGis.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.084Z","timestamp":1791570703084,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/websocket.impl.DrPzdGis.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/commonChunk.0oGKmx_H.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76be3cd82efa-OSL\r\ncf-cache-status: HIT\r\nage: 27341\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: 3AN415wJzX1NY2j1h8daYA==\r\nx-oss-hash-crc64ecma: 10528854025433177940\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C841F1D29D37322805DF\r\nx-oss-server-time: 17\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8577,"size_decoded":3565,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (8576)","md5":"dc0378d79c09cd7d4d6368f587c75a60","sha1":"afef52e0c7e6f2d11b15988dd660fa03db373b0e","sha256":"008b7836205c099c3ea1fcc9add3e36dd4bd37033321b620dcc3be4067fbf4b5","sha512":"39e2a0b0e01e71eb51830475cc8fcb474e2addeb8b5514517a53d8a4c9ee863aefc134dd3ee680979cd211d7be52d205c328569af44dfdba611c1cde9a9dcf8d","ssdeep":"192:8HAZhl705K992sieCcXknNgoji6+YzWWq2LgFZWjvXq:8gvlA5afihIwNdji6TzWWq2LgFZUa","tlshash":"5002329457568a3b62fac267b2342613632427510704c38cb26c9fee8b2ed817d74bf6","first_seen":"2026-10-09T17:19:19.178027Z","last_seen":"2026-10-09T18:33:13.950012Z","times_seen":6,"resource_available":true,"data":null}},"time_used":15,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-1/common/_sprite/icon_btm_sy1.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.103Z","timestamp":1791570703103,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-1/common/_sprite/icon_btm_sy1.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76be5d022efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 23458\r\ncache-control: max-age=604800,public\r\netag: \"16AC51B1A0275E62D7BD11ED3CD9B3B8\"\r\nlast-modified: Fri, 25 Sep 2026 04:53:38 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: FqxRsaAnXmLXvRHtPNmzuA==\r\nx-oss-hash-crc64ecma: 12559749418413079000\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D76C88D14B35399AB060\r\nx-oss-server-time: 3\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 534\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":534,"size_decoded":1203,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"16ac51b1a0275e62d7bd11ed3cd9b3b8","sha1":"5027ff873328f51c11dd886e57f31aaec0aeb166","sha256":"5df7b645b998df847c09c9bcbc168b3d320716e1afb357393af8369ecf6bcf97","sha512":"8b2e32c4bd720f82b85970eb4b9caee35422f3e3594e2dce12754bf13c22f5cb59962a7bf62b1d222b0fe9fe7681ece2b5a6f4e675b76803b510fbfd868405a1","ssdeep":"","tlshash":"4df00515dde716ad939408451ee9bd89e2dfc6e1026432115a4eaaf4f84d1410716cd6","first_seen":"2026-10-09T17:45:43.493959Z","last_seen":"2026-10-09T18:33:13.950942Z","times_seen":4,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-1/common/_sprite/icon_btm_sw.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.108Z","timestamp":1791570703108,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-1/common/_sprite/icon_btm_sw.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76be6d0b2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 23458\r\ncache-control: max-age=604800,public\r\netag: \"657144D97928D133E1ADDBDAEE3A29F3\"\r\nlast-modified: Fri, 25 Sep 2026 04:33:13 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: ZXFE2Xko0TPhrdva7jop8w==\r\nx-oss-hash-crc64ecma: 2806749085752148266\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D76C88D14B333438B260\r\nx-oss-server-time: 20\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1102\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1102,"size_decoded":1772,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"657144d97928d133e1addbdaee3a29f3","sha1":"567af8b182ff244b75d128eccc09862b45c05ddc","sha256":"bff0cbdffe2347e2db575fa928e3f833f9a05dcd89d4a56991a86c43341c45a6","sha512":"7bee1866ca8acf98757415d45d2fdd80a4c0d4f15319ab707cb5a218d65047956120e0b2328c3e71ee9d22c5be03464c75ea21ad80670bbd01d5effd32b6032d","ssdeep":"","tlshash":"ed11f938861771e6c295ce54cf0421746136a50a923d0b113145622290cb1c039dd8f5","first_seen":"2026-10-09T17:45:43.737063Z","last_seen":"2026-10-09T18:33:13.952117Z","times_seen":4,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/vendors/vendor-@tonconnect.DfDAdMM-.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.408Z","timestamp":1791570703408,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/vendors/vendor-@tonconnect.DfDAdMM-.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/AsyncAsideIndex.DJTJPSZz.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76c04eda2efa-OSL\r\ncf-cache-status: HIT\r\nage: 24672\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: m10yWoH31BgT8DzBWPGg5w==\r\nx-oss-hash-crc64ecma: 10455323026050215573\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D2AEA05E3636362D4E84\r\nx-oss-server-time: 32\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":362625,"size_decoded":107072,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (38406)","md5":"9b5d325a81f7d41813f03cc158f1a0e7","sha1":"9b41bac1a143e2264531bcf41576f0e2fcf25f07","sha256":"2b272ef290f2e28aa02e36503fa921b9faef917d1c1a0263cff7b06f51e40fee","sha512":"c6d009227bb9857cd2b325b5532d315d1862155d8e533404d126aa55af4133f28e51d311df8a130a25784554f362b39a1c515226b719041c2b861a825d768f37","ssdeep":"6144:wqxq77+Ykat5nefHQ0/ffjnbcQAbxqOpUoUb1meFy5T8pQtKtR6MN8vkwdXlVC8D:NIH96QofstxqOpUoU5/FmT8I","tlshash":"d4743bc6f3cab260238b87d450770556b33a1ce9650d81b8f76c899a6f70588c1b7bf9","first_seen":"2026-10-09T17:19:18.750456Z","last_seen":"2026-10-09T18:33:13.953618Z","times_seen":7,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/369/3/3690030/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.760Z","timestamp":1791570703760,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/369/3/3690030/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76c279672efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"EE7DC6424D454AF04B0BD40C92F69796\"\r\nlast-modified: Sun, 27 Sep 2026 04:21:10 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: 7n3GQk1FSvBLC9QMkvaXlg==\r\nx-oss-hash-crc64ecma: 634275205021993032\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D3664005843436777882\r\nx-oss-server-time: 15\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 23248\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23248,"size_decoded":23990,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ee7dc6424d454af04b0bd40c92f69796","sha1":"065f4c249ad37c334e90fb5c4636508a3a1c2352","sha256":"f402c44dd783fdef0140f36b1f5d91e9c522f098b9f40257988142758f335af4","sha512":"b08b3aea53c9d8cb682919a45913b6658aa2313ebefb1aec8a057d80a9b24dc23af8c3072a9be936ef989e8b984034b02dfdc09284d1383a7870359f5c34c377","ssdeep":"384:nKpOdH8tdiltkdC1hyol2JHHrSqM5s+t40apOYV3rGQAn7:nuOudigCwoB5j4T1V7GQU","tlshash":"bba2e1256da5f7b0c8cccff156992f9171bd3dc852c92b4af5ca0166188b3a058b3e0e","first_seen":"2026-10-09T17:45:43.505654Z","last_seen":"2026-10-09T18:33:13.868532Z","times_seen":4,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x03k89o0jg.wgbos.com/agespeed.txt?t=1791570708930","fqdn":"x03k89o0jg.wgbos.com","domain":"wgbos.com","tld":"com"},"ip":{"addr":"104.18.38.204","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:48.936Z","timestamp":1791570708936,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"x03k89o0jg.wgbos.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 12:30:51 GMT","end":"Tue, 01 Dec 2026 12:30:50 GMT"},"fingerprint":{"sha1":"93:0E:C9:80:CD:07:8F:3A:8D:2C:AA:C0:0B:B2:02:DC:05:3F:9B:8A","sha256":"C9:30:4B:8D:B8:57:76:F6:AC:C4:86:14:0D:F6:08:14:3D:E5:26:D6:FE:40:AF:0A:37:24:2C:A5:70:A6:00:A7"}}},"request":{"raw":"GET /agespeed.txt?t=1791570708930 HTTP/1.1\r\nHost: x03k89o0jg.wgbos.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nConnection: keep-alive\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Fri, 09 Oct 2026 18:31:49 GMT\r\ncontent-type: text/plain\r\nserver-timing: cfExtPri\r\npriority: u=4,i=?0\r\nstrict-transport-security: max-age=15552000\r\ncache-control: s-maxage=315360000,max-age=0,public\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 3600\r\naccess-control-allow-credentials: true\r\naccept-ranges: bytes\r\ncf-cache-status: BYPASS\r\nserver: cloudflare\r\nset-cookie: acw_tc=0a0ccbdb17915707092464386e646296ff87f84b3ca447ac2cad6e62f6f88b;path=/;HttpOnly;Max-Age=1800\n__cf_bm=PzhaX1esJU_dEdFSoYaHr5oCgfBc36n5ThKnPFElLFo-1791570708.970624-1.0.1.1-Qp5n2WN43uCUCm73rigUy.r47WqdyXrw9Fi82AGPtLEUQwnHgd.FGU8ep5kXJs4WPEcsrRwXXcGn0nUWVF4Ohl6vDWzi6bRi7Y7l.uZnLd4bHfe6cCbOuX_Zv1KWhMSj; HttpOnly; SameSite=None; Secure; Path=/; Domain=x03k89o0jg.wgbos.com; Expires=Fri, 09 Oct 2026 19:01:49 GMT\r\ncf-ray: a47f76e30e508deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2\r\n\r\n","headers":null,"cookies":[{"name":"acw_tc","value":"0a0ccbdb17915707092464386e646296ff87f84b3ca447ac2cad6e62f6f88b","quoted":false,"path":"/","max_age":1800,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"acw_tc=0a0ccbdb17915707092464386e646296ff87f84b3ca447ac2cad6e62f6f88b;path=/;HttpOnly;Max-Age=1800"},{"name":"__cf_bm","value":"PzhaX1esJU_dEdFSoYaHr5oCgfBc36n5ThKnPFElLFo-1791570708.970624-1.0.1.1-Qp5n2WN43uCUCm73rigUy.r47WqdyXrw9Fi82AGPtLEUQwnHgd.FGU8ep5kXJs4WPEcsrRwXXcGn0nUWVF4Ohl6vDWzi6bRi7Y7l.uZnLd4bHfe6cCbOuX_Zv1KWhMSj","quoted":false,"path":"/","domain":"x03k89o0jg.wgbos.com","expires":"2026-10-09T19:01:49Z","raw_expires":"Fri, 09 Oct 2026 19:01:49 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=PzhaX1esJU_dEdFSoYaHr5oCgfBc36n5ThKnPFElLFo-1791570708.970624-1.0.1.1-Qp5n2WN43uCUCm73rigUy.r47WqdyXrw9Fi82AGPtLEUQwnHgd.FGU8ep5kXJs4WPEcsrRwXXcGn0nUWVF4Ohl6vDWzi6bRi7Y7l.uZnLd4bHfe6cCbOuX_Zv1KWhMSj; HttpOnly; SameSite=None; Secure; Path=/; Domain=x03k89o0jg.wgbos.com; Expires=Fri, 09 Oct 2026 19:01:49 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2,"size_decoded":898,"mime_type":"text/plain","magic":"ASCII text, with no line terminators","md5":"e0aa021e21dddbd6d8cecec71e9cf564","sha1":"9ce3bd4224c8c1780db56b4125ecf3f24bf748b7","sha256":"565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3","sha512":"900110c951560eff857b440e89cc29f529416e0e3b3d7f0ad51651bfdbd8025b91768c5ed7db5352d1a5523354ce06ced2c42047e33a3e958a1bba5f742db874","ssdeep":"","tlshash":"c710000000000000000000030000000030000000000000000c000000c0000000000000","first_seen":"2023-03-09T09:04:49Z","last_seen":"2026-10-09T20:28:03.314773Z","times_seen":396530,"resource_available":true,"data":null}},"time_used":423,"timings":{"blocked":-1,"dns":16,"connect":17,"send":0,"wait":390,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/ThirdMenuList.TXbHq1tV.css","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.918Z","timestamp":1791570702918,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/ThirdMenuList.TXbHq1tV.css HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: text/css\r\ncontent-encoding: br\r\ncf-ray: a47f76bd3bff2efa-OSL\r\ncf-cache-status: HIT\r\netag: W/\"DDE2AF8D4BCBD87042F158990EE5ED73\"\r\nage: 27341\r\ncache-control: max-age=31622400\r\npriority: u=2,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:01 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: 3eKvjUvL2HBC8ViZDuXtcw==\r\nx-oss-hash-crc64ecma: 13533080908081372713\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C84123193837367BA657\r\nx-oss-server-time: 1\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":191,"size_decoded":790,"mime_type":"text/css","magic":"ASCII text","md5":"dde2af8d4bcbd87042f158990ee5ed73","sha1":"36587f1abf1f6ce5f8c3be56c8d2fa066b8eba66","sha256":"ccb91b6b0298e60a9d5de7e6acd85d3db09fbe36006ce61e56b0d942786dfa11","sha512":"366cae92dd7c7ea9a914d61c7403dbabd3fe36a14aeb5726eac4967393ebd2297ec85cdf785a571d310c871662d88620ee72dc7d31ef2b6904699f2441d7a058","ssdeep":"","tlshash":"81c022f005d2622cc225b323b89acf4c28aaa0cc5ca22f0daa85b461d78e448240e440","first_seen":"2026-09-27T17:53:43.405458Z","last_seen":"2026-10-09T18:33:13.96073Z","times_seen":6,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/200/3/2000104/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.767Z","timestamp":1791570703767,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/200/3/2000104/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76c289882efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"D3ED16D06A966F733F61F9666E20B746\"\r\nlast-modified: Sun, 27 Sep 2026 05:03:47 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: 0+0W0GqWb3M/YflmbiC3Rg==\r\nx-oss-hash-crc64ecma: 335429606943808683\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D366A87B9A3931B1084C\r\nx-oss-server-time: 19\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 22168\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":22168,"size_decoded":22910,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d3ed16d06a966f733f61f9666e20b746","sha1":"089a4169a36f689d829bb5be6bb6d68871bf1dc6","sha256":"c110bb4c4b933b3c0fc103277b361bb6ac7b4cb4ca021a6063cefe3fb7b882be","sha512":"7eb028393360191c0347993e157b83578c49e805d8d46d5c20560172653686e369d62070bf90d64bc6e1a8dea55ad41c94624f05491ba7b0cc8916bb7e248316","ssdeep":"384:79HRMNSzmy9PkUdD9acyXBTzafRcn0rxY6OPfewTfPdnWpBCv4kefNp8:7hdLP39SBTmJdxYPTHdCIvWc","tlshash":"19a2d03538f1803117bd4261b6c3ef8b7b2e8a065c9ce2a5f9fcd69584a771cc276485","first_seen":"2026-10-09T17:45:43.548774Z","last_seen":"2026-10-09T18:33:13.964554Z","times_seen":4,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-common/common/_sprite/icon_dtfl_rm_1.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.366Z","timestamp":1791570703366,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-common/common/_sprite/icon_dtfl_rm_1.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c00e702efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 18565\r\ncache-control: max-age=604800,public\r\netag: \"197E98A19239FD9420C3511BF1CDBECC\"\r\nlast-modified: Fri, 25 Sep 2026 04:47:12 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: GX6YoZI5/ZQgw1Eb8c2+zA==\r\nx-oss-hash-crc64ecma: 11187810360065152223\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8EA89AFCCE631337A2CF7\r\nx-oss-server-time: 10\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1766\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1766,"size_decoded":2437,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"197e98a19239fd9420c3511bf1cdbecc","sha1":"7121ed497be17c11e9a030755fc42b7e1ee8873d","sha256":"1c7d3a6ad05e61777ca5aa6a4f5716a61be7280dbe7f1a1a02395a8e23214fd9","sha512":"79ff1db037b64b39e0055b3c5c26d9740df33b1020e2ff46c6e375a28ff9273d1cc349df35f36361511354d44022c84b0acf004d0a08e3bf00559be7ced49543","ssdeep":"","tlshash":"ec310b7d11abcf15b6dcec378dd94c2942584fd3016655401a132d5c0b976ce2e7ce80","first_seen":"2026-10-09T17:45:43.551628Z","last_seen":"2026-10-09T18:33:13.967177Z","times_seen":4,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/AsideIndex.CcjgmB2M.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.397Z","timestamp":1791570703397,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/AsideIndex.CcjgmB2M.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/AsyncAsideIndex.DJTJPSZz.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76c03ec02efa-OSL\r\ncf-cache-status: HIT\r\nage: 27340\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: o+U4kXdt2//CVFcj1vA3wA==\r\nx-oss-hash-crc64ecma: 18293604093299635066\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C84223193837369BB457\r\nx-oss-server-time: 6\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7040,"size_decoded":3354,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (7039)","md5":"a3e53891776ddbffc2545723d6f037c0","sha1":"8c783c5b9458fa6ce87ee19761e799382ed02d3b","sha256":"0cc475f0a187b20a1e50c19dda9b042f00a5d41ede9297768921b2f294eb9ec4","sha512":"1178f0639f854369a9f49effb79cb93a37cbd60c9b6fa216f4379cf7a9dba59f9d696482d50592f2bf7983ebd398336811dfd5abb96907ff1a592d1a8463d731","ssdeep":"96:RbigjWPZ9TK/3yEpX/oXjOLsnprwXdcPPPYBxMz/xMYOJfhPtP0qOT/tKzKHhnhW:ReSWK/3pd/oXjNnQknnWfa/AexU","tlshash":"6ce1c772900576bee83735fdb0813d3043689bc4da40861251fa6b2d4bacdebfa4c45e","first_seen":"2026-10-09T17:19:19.155887Z","last_seen":"2026-10-09T18:33:13.968585Z","times_seen":5,"resource_available":true,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/common/common/event/kjrk_icon_zhankai.svg?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:46.804Z","timestamp":1791570706804,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/common/common/event/kjrk_icon_zhankai.svg?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D; g_state={\"i_l\":1,\"i_ll\":1791570704718,\"i_b\":\"AUD+1QJhwLFQIgL25h/mMPSBZUZ0nELdT6H4yLr7+QE\",\"i_e\":{\"enable_itp_optimization\":24},\"i_et\":1791570704718}\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:46 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: br\r\ncf-ray: a47f76d58d6a2efa-OSL\r\ncf-cache-status: HIT\r\netag: W/\"87B2BC6133E4355C4B69DF2CF4B0EB2C\"\r\nage: 25651\r\ncache-control: max-age=604800,stale-while-revalidate=86400,immutable,proxy-revalidate,public\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 07 Oct 2026 02:12:09 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: h7K8YTPkNVxLad8s9LDrLA==\r\nx-oss-hash-crc64ecma: 13861615663866925497\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8CEDE447B513732C62D4D\r\nx-oss-server-time: 16\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":2314,"size_decoded":1760,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"87b2bc6133e4355c4b69df2cf4b0eb2c","sha1":"0e0ab402de17cec4b733cf6fc69afb1f7bfe52be","sha256":"11b557f43d5885a347860c0fc829b083500bb6f57f73c08620da49452ed11041","sha512":"e59c5290d2a66059891c281e31157bdee7d16079e7c87b8f64ab5d7e4501b2be9aab9ded847634be7d6d68f709619604e55e39afc4a1479fd31e884c88f82686","ssdeep":"","tlshash":"4141bfb1a3ec93f27105fb006439d0727aaf11ea5637db1907e92df4a95600fe48e8a4","first_seen":"2025-08-13T04:25:41.253384Z","last_seen":"2026-10-09T19:17:20.825944Z","times_seen":5264,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/cocos/lg/favicon.ico","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.228Z","timestamp":1791570702228,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /cocos/lg/favicon.ico HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: image/x-icon\r\ncontent-encoding: gzip\r\ncf-ray: a47f76b8e91c2efa-OSL\r\ncf-cache-status: HIT\r\netag: W/\"CA7F7C76154F6AC4991EEF45D795E1D8\"\r\nage: 27345\r\ncache-control: s-maxage=86400,public,max-age=1800\r\npriority: u=6,i=?0\r\nlast-modified: Mon, 07 Sep 2026 14:30:22 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: yn98dhVPasSZHu9F15Xh2A==\r\nx-oss-hash-crc64ecma: 5370010277683981176\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C83CEEA19D3134B0A93C\r\nx-oss-server-time: 2\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":4314,"size_decoded":3058,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"ca7f7c76154f6ac4991eef45d795e1d8","sha1":"86113980861ea95230804a5fb2c3822a32ead3ab","sha256":"a3370e046e6a854cb35b09e81ad73d6433780c89e58ce1b2b7f8b0bf559dae31","sha512":"6b9fd5a53c20bc7cbb3b8b6c45f8d20de7a1e5275158a8ca7a453718af5c16c067485b30da2bdcd717c65b221dda251f473c7443bf41323ff27b3bb0e8956fcd","ssdeep":"48:Biw2YhRYnDaE75QgU21AJL7z1pSxz3BH9+q7NHH2YRIkuzfYw:32Yh8aE7Wgxq5rSxh9fHHlfVw","tlshash":"6b91c767093140c4fd680f795940aa7690ba7d7ba93cb96d0d9a70c437b78c6907742f","first_seen":"2026-10-09T17:19:18.840185Z","last_seen":"2026-10-09T18:33:13.971033Z","times_seen":7,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/0_RechargeCommonChunk.cD1Z7U3x.css","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.576Z","timestamp":1791570702576,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/0_RechargeCommonChunk.cD1Z7U3x.css HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: text/css\r\ncontent-encoding: br\r\ncf-ray: a47f76bb1a442efa-OSL\r\ncf-cache-status: HIT\r\nage: 27346\r\ncache-control: max-age=31622400\r\npriority: u=2,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:01 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: w8+Ncs6k42sdtv0VuJz3lg==\r\nx-oss-hash-crc64ecma: 9176930394691167976\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C83C0A93063538177551\r\nx-oss-server-time: 5\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":29652,"size_decoded":5926,"mime_type":"text/css","magic":"ASCII text, with very long lines (29651)","md5":"c3cf8d72cea4e36b1db6fd15b89cf796","sha1":"7f54faf5651747def6f5476b339e32a16ec14df6","sha256":"e0a3494f59fa854a2642d36de705e8d895f4e3404bf76b9b2907dd597cd662cc","sha512":"c93d5073a6fc58badbca704f59e6b9796239b247290504bee583bb858a0d4d2886f1e425b49790e7ec5a98dafcb901115e24bc61779cd7a9162a7024359cf53d","ssdeep":"768:a3K5nh7lTbB1tvgqldg4O7gBHZ4Zvj8CjLdfT8TaXM7ma0:wK5nh3gqldg4O7gBHZ4Zvj8CjLdfT8Ts","tlshash":"97d2c89e9a30b13dd51bdb20bdf1bbd8c24071558a520152ab974d3f4bcafd629b0bc8","first_seen":"2026-10-07T06:42:39.092617Z","last_seen":"2026-10-09T18:33:13.972055Z","times_seen":16,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/ThirdMenuList.EMB1A7Ci.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.416Z","timestamp":1791570703416,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/ThirdMenuList.EMB1A7Ci.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/AsyncAsideIndex.DJTJPSZz.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76c05ee52efa-OSL\r\ncf-cache-status: HIT\r\netag: W/\"A52D66F9CCE0A9436E871411CFB640EA\"\r\nage: 27340\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: pS1m+czgqUNuhxQRz7ZA6g==\r\nx-oss-hash-crc64ecma: 17143677726076057471\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C842EEA19D31342BF93C\r\nx-oss-server-time: 2\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":636,"size_decoded":1140,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (635)","md5":"a52d66f9cce0a9436e871411cfb640ea","sha1":"686df3e19c1e5baa797e28a65673747d1e25e165","sha256":"b6103d36520186959a18e324ef0d32ddea2f5a4151655225b864218ff83b254c","sha512":"b8272c55e9a05085ac6f4da02359a64b51f0587d807e247f6ec5e616f437e40523999dfbf63c47b7ee94c58bf41ac6f6dd652668e41ac95d38af8d95bcac6a89","ssdeep":"","tlshash":"f9f002cdf5a4a7bc2a0c148ac0fef15a194c828d860561a0c5f79572a3d284dfb6e725","first_seen":"2026-10-09T17:19:19.099486Z","last_seen":"2026-10-09T18:33:13.973145Z","times_seen":5,"resource_available":true,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/MenuList.Bsrkl6q1.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.413Z","timestamp":1791570703413,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/MenuList.Bsrkl6q1.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/AsyncAsideIndex.DJTJPSZz.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76c04ee42efa-OSL\r\ncf-cache-status: HIT\r\nage: 27340\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: D3ZLke+NdYbebXt2zskaPg==\r\nx-oss-hash-crc64ecma: 6390231925544056619\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C8428F02F93631C581A8\r\nx-oss-server-time: 5\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":4551,"size_decoded":2356,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (4550)","md5":"0f764b91ef8d7586de6d7b76cec91a3e","sha1":"18c17bf86aacee75229d2ef8b42bd3d9d535b57d","sha256":"ce5d77298156b4593f1d81dcc73e0c9bc76fedb7171c321c204d54b29a58b736","sha512":"616cf698a13aef27c1f2376871a87a84dd7f50eca9a0abc57ff50b5ebc3a193846ea20ac727a28c7880d877395c8833b6450538235ad11b97603464364c9ab62","ssdeep":"96:6otGlZlZiON+9yRzJP9wxnWp46nDvOPrZKCuCcAX+Qbu3cTHxi6oHuV:JUlbY+RzTMnSRGZoy1THxX","tlshash":"8d9175d4891cd03e32bbf8c7d856c002a248b5a5de01e96462fabb79c6147dc63b1b2d","first_seen":"2026-10-09T17:19:19.127875Z","last_seen":"2026-10-09T18:33:13.974775Z","times_seen":5,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/p/3792/L1/SQ/hot/1012/4/custom_VND.webp?p=1791191450","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.646Z","timestamp":1791570703646,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/p/3792/L1/SQ/hot/1012/4/custom_VND.webp?p=1791191450 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c1c89d2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"79B7085155F0412933865FD6219FC779\"\r\nlast-modified: Sun, 27 Sep 2026 04:16:24 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: ebcIUVXwQSkzhl/WIZ/HeQ==\r\nx-oss-hash-crc64ecma: 11273582355045058010\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D366AFBCCE3535EA2A07\r\nx-oss-server-time: 20\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 23648\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23648,"size_decoded":24392,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"79b7085155f0412933865fd6219fc779","sha1":"b34d2f4ccda07b53615c5e9eca2221e0eca77322","sha256":"2bd47924b066d05cc808c4722ef7378ca0bb5b410fc9647f18e639062e26dfb0","sha512":"f1ed3c99614bd28e36fc69bcf7f6e7a03baaf5dd8733310f32f8af1a5abd1e45c6bc903482e3e0c89f79d2c650b624a47de38c01b7d52e5d7ee8addd2f039c96","ssdeep":"384:jKRbykjvCQsZHrSWJoaVKFNud0tiZ+JFEl60zJRDzDOY5DJTR2Dujb7Qi2imC7KC:jKRbBj6QoWAXVKDudFZQFEl6KJBnR2Dk","tlshash":"6fb2e13442568f9bbfd10c1a15bcd71b0e64a1c4515cf5a91a42fdf042fb324598ad7f","first_seen":"2026-10-09T17:45:43.392057Z","last_seen":"2026-10-09T18:33:13.975716Z","times_seen":4,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/hall/version_v2.json?t=1791570709235","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:49.249Z","timestamp":1791570709249,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /hall/version_v2.json?t=1791570709235 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D; g_state={\"i_l\":1,\"i_ll\":1791570704718,\"i_b\":\"AUD+1QJhwLFQIgL25h/mMPSBZUZ0nELdT6H4yLr7+QE\",\"i_e\":{\"enable_itp_optimization\":24},\"i_et\":1791570704718}\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:49 GMT\r\ncontent-type: application/json\r\ncontent-encoding: br\r\ncf-ray: a47f76e4cfc32efa-OSL\r\ncf-cache-status: MISS\r\ncache-control: no-cache\r\npriority: u=3,i=?0\r\nlast-modified: Fri, 09 Oct 2026 18:26:56 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: b42uHqM7fXKfSL04uhjklg==\r\nx-oss-hash-crc64ecma: 2283945156923342556\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC93315C05EDB3630570A70\r\nx-oss-server-time: 1\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":6613,"size_decoded":2193,"mime_type":"application/json","magic":"JSON text data","md5":"6f8dae1ea33b7d729f48bd38ba18e496","sha1":"ec3eaec1af8353e1a4f80888cb07d35ab115e3f5","sha256":"8941d9cf1c9a703372acdfc1f961479efed873d922fad83b63287a70391853fc","sha512":"9b94a1b335b2ad26200be279eddf0918cf5a98122f7fbfcc68361b635097fd445f55f65b68946e6b14ec73c37637ef7e3d8f4f7bd7a3497474fbe61847e711ff","ssdeep":"192:8SchSapYe1i10gkmou0hy0KtY4XOSXjcgIsD:8SchHYe1i10gkmou0hy0k","tlshash":"60d1c8424108d86b8b525f2574443a939fafd5fcbc47b0282fc6051ab6cd18c73ba6bb","first_seen":"2026-10-09T18:33:13.977541Z","last_seen":"2026-10-09T18:33:13.977541Z","times_seen":1,"resource_available":true,"data":null}},"time_used":417,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":417,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/upload/img/2104828426741563394.webp","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.739Z","timestamp":1791570703739,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/upload/img/2104828426741563394.webp HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76c2592d2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 27341\r\ncache-control: immutable,stale-while-revalidate=86400,public,max-age=86400\r\netag: \"502262FEDC5189720093B492813C1CF2\"\r\nlast-modified: Tue, 29 Sep 2026 06:59:56 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: UCJi/txRiXIAk7SSgTwc8g==\r\nx-oss-hash-crc64ecma: 3504430881848851933\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C8428F02F93631FE7AA8\r\nx-oss-server-time: 15\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 150956\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":150956,"size_decoded":151666,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"502262fedc5189720093b492813c1cf2","sha1":"9aa0809079d010fcf693527fbbdcb74995751c4a","sha256":"fa382186efd8c627713ffc70c22a1640e7aa637643766b369abda2a4899d353f","sha512":"064588ef11294f58ecf11520f5181f54dd9aac3c048ae53573b81ffc26d1ef8239b65027e219093795a8473ee8b1036d23f71605ab46dd6091f6086915348f81","ssdeep":"3072:uircFYdqOJsGNlC8wq6ktl5c6LAui7XERUR/Hy6bjUbRnUpnSEN8DR:VrEF8lDbtly6Lbi7XERU9S6MbRnU9be","tlshash":"05e31224a7334515e90622776628e9069a5810b1db62f40eccd33337b6ffb612a4776f","first_seen":"2026-10-09T17:45:43.770466Z","last_seen":"2026-10-09T18:33:13.979473Z","times_seen":4,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/festival-ui-group.D3Rwdyew.css","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.913Z","timestamp":1791570702913,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/festival-ui-group.D3Rwdyew.css HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: text/css\r\ncontent-encoding: br\r\ncf-ray: a47f76bd2bf12efa-OSL\r\ncf-cache-status: HIT\r\nage: 27341\r\ncache-control: max-age=31622400\r\npriority: u=2,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:01 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: Z2DwMHf3da2bw5h+0iKdQQ==\r\nx-oss-hash-crc64ecma: 1538754299234494677\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C841669A4C3532488B49\r\nx-oss-server-time: 13\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2419,"size_decoded":1174,"mime_type":"text/css","magic":"ASCII text, with very long lines (2418)","md5":"6760f03077f775ad9bc3987ed2229d41","sha1":"9d8d95401388d314d6f131221f28906977cd8358","sha256":"2d43f2b28bcb5ad7c312375454b19d9198a52b313f96e01130c83d1456638e61","sha512":"a8e631ee395e23377d3ad17fc213cd06a5358c3b898cf51c1d86f5dce7bf42ccf565715f070efd4417be52de816b576aabc1af7b0583813ec391831257601f6c","ssdeep":"","tlshash":"ff412dd2850d373dc16bbb23a8d4c19a467c514ae5e33d0ed7cb8fb122c69e8294ed51","first_seen":"2026-09-27T17:53:43.429384Z","last_seen":"2026-10-09T18:33:13.980393Z","times_seen":6,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/MenuList.Q2aaORav.css","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.917Z","timestamp":1791570702917,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/MenuList.Q2aaORav.css HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: text/css\r\ncontent-encoding: br\r\ncf-ray: a47f76bd3bfa2efa-OSL\r\ncf-cache-status: HIT\r\nage: 27341\r\ncache-control: max-age=31622400\r\npriority: u=2,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:01 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: DL7ogX1D1lkPFMAQjkDNfg==\r\nx-oss-hash-crc64ecma: 976804377115254047\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C841E702E230357B2543\r\nx-oss-server-time: 18\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":7651,"size_decoded":2027,"mime_type":"text/css","magic":"ASCII text, with very long lines (7650)","md5":"0cbee8817d43d6590f14c0108e40cd7e","sha1":"aab152b10293ecdcb1e4884a14adfd025f54b48d","sha256":"b53d69f8009200a287958c439a4d5aaea57fc437b7449831a1e5d722b082d72b","sha512":"0ec2f05a2eaf4d676d5267c0e69224e3394a9932d37b9cb186db54cf9e466dd33442a50754bf631b8da938ad86e8baf95f438b493e2ed13c4a65ebe507090c8a","ssdeep":"192:g3Z3xW10AIWk64wlWAmzKrqpQhXRMAGrCtjtfidbAsd1yZ1yX01yYR3ju0I2eqt9:mM1QESFgGci6","tlshash":"f0f179f1485af03c7a72f02aec86e25a13148892dfd50c607bb6567c8b667c167f4f49","first_seen":"2026-09-27T17:53:43.363675Z","last_seen":"2026-10-09T18:33:13.981055Z","times_seen":6,"resource_available":true,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-1/common/_sprite/icon_btm_yh.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.104Z","timestamp":1791570703104,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-1/common/_sprite/icon_btm_yh.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76be6d072efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 23458\r\ncache-control: max-age=604800,public\r\netag: \"18A3C88B9EECD6D1ACD32DBC0460B13F\"\r\nlast-modified: Fri, 25 Sep 2026 04:33:13 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: GKPIi57s1tGs0y28BGCxPw==\r\nx-oss-hash-crc64ecma: 11987380991306511720\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D76C447B51313107D5BF\r\nx-oss-server-time: 2\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 566\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":566,"size_decoded":1235,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"18a3c88b9eecd6d1acd32dbc0460b13f","sha1":"4a2d087f327e1895fcc9b6223af3dd0cd3d6d25a","sha256":"f2e594460a59eea41f75a0171f863772500e33414b1e7ba409a3b647b816f46a","sha512":"2f7cec3970d68aa76e839b9086b639322a347bc4f92ba58700cac85afcc032addb53e489a65c25e2476d594ca7a5d1615962d6c45f8465e91641b117f26bcd73","ssdeep":"","tlshash":"46f096634f2dee61d778a5b81b533321287020a80387d62c3fb5f0234071599b45120f","first_seen":"2026-10-09T17:45:43.586561Z","last_seen":"2026-10-09T18:33:13.982014Z","times_seen":4,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"global-websis.api.engagelab.cc/v1/get-webaddr","fqdn":"global-websis.api.engagelab.cc","domain":"engagelab.cc","tld":"cc"},"ip":{"addr":"43.153.194.206","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:44.123Z","timestamp":1791570704123,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.api.engagelab.cc","organization":""},"issuer":{"commonName":"RapidSSL TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Sun, 20 Sep 2026 00:00:00 GMT","end":"Tue, 06 Apr 2027 23:59:59 GMT"},"fingerprint":{"sha1":"C4:CB:0D:2D:4C:38:E6:57:4B:E0:46:BB:25:9B:DB:00:6E:6D:37:80","sha256":"52:52:66:3D:C8:15:50:81:7C:7F:0F:A4:E9:B4:F2:F4:6B:6B:C6:DF:EE:F7:95:22:22:27:0F:3B:69:21:2E:82"}}},"request":{"raw":"POST /v1/get-webaddr HTTP/1.1\r\nHost: global-websis.api.engagelab.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nContent-Length: 37\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nConnection: keep-alive\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"appkey\":\"9ec737c30e02452cba9b30ce\"}"}},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 09 Oct 2026 18:31:44 GMT\r\ncontent-type: application/json\r\ncontent-length: 127\r\naccess-control-allow-origin: https://ad852.xyz\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":127,"size_decoded":300,"mime_type":"application/json","magic":"JSON text data","md5":"d41e6eb32da852eaa9caabb89ee51dee","sha1":"6cd773bdc21f2c496a48a47a9bd1bd50aa6edd18","sha256":"ee4d79a56bd3aab7051b45966f8c00a09f105147cdc2c111b9b2d3c3f8dfac1c","sha512":"53cd2f65aa547642d3f8a666174abc4008495eff58e644398527cf647984e15e9bf572e657e65ba30fb246d9a307b4307b4ec3eada5fcc10fcf94de33d56176c","ssdeep":"","tlshash":"d8b09bb754095815973911c0b01cf064b59785465581d5d7c3621f5560674d1c144054","first_seen":"2026-07-09T22:33:24.710965Z","last_seen":"2026-10-09T18:33:13.983414Z","times_seen":14,"resource_available":true,"data":null}},"time_used":176,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":176,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/AsideIndex.BpGDo2s6.css","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.919Z","timestamp":1791570702919,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/AsideIndex.BpGDo2s6.css HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: text/css\r\ncontent-encoding: br\r\ncf-ray: a47f76bd3c042efa-OSL\r\ncf-cache-status: HIT\r\nage: 27341\r\ncache-control: max-age=31622400\r\npriority: u=2,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:01 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: XgS+eREcykc5v0tzVso51A==\r\nx-oss-hash-crc64ecma: 11845967475953077738\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C841E9CC4C3133AB0AC5\r\nx-oss-server-time: 15\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":9467,"size_decoded":2426,"mime_type":"text/css","magic":"ASCII text, with very long lines (9466)","md5":"5e04be79111cca4739bf4b7356ca39d4","sha1":"b8bcb1eb575dd05202bce1451775cbeebb22571b","sha256":"1eeb8e35945a7594ce236d6079d0889787c1005931bdfe27128bf12d8da8747a","sha512":"dbd326a6eea61274f482b0af0f55816a3df0dca644c34ac3e13f2d7c625106748e7064ba52e57104d1069627942b313d8034d71b02c881cf7879bb8624ba9991","ssdeep":"192:KsnanynDU1VnscnwnDrqzwz+z6znvOZr7tftbL6z2kkZlPDyrKJMREu3H:K0anynkVnBnwnDuQuqP9","tlshash":"9a1241768ee8b039c46a117f51b3a7dd23c8ccd0e7418aa5a74f0b3d8ea5fe1b160156","first_seen":"2026-10-09T17:45:43.415957Z","last_seen":"2026-10-09T18:33:13.986496Z","times_seen":4,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"global-websis.api.engagelab.cc/v1/get-webaddr","fqdn":"global-websis.api.engagelab.cc","domain":"engagelab.cc","tld":"cc"},"ip":{"addr":"43.153.194.206","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:44.126Z","timestamp":1791570704126,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.api.engagelab.cc","organization":""},"issuer":{"commonName":"RapidSSL TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Sun, 20 Sep 2026 00:00:00 GMT","end":"Tue, 06 Apr 2027 23:59:59 GMT"},"fingerprint":{"sha1":"C4:CB:0D:2D:4C:38:E6:57:4B:E0:46:BB:25:9B:DB:00:6E:6D:37:80","sha256":"52:52:66:3D:C8:15:50:81:7C:7F:0F:A4:E9:B4:F2:F4:6B:6B:C6:DF:EE:F7:95:22:22:27:0F:3B:69:21:2E:82"}}},"request":{"raw":"OPTIONS /v1/get-webaddr HTTP/1.1\r\nHost: global-websis.api.engagelab.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 09 Oct 2026 18:31:44 GMT\r\ncontent-type: application/json\r\ncontent-length: 3\r\naccess-control-allow-headers: content-type\r\naccess-control-allow-methods: POST\r\naccess-control-allow-origin: https://ad852.xyz\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3,"size_decoded":254,"mime_type":"application/json","magic":"ASCII text","md5":"a227d42afbcc590b4e949075cde4a5b6","sha1":"20b40ff2624a56b681d03737e2cfea7ed545726b","sha256":"bd85bcdb8d4e613a79cb62d0903946ad10c83e63dc75f67614c159c0dbf4d184","sha512":"12793ab79c1b4eab7fbfe1ca524f6e9518df6b96654d5a5bf131339f8143636ff6fcb480486e9b3792e29bc87aeaaa2936a3909904113806b0966c13bb44c33c","ssdeep":"","tlshash":"c720000000000000000000000000000000000300000000000000000000000000000000","first_seen":"2023-06-16T12:29:13Z","last_seen":"2026-10-09T18:33:13.987957Z","times_seen":101,"resource_available":true,"data":null}},"time_used":699,"timings":{"blocked":0,"dns":0,"connect":173,"send":0,"wait":175,"receive":0,"ssl":350},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ytbacksexo.xyz/hall/api/gohal/heartbeat","fqdn":"ytbacksexo.xyz","domain":"ytbacksexo.xyz","tld":"xyz"},"ip":{"addr":"8.233.17.31","port":443,"asn":3356,"as":"LEVEL3","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:52.600Z","timestamp":1791570712600,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ytbacksexo.xyz","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Tue, 29 Sep 2026 13:10:22 GMT","end":"Mon, 28 Dec 2026 14:06:17 GMT"},"fingerprint":{"sha1":"04:0A:47:19:B0:39:99:10:59:DF:86:B3:5D:7C:0A:9C:BD:E2:E6:E6","sha256":"31:E0:07:6A:95:AF:27:B6:02:96:5F:18:19:44:AA:81:D9:DF:02:17:C7:1E:25:ED:01:84:C0:20:BB:82:4E:FB"}}},"request":{"raw":"OPTIONS /hall/api/gohal/heartbeat HTTP/1.1\r\nHost: ytbacksexo.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: appsystem,appversion,browserfingerid,browsertype,clienttimezone,currency,device,devicebrand,devicemodel,domain,language,operatingsystem,physicaldevicemodel,platformtype,sitecode,timestamp,token,webauthndomain,x-custom-referer,x-data-mode,x-device,x-object-id,x-request-id,x-version\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 200 \r\ndate: Fri, 09 Oct 2026 18:31:52 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 0\r\nset-cookie: acw_tc=0a0f6bd417915707129534804e416fc9530a7aa69d659309869a1c0cf5decb;path=/;HttpOnly;Max-Age=1800\r\nx-saas-server-id: 8576b68756-46hgc|ea270fcd1496d6242a7d57c9f950567a\r\naccess-control-allow-methods: *\r\naccess-control-max-age: 1728000\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: appsystem,appversion,browserfingerid,browsertype,clienttimezone,currency,device,devicebrand,devicemodel,domain,language,operatingsystem,physicaldevicemodel,platformtype,sitecode,timestamp,token,webauthndomain,x-custom-referer,x-data-mode,x-device,x-object-id,x-request-id,x-version\r\naccess-control-expose-headers: X-Trace-ID, newjwt, token\r\nvia: 1.1 google\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":[{"name":"acw_tc","value":"0a0f6bd417915707129534804e416fc9530a7aa69d659309869a1c0cf5decb","quoted":false,"path":"/","max_age":1800,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"acw_tc=0a0f6bd417915707129534804e416fc9530a7aa69d659309869a1c0cf5decb;path=/;HttpOnly;Max-Age=1800"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":0,"size_decoded":895,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-09T20:29:43.461907Z","times_seen":18980891,"resource_available":true,"data":null}},"time_used":535,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":535,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ytbacksexo.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/200/3/2000135/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.652Z","timestamp":1791570703652,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/200/3/2000135/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c1c8a42efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"23FED4D974629CB2F8639DE50EC7DF24\"\r\nlast-modified: Sun, 27 Sep 2026 04:52:54 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: I/7U2XRinLL4Y53lDsffJA==\r\nx-oss-hash-crc64ecma: 16663364862856337027\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D366A87B9A393116094C\r\nx-oss-server-time: 17\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 17174\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17174,"size_decoded":17918,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"23fed4d974629cb2f8639de50ec7df24","sha1":"a6fde4e84cf591dfb8e239e8e35c86d3373bb61a","sha256":"799ee4323bd31557f9a5c062b488dd0a38bb287242d4f1050f5cf799a0f4ae41","sha512":"efefe51880fef49b876e713ef4d26f33c43f0a018d8ae2b05176f891c72f4fa1e881fcd7596614e06ebb031adbab08cab8d0a00a6fb8e643eb965db908f9c4b8","ssdeep":"384:oa2rmqjTny9SxC438cIpOdewU/tX84xMrHFiHFIyPL:o/LyG84H4xMoywL","tlshash":"2772df9d92a19e17255b2f5ca406c26ee9083829fe8a628f1457e00a598b059567ea30","first_seen":"2026-10-09T17:45:43.827782Z","last_seen":"2026-10-09T18:33:13.988684Z","times_seen":4,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/workers-DZZHDtNt.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:44.138Z","timestamp":1791570704138,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/workers-DZZHDtNt.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:44 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76c4db662efa-OSL\r\ncf-cache-status: HIT\r\nage: 27999\r\ncache-control: max-age=31622400\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: 1uHMLZWdBxVbSH1JEbYIfg==\r\nx-oss-hash-crc64ecma: 10918190586927633353\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C5B00A93063436356A2F\r\nx-oss-server-time: 4\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4420,"size_decoded":2249,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"d6e1cc2d959d07155b487d4911b6087e","sha1":"6334fce87963b6c07edbcc4277bf01565b9d0798","sha256":"b5b10a66bb72a298d200bc6c64734fc38faf8770a3e0f2a8ed5de79a0e07ef7a","sha512":"42e39ca5e6ef4d40feaf5a44af8155947e143786b7f7acaab2afe1d3cf6d2a04cbdeaa8b3dd5d2de0874a4b4ed702a68ae94ba00183c9a69c8667696b41ebf3f","ssdeep":"96:PuwSVVYp76V91Yu1b2i0BXFRY/k6/QR46XXgEUKxaYlIjRqrIspS:PuwSVVYp76n1Ywbd0drQ/QRVXXgEjxx6","tlshash":"6791230f7ef634669027b074561f9801ba61a42701dddc207e9ce2b09f558385bbefad","first_seen":"2024-12-20T05:32:30.464122Z","last_seen":"2026-10-09T19:17:20.776328Z","times_seen":11983,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/common/upload/2091899911632654338.webp","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:46.813Z","timestamp":1791570706813,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /common/upload/2091899911632654338.webp HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D; g_state={\"i_l\":1,\"i_ll\":1791570704718,\"i_b\":\"AUD+1QJhwLFQIgL25h/mMPSBZUZ0nELdT6H4yLr7+QE\",\"i_e\":{\"enable_itp_optimization\":24},\"i_et\":1791570704718}\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:46 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76d58d702efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 25651\r\ncache-control: immutable,stale-while-revalidate=86400,public,max-age=86400\r\netag: \"4E8DF09509F1268CAB2CBBB5A78C8BD1\"\r\nlast-modified: Mon, 24 Aug 2026 14:46:23 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: To3wlQnxJoyrLLu1p4yL0Q==\r\nx-oss-hash-crc64ecma: 5094567792084389382\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8CEDF4E81D53638F09482\r\nx-oss-server-time: 22\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 119984\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":119984,"size_decoded":120694,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4e8df09509f1268cab2cbbb5a78c8bd1","sha1":"6713d738da2dacbcab6db3eb418728adbcd53535","sha256":"4cf48b640d79d317e1f3211d1feb3a26a83005a91487a9807589613133f9a171","sha512":"53a5be0b7848ea68f83027e9a8db781b50f44f9b94909deace6a2b12839a1b7e2eb0e5e5beb137072cbe1d15628ece9a43ecbfedf7b936dc9d0045d407670c52","ssdeep":"3072:TRM+4ZJQDDTV8hl17ThxKR15tJzvm25YVFZpfdb7:e+4zQDDT67Tn+zvm258","tlshash":"cfc3125ac005d730cde362f8e5969012f19f9acbc19c5a09a29f796fa6e43f4350cb31","first_seen":"2026-10-09T17:45:43.396387Z","last_seen":"2026-10-09T18:33:14.002378Z","times_seen":4,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"global-websis.api.engagelab.cc/v1/get-webaddr","fqdn":"global-websis.api.engagelab.cc","domain":"engagelab.cc","tld":"cc"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.633Z","timestamp":1791570703633,"http_version":"","security_state":"","security_info":null,"request":{"raw":"OPTIONS /v1/get-webaddr HTTP/1.1\r\nHost: global-websis.api.engagelab.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-09T20:29:43.461907Z","times_seen":18980891,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/upload/img/2104874109111459841.webp","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:49.227Z","timestamp":1791570709227,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/upload/img/2104874109111459841.webp HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D; g_state={\"i_l\":1,\"i_ll\":1791570704718,\"i_b\":\"AUD+1QJhwLFQIgL25h/mMPSBZUZ0nELdT6H4yLr7+QE\",\"i_e\":{\"enable_itp_optimization\":24},\"i_et\":1791570704718}\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:49 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76e4afb12efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 18565\r\ncache-control: immutable,stale-while-revalidate=86400,public,max-age=86400\r\netag: \"F739E3E47FE2A4483C8309ED6956187F\"\r\nlast-modified: Tue, 29 Sep 2026 10:01:09 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: 9znj5H/ipEg8gwntaVYYfw==\r\nx-oss-hash-crc64ecma: 4628275329473053927\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8EA9088D14B313300765F\r\nx-oss-server-time: 18\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 95044\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":95044,"size_decoded":95753,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 920x720, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f739e3e47fe2a4483c8309ed6956187f","sha1":"f949c58f040364eae30128ad46b5d6977b05d052","sha256":"066fd25486243ccf40d8ee39fd986d2d71f9c9b95828e35696635cb8ceefeacf","sha512":"4f22e029d3af7ebc6922ca0b5870866e2a394d4bfd7db246acf3f2c3239b3c3f7072435f84ff672e7679454646ba792e417a31968e60c59add8d07942fb6439c","ssdeep":"1536:9kEHRiNtfcnd9QvZMv77ONnKwRdzuMcZwS/uGnmZTh7x/ZT+amP7qgmc:GwN8ZMveNnKwRxe2GnmZtxxT+amP+Y","tlshash":"5293127dfe61687debb45f98649740b35323a4cac53a1a8276f3c107dda1fb4d804a88","first_seen":"2026-10-09T17:45:43.618398Z","last_seen":"2026-10-09T18:33:14.004489Z","times_seen":4,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":16,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-1/common/_sprite/icon_btm_sy.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.099Z","timestamp":1791570703099,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-1/common/_sprite/icon_btm_sy.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76be5cfe2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 23458\r\ncache-control: max-age=604800,public\r\netag: \"E13923267AF56F4ADF265B0067F2EBF6\"\r\nlast-modified: Fri, 25 Sep 2026 04:53:38 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: 4TkjJnr1b0rfJlsAZ/Lr9g==\r\nx-oss-hash-crc64ecma: 2410316701204618124\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D76C447B513131A6D4BF\r\nx-oss-server-time: 15\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 772\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":772,"size_decoded":1441,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e13923267af56f4adf265b0067f2ebf6","sha1":"b974040ddf9c6bbf731fb758c8f42eaf0ff2ba8f","sha256":"becf72f7f2061a2230b3db8b53e730e192db1a1831f81097f57a518a46912587","sha512":"5217d434c4b4d1cd2cfab6f9287918fa06fe25d3ca117df655befc36f95a8d3d0026b7e489404ddd3c8092729be9ed93cdfeef29ba40fa1367659b7be20d4ff0","ssdeep":"","tlshash":"4601ba7047721cbda9b053506ea4cc271e057906e3070ec161474a9510bfc68e1b5290","first_seen":"2026-10-09T17:45:43.653252Z","last_seen":"2026-10-09T18:33:14.006212Z","times_seen":4,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/p/3792/L1/SQ/hot/346/4/custom_VND.webp?p=1791191450","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.649Z","timestamp":1791570703649,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/p/3792/L1/SQ/hot/346/4/custom_VND.webp?p=1791191450 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c1c8a22efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"9B34BACF74A239DCDBE54EB8DF24DDCC\"\r\nlast-modified: Sun, 27 Sep 2026 04:17:26 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: mzS6z3SiOdzb5U643yTdzA==\r\nx-oss-hash-crc64ecma: 3501807570915417094\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D36688D14B353458052C\r\nx-oss-server-time: 22\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19382\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":19382,"size_decoded":20125,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"9b34bacf74a239dcdbe54eb8df24ddcc","sha1":"878133798b64f29ba28e6917bbfb44b985a0536f","sha256":"1078a68d4cf3ac301c11f9b942f70da70df2ab95f98ad45fb27d6a68c277d2b7","sha512":"304dce926c2338e1eb962b106ee1d60f28f640f6ad71af0b68694765201fd49662da25bce70aaeb4bc9291aa5716fd4fe1614d34021af8e26a69cd2a938a4400","ssdeep":"384:y4XkKhQ3wxHLg6hAs3znAJcLaICegsMeQaKyjdF+ZgUY1sKt3ZO+UzoEmLo3e:y40uQwJL1hBznLLaxegJebr+ZgU0x3US","tlshash":"a792e19619b63a37cba7931c9010b478009982f772539e3a2230dd35ab5333395ee0cb","first_seen":"2026-10-09T17:45:43.839481Z","last_seen":"2026-10-09T18:33:13.794681Z","times_seen":4,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/200/3/2000074/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.757Z","timestamp":1791570703757,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/200/3/2000074/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76c2795c2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"770C693F938E334B45F45D75E0FBEADB\"\r\nlast-modified: Sun, 27 Sep 2026 04:19:50 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: dwxpP5OOM0tF9F114Pvq2w==\r\nx-oss-hash-crc64ecma: 15920645692694705135\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D36675EC4632349E6628\r\nx-oss-server-time: 39\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 22662\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":22662,"size_decoded":23406,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"770c693f938e334b45f45d75e0fbeadb","sha1":"d58b9380d96375eeab14a97364b63fa6d3af8d19","sha256":"a0a1a5b043250f7a039b65758dda0e7935ce6f03653e19ab6b8d9d39bfbd0c0a","sha512":"0ba72181451f3d64661192cacc46cda37826c49936507c81396b16c6a6ab739d556ac32f812548a03b73913c37a28ffe1c6ce09723c2602201f7a1f5208082a8","ssdeep":"384:dHh4LGPPIPvtm1FP06rVTdbVHPgJ61s3MSeLFhxshjsnCTPOkNjB/X9SYp3q9c:FCkPGF/6rXBows3xeLKxTPfF/sYp3J","tlshash":"5da2e09a80705369fc9fc094a7bc30c05203ecda6ba96f6d6e46b586cd6c123c79b854","first_seen":"2026-10-09T17:45:43.837386Z","last_seen":"2026-10-09T18:33:14.007087Z","times_seen":4,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/index.BK_13tHV.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.103Z","timestamp":1791570702103,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/index.BK_13tHV.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76b8185a2efa-OSL\r\ncf-cache-status: HIT\r\netag: W/\"1AC4CD5398779C0E7C79022361E44044\"\r\nage: 25005\r\ncache-control: max-age=31622400\r\npriority: u=1,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: GsTNU5h3nA58eQIjYeRARA==\r\nx-oss-hash-crc64ecma: 5479490127589162678\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D160E702E2333719F8BD\r\nx-oss-server-time: 2\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":199,"size_decoded":847,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"1ac4cd5398779c0e7c79022361e44044","sha1":"e43989f341cf004914b3a6fa4b44dfb28a06ecce","sha256":"e4ab9ad28ed82614500d3420b0467843720abf14f9f3a7d567983b09873b5620","sha512":"ca90934eb888e6084ee6f06e78726a4cbe436673354bd989e1ba6d8e096399f090e24a292fd7a1c75e06d72aa3191af2cfdde4d6847f46e74fc4be7d172cd898","ssdeep":"","tlshash":"23d0c0a3c010b6d028e1c8c0cfb9e592a3ce03331302422bf0fe33169348c31cd04411","first_seen":"2026-10-09T17:19:18.835474Z","last_seen":"2026-10-09T18:33:14.008215Z","times_seen":7,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/upload/img/2103354827301761026.webp","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.096Z","timestamp":1791570703096,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/upload/img/2103354827301761026.webp HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76be5cf42efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24490\r\ncache-control: immutable,stale-while-revalidate=86400,public,max-age=86400\r\netag: \"98F187172694E9B030C3B7A221CF740A\"\r\nlast-modified: Fri, 25 Sep 2026 05:24:04 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: mPGHFyaU6bAww7eiIc90Cg==\r\nx-oss-hash-crc64ecma: 4432472439612705818\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D364AFBCCE3535581307\r\nx-oss-server-time: 34\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1720\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1720,"size_decoded":2428,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"98f187172694e9b030c3b7a221cf740a","sha1":"2091256d9288db049513301f1560205fc9c46004","sha256":"c1b76395e2f1a6153ce068e2f575b99d00c2fd4b3b4bba344854a4d5b54ab771","sha512":"52e5b6b27a0a0e3059e6400055fec61801c4400bbea4e06b0bc5756450233bc6fc5615e32556d62aaa8cfa19ce345940a1e0a3f2b119dbd7e643c657a2260acc","ssdeep":"","tlshash":"dc31fd41fadcd8638dd0b071d4d21f45ec87c6185b97087b08572a627d0d9a2ec71bd9","first_seen":"2026-10-09T17:45:43.402491Z","last_seen":"2026-10-09T18:33:14.009729Z","times_seen":4,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/festival-ui-group.DIvylWvC.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.112Z","timestamp":1791570703112,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/festival-ui-group.DIvylWvC.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/commonChunk.0oGKmx_H.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76be6d102efa-OSL\r\ncf-cache-status: HIT\r\nage: 27341\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: DJ1L6t4qocVLFLCKrL71Og==\r\nx-oss-hash-crc64ecma: 17762546556807963311\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C841EEA19D31349DEB3C\r\nx-oss-server-time: 52\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9505,"size_decoded":3430,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (9504)","md5":"0c9d4beade2aa1c54b14b08aacbef53a","sha1":"61ff5d9069aa11d8f8f5419700b8d2fda5dfe747","sha256":"fe05be9fb5f12ce448924ba7be291ea34afe1d20c91ff6c4fbfd3b50bfca42ea","sha512":"4c9cfa405497361ed1fd9db4d04344025d8d0272c8a2325dd8b0f971db4258d6ae4475c7290e70862ca11b2144cbb93f4193c9710d1cbff8cf5337df4ea0ad30","ssdeep":"192:Zh882fRHkTbIO8X6NVhFlkxAPh3oyoLavf1LTl:Zh882fRHabIO8XEVhw6P7","tlshash":"5512988f50983430d66f2d97803a8092585edb5ac311e946f3f2fea876c2e695f91633","first_seen":"2026-10-09T17:19:19.160508Z","last_seen":"2026-10-09T18:33:14.01059Z","times_seen":5,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/common/web/home/btn_sc_off_2.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.756Z","timestamp":1791570703756,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/common/web/home/btn_sc_off_2.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76c2794b2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: max-age=604800,stale-while-revalidate=86400,immutable,proxy-revalidate,public\r\netag: \"ADF0800E031CFF7D59106FE817B660C1\"\r\nlast-modified: Wed, 07 Oct 2026 02:14:13 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: rfCADgMc/31ZEG/oF7ZgwQ==\r\nx-oss-hash-crc64ecma: 1444142512097110568\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D36675EC463234416628\r\nx-oss-server-time: 10\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 684\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":684,"size_decoded":1409,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"adf0800e031cff7d59106fe817b660c1","sha1":"105c4cdba9771fbf4a9ab44cc9898d58fd3668e5","sha256":"beff374b37469062554a6f44b78a685434ed71245648a3c7883b9a347fa5f2bd","sha512":"ebbebc6656976fdaca3ed7dbd545c6ad865984dbaf696e160a4fe7bffce55cd2548ec09883e04bd595032c1150bbc82eb482aa3584409fccff518e226ec5cd71","ssdeep":"","tlshash":"7301887b017d9af18505dd8954a6b2b4f047396e8c007f32c6b155f575011bd703743b","first_seen":"2024-08-03T23:56:14Z","last_seen":"2026-10-09T18:33:14.011668Z","times_seen":64,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/312/11/312001/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.770Z","timestamp":1791570703770,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/312/11/312001/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76c2898f2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"16785DF085DF4FA69263995257D9D44E\"\r\nlast-modified: Sun, 27 Sep 2026 04:27:10 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: Fnhd8IXfT6aSY5lSV9nUTg==\r\nx-oss-hash-crc64ecma: 15160503604812439007\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D366447B513136B8478B\r\nx-oss-server-time: 12\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7716\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7716,"size_decoded":8459,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"16785df085df4fa69263995257d9d44e","sha1":"e96ffb00ac8ebdd081e2e7c64c3d047c56f5d7ce","sha256":"6eb2685a3d4f3b2eb078f080565eff8447f6166d85e4102dbdfeb27d957cfaec","sha512":"4eb076b9d5306cf4cdc5f61a5f7b25eeb861e86dadffcec92ddcf89f96c01653e5337dd3a2fd04074e2afdd00c73665286d0d32b44b5394a71622bd8e66d8ca3","ssdeep":"192:s/JmuA6knLnaKoH2D+mBnTGW/fJBG0YZ/66dt:s/JWPLnslmBnTG6f3GV","tlshash":"aff19e21473a7de2e6f62ff993bc8977461729410873ae50432ac83a35a87503476f85","first_seen":"2026-10-09T17:45:43.728459Z","last_seen":"2026-10-09T18:33:14.012888Z","times_seen":3,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/upload/img/2086060536948338689.png","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:45.777Z","timestamp":1791570705777,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/upload/img/2086060536948338689.png HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D; g_state={\"i_l\":1,\"i_ll\":1791570704718,\"i_b\":\"AUD+1QJhwLFQIgL25h/mMPSBZUZ0nELdT6H4yLr7+QE\",\"i_e\":{\"enable_itp_optimization\":24},\"i_et\":1791570704718}\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:45 GMT\r\ncontent-type: image/png\r\npriority: u=6,i=?0\r\ncf-ray: a47f76cf19462efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 27990\r\ncache-control: immutable,stale-while-revalidate=86400,public,max-age=86400\r\netag: \"5991FCCAB105B5351AEA86EB5A84D720\"\r\nlast-modified: Sat, 08 Aug 2026 12:02:44 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: WZH8yrEFtTUa6obrWoTXIA==\r\nx-oss-hash-crc64ecma: 4333458525956311755\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C5BBEEA19D3835E4351B\r\nx-oss-server-time: 7\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 94642\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":94642,"size_decoded":95352,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit colormap, non-interlaced","md5":"5991fccab105b5351aea86eb5a84d720","sha1":"001bff984bc35c9e40baae3fa6a75028ff7a5b2a","sha256":"c9f99e370f66964ee79cf633512dbb2230bfc4c74f7be85ecf87970d5a0037f5","sha512":"7a60b55e32f10d04bcd421b8156aa5db68394f8654e32375d2aec342f361704635ed04d3d75d2427d91b3aab9812d89d2e5204ba83776d0a8306d1d1b709ab7b","ssdeep":"1536:gL+TB1lhP6WmfaBWc70QdxSMQgV5R3may6qdk0JO/gNd63N/wNl84EqmvKoLH/A9:3TB1qfaBBVoMd1ry6q60PduRWPEqIr7w","tlshash":"13931228df9b0e57d393d70fa506d320101532246bb9aee603ba2dcd7a1b7a5d143e43","first_seen":"2026-10-09T17:19:18.751848Z","last_seen":"2026-10-09T18:33:13.873615Z","times_seen":7,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/commonChunk.0oGKmx_H.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.101Z","timestamp":1791570702101,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/commonChunk.0oGKmx_H.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76b818572efa-OSL\r\ncf-cache-status: HIT\r\nage: 25005\r\ncache-control: max-age=31622400\r\npriority: u=1,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: QV6F1u1Qr5wS05Jytl+3fQ==\r\nx-oss-hash-crc64ecma: 4271081454595560377\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D160A87B9A3131AC2331\r\nx-oss-server-time: 23\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1434522,"size_decoded":451528,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (59299)","md5":"9e28593dc8ad5b8bd4076c69c27a2485","sha1":"75c8576b60242821cd5f587e075584b8313a16cf","sha256":"383f403e97ceb1e9abfb70b2e84fd47034e2156fbce9137fc8d605b3f941b8fb","sha512":"58080aa34b5f240a30f60160037f154eb9e1c94320f47a667a30bbfa299b2b7e6ef3b798c57e5ae5974ae83bd797c392a12c0fe90c0b09c19870ea1a86845a31","ssdeep":"24576:3FrPLPikBBoVy6GOGbNRF/XWdQZ4IecpgDtQaN:3FrzPNBBoVy6GOSbF/XWdQZ4IecpgDtv","tlshash":"f9257d8ab1be257177b41cdc907a156261287f017406c8f4f2bf8f7a3356945a2f2b3a","first_seen":"2026-10-09T17:19:18.887934Z","last_seen":"2026-10-09T18:33:14.015865Z","times_seen":6,"resource_available":true,"data":null}},"time_used":96,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":89,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/upload/img/2105266192938786818_x50.webp","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.101Z","timestamp":1791570703101,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/upload/img/2105266192938786818_x50.webp HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=3,i\r\ncf-ray: a47f76be5cff2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24490\r\ncache-control: immutable,stale-while-revalidate=86400,public,max-age=86400\r\netag: \"2F49ED29A29B1178D28D29869C6D8176\"\r\nlast-modified: Wed, 30 Sep 2026 11:59:14 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: L0ntKaKbEXjSjSmGnG2Bdg==\r\nx-oss-hash-crc64ecma: 17426297462836426569\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D3644005843436E45E82\r\nx-oss-server-time: 18\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 15172\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":15172,"size_decoded":15882,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 510x150, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2f49ed29a29b1178d28d29869c6d8176","sha1":"fe5e4ca4ffe71d981ac9aa784aa97c525d6fbd2c","sha256":"a2f27732c21e8a7ca25b2431d540cf334461d87d18d12cd8d4f27a55e835fb15","sha512":"c83ee9a99cd7a32cf1a0ace6af654e16ac4d7da99f0d35a5cec87b9fb89b9ae01279b65d08d5993a5f462d683274b1b01dac117d984860500fa24ae78e989d9c","ssdeep":"384:Bx8qUiZx8qQvUJMPulzbKw8rvbP2KEkrhMz+qfPKS:jU+hKPulSVrvrdhMSy9","tlshash":"a762c091241d2b4aa06e8454cf347c583e276aefac7ebff05dc2e55b9b0b0012ab7141","first_seen":"2026-10-09T17:45:43.59063Z","last_seen":"2026-10-09T18:33:14.017752Z","times_seen":4,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-common/common/_sprite/icon_dtfl_zr_1.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.368Z","timestamp":1791570703368,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-common/common/_sprite/icon_dtfl_zr_1.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c00e752efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24490\r\ncache-control: max-age=604800,public\r\netag: \"54BDD6E1267A4C828912973104D9FB7C\"\r\nlast-modified: Fri, 25 Sep 2026 04:33:13 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: VL3W4SZ6TIKJEpcxBNn7fA==\r\nx-oss-hash-crc64ecma: 1614107133037453224\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D364AFBCCE3535761507\r\nx-oss-server-time: 35\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2050\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":2050,"size_decoded":2720,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"54bdd6e1267a4c828912973104d9fb7c","sha1":"9fa1fbdb646e60bc04feaa692fcb86326d4b5ff6","sha256":"d7a01d1928513c03d5298cfa9297a6b2ba1a350a066009cf7756eca0bd1cd408","sha512":"4b69f7eb880e267203529fbd65131a8bf77d1158ac7768abb35c779b3fa58e0c6189039c37a5dd53e8d42ab18094ec7d302ca89c6395a6e620fd8dd759f1ce6d","ssdeep":"","tlshash":"2c411a5565ecdce4cc627e6e6575a801e34a980ef5a10e305442f0df38e02fa399f795","first_seen":"2026-10-09T17:45:43.473543Z","last_seen":"2026-10-09T18:33:14.020254Z","times_seen":4,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"accounts.google.com/gsi/style","fqdn":"accounts.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"172.253.148.84","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:44.719Z","timestamp":1791570704719,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:00:11 GMT","end":"Fri, 11 Dec 2026 20:00:10 GMT"},"fingerprint":{"sha1":"81:58:83:A3:C8:EB:81:F3:A5:FE:6C:6B:D8:F7:B3:E8:49:83:32:0F","sha256":"30:B5:2C:EA:47:6E:0A:AB:5B:94:50:CC:FC:33:CB:F9:57:B2:4B:F1:B4:5D:3D:7D:BB:10:A6:02:81:8E:54:F5"}}},"request":{"raw":"GET /gsi/style HTTP/1.1\r\nHost: accounts.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/css; charset=utf-8\r\nexpires: Fri, 09 Oct 2026 18:31:44 GMT\r\ndate: Fri, 09 Oct 2026 18:31:44 GMT\r\ncache-control: private, max-age=86400\r\ncontent-security-policy: script-src 'nonce-YvF1TkLJqm1_klkQKgC_2A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"coop_dd7de8473bddc59c6b748810a67a39b1\"\r\ncross-origin-resource-policy: cross-origin\r\nreport-to: {\"group\":\"coop_dd7de8473bddc59c6b748810a67a39b1\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1\"}]}\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":696,"size_decoded":1373,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (696), with no line terminators","md5":"ee570cebd6ae40b9567844b080aee1e9","sha1":"2b7b0ffcfe8aca40ced147fb7ce107010392d6b9","sha256":"d49e8f04be7ccbb69e87ae474ee50f6903b780451989e66d35ffc247a80510fe","sha512":"836c832111c285f7cb692c4eb62e2bca615017b6ab4af6920674f17df0ae1da040f7171208d5d312c3c43ed8ed7e49b653e7fce0948f24076d0548f7c8e8f25a","ssdeep":"","tlshash":"430197321aa2602eecb3ab3bf04a9d8c023aa117eeb705ccb59cca15c38d95874a5041","first_seen":"2025-10-22T21:08:41.081019Z","last_seen":"2026-10-09T20:26:39.936455Z","times_seen":93253,"resource_available":true,"data":null}},"time_used":58,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/GlobalEventListenerIndex.BYsJMIjY.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.159Z","timestamp":1791570703159,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/GlobalEventListenerIndex.BYsJMIjY.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/commonChunk.0oGKmx_H.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76bebd462efa-OSL\r\ncf-cache-status: HIT\r\nage: 24672\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: SKaYPPor6pqaO0JFnrp/Hw==\r\nx-oss-hash-crc64ecma: 10689936879485569633\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D2AE75EC463936D5D41E\r\nx-oss-server-time: 17\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8289,"size_decoded":3990,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (7279)","md5":"48a6983cfa2bea9a9a3b42459eba7f1f","sha1":"70ad4b16859b9bd21d7226cb052fd766a95ad50b","sha256":"91f9e876b1e94d247be7f5a842ae2102cabe31426c8b812f5caa2c417c48152c","sha512":"1162b9549964006422413c6967502c65c9dba26f35fc0e122cbadce22f9e8579a9dee27b3166f38e2e9e060dc79b38ebecea71487507fd68b20558a3b4a4034c","ssdeep":"192:lUCCdxhTlc8c0ipXDpLBzVMuq+Av0N8Zy83pRR7Rs+D5hdSuq5o7lk9kPZSkWM:lrCdXT+8c0ihJJlq+Av0N8I83pRR7i+Z","tlshash":"ab02c88952797bfc78e52dc8e9a35093061567d72502c3e8f07f2d15628d8018f79ef6","first_seen":"2026-10-09T17:19:18.854711Z","last_seen":"2026-10-09T18:33:14.021983Z","times_seen":7,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/312/11/312001/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.661Z","timestamp":1791570703661,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/312/11/312001/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c1d8b02efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"16785DF085DF4FA69263995257D9D44E\"\r\nlast-modified: Sun, 27 Sep 2026 04:27:10 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: Fnhd8IXfT6aSY5lSV9nUTg==\r\nx-oss-hash-crc64ecma: 15160503604812439007\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D366447B513136B8478B\r\nx-oss-server-time: 12\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7716\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7716,"size_decoded":8459,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"16785df085df4fa69263995257d9d44e","sha1":"e96ffb00ac8ebdd081e2e7c64c3d047c56f5d7ce","sha256":"6eb2685a3d4f3b2eb078f080565eff8447f6166d85e4102dbdfeb27d957cfaec","sha512":"4eb076b9d5306cf4cdc5f61a5f7b25eeb861e86dadffcec92ddcf89f96c01653e5337dd3a2fd04074e2afdd00c73665286d0d32b44b5394a71622bd8e66d8ca3","ssdeep":"192:s/JmuA6knLnaKoH2D+mBnTGW/fJBG0YZ/66dt:s/JWPLnslmBnTG6f3GV","tlshash":"aff19e21473a7de2e6f62ff993bc8977461729410873ae50432ac83a35a87503476f85","first_seen":"2026-10-09T17:45:43.728459Z","last_seen":"2026-10-09T18:33:14.012888Z","times_seen":3,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"accounts.google.com/gsi/client","fqdn":"accounts.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"172.253.148.84","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:44.462Z","timestamp":1791570704462,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"accounts.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:02:28 GMT","end":"Fri, 11 Dec 2026 20:02:27 GMT"},"fingerprint":{"sha1":"41:A1:6F:D0:32:4C:C5:6C:AA:87:D1:27:4B:22:3B:93:31:5B:75:D5","sha256":"29:DE:6F:BB:EA:C2:C6:B0:CC:4B:71:28:06:4A:D0:B3:6F:25:A5:66:DD:55:46:F7:17:75:05:B4:AA:13:24:6B"}}},"request":{"raw":"GET /gsi/client HTTP/1.1\r\nHost: accounts.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\nexpires: Fri, 09 Oct 2026 18:31:44 GMT\r\ndate: Fri, 09 Oct 2026 18:31:44 GMT\r\ncache-control: private, max-age=1800\r\ncontent-security-policy: script-src 'nonce-T1F5tV47c-hT50ubE8bvdg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"coop_dd7de8473bddc59c6b748810a67a39b1\"\r\ncross-origin-resource-policy: cross-origin\r\nreport-to: {\"group\":\"coop_dd7de8473bddc59c6b748810a67a39b1\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1\"}]}\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":275137,"size_decoded":102915,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2663)","md5":"0866f65ee4b7b6345ada47b47955c555","sha1":"c09f6fd344f9d2f088ba86f389ba740134edb0ee","sha256":"0084e0d896335f4b1b5273ce9713a21a318df32fd22f0b4c9dbdb6257c1f1656","sha512":"5837d9e281efe95da0eada1b418fd6fb18c448bf290735ac14ab82ec8783e1ef589dbf137f2000c8f516d759aa5c733b56fbdcea933f9317ad2437ecaca9c6b5","ssdeep":"6144:VDxV7hxy5msIJQhS/0Cr3fwnZqeFMFaCzFBG5BU:VDpssr/0CrPsscMFaCzFBG/U","tlshash":"65444bdcb6e270359222f8b5c43f410ab076a679f4498cacfa94c5f5acb0d890167f79","first_seen":"2026-10-08T09:17:23.759675Z","last_seen":"2026-10-09T20:34:35.234598Z","times_seen":219,"resource_available":true,"data":null}},"time_used":184,"timings":{"blocked":0,"dns":3,"connect":17,"send":0,"wait":133,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"conn.webpush.theengagelab.com/v2/get/webdevices","fqdn":"conn.webpush.theengagelab.com","domain":"theengagelab.com","tld":"com"},"ip":{"addr":"43.134.137.157","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:47.405Z","timestamp":1791570707405,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.webpush.theengagelab.com","organization":""},"issuer":{"commonName":"RapidSSL TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 07 May 2026 00:00:00 GMT","end":"Sat, 21 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"CF:43:D4:33:C6:77:40:E1:A8:79:10:1A:3A:DA:E1:9C:70:B5:1B:EC","sha256":"D1:4F:71:7C:73:4A:0C:A4:15:EF:41:41:B5:F8:DF:41:F4:2C:47:8A:D4:DA:BE:15:E6:37:7A:67:F8:4A:64:AB"}}},"request":{"raw":"POST /v2/get/webdevices HTTP/1.1\r\nHost: conn.webpush.theengagelab.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Length: 48\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nAuthorization: Basic MTgwNjIyMzQ5MTpkYWU2YjBmZWVhM2JiYWJlOTA3ZmRlNmE0YmEzOWJkZjFiZmU2Y2U3OjQ0MzY1MWNlNTkwMjRjOGQ=\r\nConnection: keep-alive\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":78,"data":"Ã\u0005‚ è\u001b'̦] ^Ò\u003e´\u0006V×èŽÿA–…C?ï]½\u0017ßP¦¤ÞÑ\u000b6«\u001dׇò션ùP"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 09 Oct 2026 18:31:47 GMT\r\nContent-Type: application/json\r\nContent-Length: 34\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nVary: Origin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":34,"size_decoded":227,"mime_type":"application/json","magic":"JSON text data","md5":"d7798bb8d9dfd6015910de93615ee1ff","sha1":"669788253397077b49cbad4ecc6d96c42fd3ee29","sha256":"00d5cfca5eab9b79007200579b897fea9bba4ebe1a5b73fff3ca673b1a2ccdd7","sha512":"7821974f0a98f3e7f1bd2bf49a322ed9b9d0bcb529849c91dc815b9f710b5acb7cc9fd299df39848a1a5a885dcaf1bcea0ba214e53c1e7e772e31788fd817c51","ssdeep":"","tlshash":"62800028c2380832020808883880088802cc0aa803c88ba288008c8883eb0820b80828","first_seen":"2026-09-27T12:39:29.449754Z","last_seen":"2026-10-09T18:33:14.023876Z","times_seen":5,"resource_available":true,"data":null}},"time_used":258,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":258,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/hall/api/lobby/lowFrequencyConfig/language/vi.gzip.json","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.898Z","timestamp":1791570702898,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /hall/api/lobby/lowFrequencyConfig/language/vi.gzip.json HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: application/json\r\ncontent-encoding: br\r\ncf-ray: a47f76bd1bdd2efa-OSL\r\ncf-cache-status: HIT\r\ncache-control: s-maxage=600,public,max-age=0\r\netag: W/\"41D1C54C7C93FE45770FAD4CE734C7EE\"\r\npriority: u=3,i=?0\r\nlast-modified: Sun, 04 Oct 2026 13:19:25 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: QdHFTHyT/kV3D61M5zTH7g==\r\nx-oss-hash-crc64ecma: 15199460948480819417\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C5BBAFBCCE3535575A4F\r\nx-oss-server-time: 5\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":1536,"size_decoded":2212,"mime_type":"application/json","magic":"data","md5":"f6edf8b6d81e8dca89ebc3937cb391e9","sha1":"61e896ca0404171c9db0774830d25432ae163ec1","sha256":"20f4bd4f08eb99476519a1db9a9a0238235aa6088ffa639420bb7fe40332d227","sha512":"92d00e9189d2c4feabc7974afc0c0e4c74d04ea3c7e9be0e5aeebda9e472ad48b121028ec1768f4a688f43a0e3e2f0478fcad593b98a02e4810b71c20efea7ad","ssdeep":"","tlshash":"804139cd61b577626b00cbe60089c689710c23dd821e64d1cdc59901d51b87a6efeff2","first_seen":"2026-10-09T17:19:18.828534Z","last_seen":"2026-10-09T18:33:14.026356Z","times_seen":7,"resource_available":true,"data":null}},"time_used":71,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":71,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/0_WithdrawChunk.Bistmez9.css","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.906Z","timestamp":1791570702906,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/0_WithdrawChunk.Bistmez9.css HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: text/css\r\ncontent-encoding: br\r\ncf-ray: a47f76bd2beb2efa-OSL\r\ncf-cache-status: HIT\r\nage: 19193\r\ncache-control: max-age=31622400\r\npriority: u=2,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:01 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: DBpqqw1/tAIt2L7OS9Mk/Q==\r\nx-oss-hash-crc64ecma: 11089374518252015211\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8E815A846BB31332173B4\r\nx-oss-server-time: 17\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":52230,"size_decoded":9059,"mime_type":"text/css","magic":"ASCII text, with very long lines (52229)","md5":"0c1a6aab0d7fb4022dd8bece4bd324fd","sha1":"6baab7a7d121d64c7fa90ed62ec32997eda1b15c","sha256":"b017d66bbc076852c7bd603f76ba6451acd85ad5781bd24e160364011796b907","sha512":"acee4280215a103e27606071d6c6573da151a28563ed518e41c1e7a8b9998dec4076caa6e710ffa23580b0f461f223a7faba0957740fa59096597e19aa4a5683","ssdeep":"1536:BtaEc2LjSvnYxpaF+wP7vSHuxqM2RQWDxla6h:2S+qM2RQWDxla6h","tlshash":"1033b54d8521b17b987fd136b9e2e7f831587668c623828dfaa38d1d4bcb3d63814319","first_seen":"2026-10-07T10:12:18.21691Z","last_seen":"2026-10-09T18:33:14.027421Z","times_seen":10,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/200/3/2000106/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.772Z","timestamp":1791570703772,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/200/3/2000106/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76c289902efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"A82B7107810E544BB4BFB58F0786A4CE\"\r\nlast-modified: Sun, 27 Sep 2026 04:46:23 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: qCtxB4EOVEu0v7WPB4akzg==\r\nx-oss-hash-crc64ecma: 10963688386425969096\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D366945394383060BD99\r\nx-oss-server-time: 19\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19580\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":19580,"size_decoded":20324,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a82b7107810e544bb4bfb58f0786a4ce","sha1":"edf0861b00a325e5f294c0671a3c1f3e3b9bb673","sha256":"a1821af411a4ee0556a27ae43619e2d5319b4d474d8fdb8a0c985c95bae0929c","sha512":"b673349265bd923378182ffbd190c38583b89e1865c57f965647e643dedf1e70eea779c23c777dd7211dbbbf2c8eb0a26b37284978ef425bd5b5bb7fa89e0a58","ssdeep":"384:6dAqfNVKpVSanLu/dUV79R0koAktFPL3PPAFTnfUoulZID3+w:6jFaLAip09A2PLn0TzB35","tlshash":"7492cf44bffdf1997025fc720f8e65dda0f248384d31ce067566aca63998ca39a3116a","first_seen":"2026-10-09T17:45:43.483506Z","last_seen":"2026-10-09T18:33:13.935994Z","times_seen":3,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ytbacksexo.xyz/hall/api/gohal/bffApi","fqdn":"ytbacksexo.xyz","domain":"ytbacksexo.xyz","tld":"xyz"},"ip":{"addr":"8.233.17.31","port":443,"asn":3356,"as":"LEVEL3","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.895Z","timestamp":1791570702895,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ytbacksexo.xyz","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Tue, 29 Sep 2026 13:10:22 GMT","end":"Mon, 28 Dec 2026 14:06:17 GMT"},"fingerprint":{"sha1":"04:0A:47:19:B0:39:99:10:59:DF:86:B3:5D:7C:0A:9C:BD:E2:E6:E6","sha256":"31:E0:07:6A:95:AF:27:B6:02:96:5F:18:19:44:AA:81:D9:DF:02:17:C7:1E:25:ED:01:84:C0:20:BB:82:4E:FB"}}},"request":{"raw":"OPTIONS /hall/api/gohal/bffApi HTTP/1.1\r\nHost: ytbacksexo.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: appsystem,appversion,browserfingerid,browsertype,clienttimezone,currency,device,devicebrand,devicemodel,domain,language,operatingsystem,physicaldevicemodel,platformtype,sitecode,timestamp,token,webauthndomain,x-custom-referer,x-data-mode,x-device,x-object-id,x-request-id,x-version\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 0\r\nset-cookie: acw_tc=0a0f6c3817915707034014908e5226d779b7f7e7f4adc6d77cd276bd1863a2;path=/;HttpOnly;Max-Age=1800\r\nx-saas-server-id: 8576b68756-6trlb|1a281003b2a450a9a3b115bf2bf235bd\r\naccess-control-allow-methods: *\r\naccess-control-max-age: 1728000\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: appsystem,appversion,browserfingerid,browsertype,clienttimezone,currency,device,devicebrand,devicemodel,domain,language,operatingsystem,physicaldevicemodel,platformtype,sitecode,timestamp,token,webauthndomain,x-custom-referer,x-data-mode,x-device,x-object-id,x-request-id,x-version\r\naccess-control-expose-headers: X-Trace-ID, newjwt, token\r\nvia: 1.1 google\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"acw_tc","value":"0a0f6c3817915707034014908e5226d779b7f7e7f4adc6d77cd276bd1863a2","quoted":false,"path":"/","max_age":1800,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"acw_tc=0a0f6c3817915707034014908e5226d779b7f7e7f4adc6d77cd276bd1863a2;path=/;HttpOnly;Max-Age=1800"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":915,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-09T20:29:43.461907Z","times_seen":18980891,"resource_available":true,"data":null}},"time_used":688,"timings":{"blocked":-1,"dns":110,"connect":12,"send":0,"wait":532,"receive":0,"ssl":33},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ytbacksexo.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/200/3/2000074/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.656Z","timestamp":1791570703656,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/200/3/2000074/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c1d8aa2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"770C693F938E334B45F45D75E0FBEADB\"\r\nlast-modified: Sun, 27 Sep 2026 04:19:50 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: dwxpP5OOM0tF9F114Pvq2w==\r\nx-oss-hash-crc64ecma: 15920645692694705135\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D36675EC4632349E6628\r\nx-oss-server-time: 39\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 22662\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":22662,"size_decoded":23406,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"770c693f938e334b45f45d75e0fbeadb","sha1":"d58b9380d96375eeab14a97364b63fa6d3af8d19","sha256":"a0a1a5b043250f7a039b65758dda0e7935ce6f03653e19ab6b8d9d39bfbd0c0a","sha512":"0ba72181451f3d64661192cacc46cda37826c49936507c81396b16c6a6ab739d556ac32f812548a03b73913c37a28ffe1c6ce09723c2602201f7a1f5208082a8","ssdeep":"384:dHh4LGPPIPvtm1FP06rVTdbVHPgJ61s3MSeLFhxshjsnCTPOkNjB/X9SYp3q9c:FCkPGF/6rXBows3xeLKxTPfF/sYp3J","tlshash":"5da2e09a80705369fc9fc094a7bc30c05203ecda6ba96f6d6e46b586cd6c123c79b854","first_seen":"2026-10-09T17:45:43.837386Z","last_seen":"2026-10-09T18:33:14.007087Z","times_seen":4,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/200/3/2000065/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.753Z","timestamp":1791570703753,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/200/3/2000065/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76c269412efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"3E928343D231D93A3E474C616B4FB762\"\r\nlast-modified: Sun, 27 Sep 2026 04:19:41 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: PpKDQ9Ix2To+R0xha0+3Yg==\r\nx-oss-hash-crc64ecma: 13228649966953716286\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D36658FFB5363860652E\r\nx-oss-server-time: 17\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12236\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":12236,"size_decoded":12980,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"3e928343d231d93a3e474c616b4fb762","sha1":"8a5d190b349c9d644258e4d2d8cc86f486ba4dee","sha256":"0343dcc62819c56937a0fdbaf157e24b37e1c342eaf71ab81d01a53f49c6c597","sha512":"d9666eb9b76d040662a5f9e058434a1c8cf36f8479384af90f3d1782bd3434cb0d49a7c37bc28338c732ae353eb56f104820e09e94d492f4c5b13904fc8bdd0f","ssdeep":"192:+A69xkWNMagstwfubM9dGiUPwSdHdLQl/QRxNdilvcbfSu1FbpR3JeYpUH6:+RmOMEFAdMPwSdt53dX39Vpi6","tlshash":"f342cf3dcf21429294b4da07604f355866ed0f6a1f6768886be6462bfc8c76a9b68301","first_seen":"2026-10-09T17:45:43.661028Z","last_seen":"2026-10-09T18:33:13.939843Z","times_seen":4,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/200/3/2001023/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.768Z","timestamp":1791570703768,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/200/3/2001023/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76c2898a2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"38399006868560B0BF4BCC09290B3F2F\"\r\nlast-modified: Sun, 27 Sep 2026 04:27:26 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: ODmQBoaFYLC/S8wJKQs/Lw==\r\nx-oss-hash-crc64ecma: 5821601217375407223\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D36675EC463134656628\r\nx-oss-server-time: 74\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 9584\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9584,"size_decoded":10326,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"38399006868560b0bf4bcc09290b3f2f","sha1":"8231bd07bd909f9089c4d64603bbfe832352894f","sha256":"3c588061b6d51d3762dbee424133239d9edd330be7fa407d6b252a78b77ac02a","sha512":"091aadccccaddb0f8cf6633dd3884b92bbcdc1facb0b8343860df3cdee11bb6b3496969595a09a58460b1529521cb7ccca65ed264da812c7d787a227149a3773","ssdeep":"192:It9NXwkgxCDmZPnz4KzW41rrlFXKy09C3UBU:wNAkAPz/W41rrl0QUS","tlshash":"9512ae4a6f9c2053fc15f287ada65f293e85b9409274293069c16ebca27690cf9620ed","first_seen":"2026-10-09T17:45:43.646793Z","last_seen":"2026-10-09T18:33:13.753931Z","times_seen":4,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/index.BcVweGMN.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.431Z","timestamp":1791570703431,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/index.BcVweGMN.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/GlobalEventListenerIndex.BYsJMIjY.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76c06ef12efa-OSL\r\ncf-cache-status: HIT\r\nage: 24672\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: 7C4dq8dGzD7jny3bKJ38Cw==\r\nx-oss-hash-crc64ecma: 6448461240369323799\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D2AEA87B9A35397EB242\r\nx-oss-server-time: 15\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1496,"size_decoded":1493,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (1495)","md5":"ec2e1dabc746cc3ee39f2ddb289dfc0b","sha1":"7ecf33a7fedd70faacd7e63f289acb9d01f2724e","sha256":"23be3b503a4d3010137a881bfd9552e8426ef193a6accb5a2aac4b611a5a5bb2","sha512":"7f801f9f3e69ea937667dd4c33b01596b2a59a33df02ecdfdbb65bb64298fc77be3dd168a8c6d59d98bcbd8f789a775e7f32a4e1b51efeb4a7c6fac010f6f73d","ssdeep":"","tlshash":"4631feaa709930b635277fb4d09a83a6014566d73564d4f07e8b2f6b020fa41d88df1f","first_seen":"2026-10-09T17:19:18.745972Z","last_seen":"2026-10-09T18:33:14.029034Z","times_seen":7,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/vendors/vendor-swiper.BqvbXe0X.css","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.907Z","timestamp":1791570702907,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/vendors/vendor-swiper.BqvbXe0X.css HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: text/css\r\ncontent-encoding: br\r\ncf-ray: a47f76bd2bec2efa-OSL\r\ncf-cache-status: HIT\r\nage: 27344\r\ncache-control: max-age=31622400\r\npriority: u=2,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:01 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: NlnUeOUhxxJl++SQc/XUXw==\r\nx-oss-hash-crc64ecma: 14412162234219682191\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C83E0A930635389E9451\r\nx-oss-server-time: 4\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":26862,"size_decoded":5678,"mime_type":"text/css","magic":"ASCII text, with very long lines (26861)","md5":"3659d478e521c71265fbe49073f5d45f","sha1":"4be44fee1e5fda26c117c6df687ec9afbd0efe40","sha256":"f437d74f169eea5e469159a27cad6ead818d38871de68adb75f93424dd9092db","sha512":"6abc759057477909108a9b36cfdf1766c05ce62e782e6c911c455dc227cb90eb3dd26101a38331fb87e4bdff82dea49ea8bae36802c93ec422161752635923b5","ssdeep":"384:bUbeqpEdUbeqUbehJZdKW+S1HB1Hr3zjfy35mSmZoTm84FiTU:IbSibGb8JZLDxB5zjQ5mSm84V","tlshash":"79c254b85350182757270f375a718bb8ddb444c30a978a6aa1c0ee44d7facbd132f6b9","first_seen":"2026-05-27T04:37:17.491557Z","last_seen":"2026-10-09T19:17:20.749458Z","times_seen":1362,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/0_WithdrawChunk.CVJE5O4x.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.403Z","timestamp":1791570703403,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/0_WithdrawChunk.CVJE5O4x.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/AsyncAsideIndex.DJTJPSZz.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76c03ecb2efa-OSL\r\ncf-cache-status: HIT\r\nage: 27343\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: JyIBDDabiBV1pFM178ZEsA==\r\nx-oss-hash-crc64ecma: 5888360231012776917\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C83F669A4C3532F46C49\r\nx-oss-server-time: 1\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":128596,"size_decoded":40641,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64138)","md5":"2722010c369b881575a45335efc644b0","sha1":"db2a0f2865bc9fe5d0611d906c5e50e33616b96b","sha256":"cea3647cb22f98ece5e50929582b8d85d0e38236d1cc48d52908f3a835bad653","sha512":"d7df869acdd2c3d4fc8cbd96c0525868b1d9d943659d124cb31a7df2c9890aa78b336395ff70ef12baee65c3c435147d819e32b6b2d636f3f81f2e8a972f2e3c","ssdeep":"3072:lVNpOAJzR5NywPlm9GZ13ZRXxCADzFQO4Yj0aXf:lVNpOAJzR7VA92QVu","tlshash":"14c30bc97167a0f47af87d98b4b20696721c3fd9a004c0f7b1ff4e21278aa91f994725","first_seen":"2026-10-09T17:19:19.056575Z","last_seen":"2026-10-09T18:33:14.033129Z","times_seen":7,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_AgentCenterChunk.B9OajlP_.css","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.909Z","timestamp":1791570702909,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/1_AgentCenterChunk.B9OajlP_.css HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: text/css\r\ncontent-encoding: br\r\ncf-ray: a47f76bd2bed2efa-OSL\r\ncf-cache-status: HIT\r\nage: 27344\r\ncache-control: max-age=31622400\r\npriority: u=2,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:01 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: OpESELdrRZ72XlFCk7tIgw==\r\nx-oss-hash-crc64ecma: 14440610561771414812\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C83E637FD23331DCAA01\r\nx-oss-server-time: 4\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":137590,"size_decoded":21185,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"3a911210b76b459ef65e514293bb4883","sha1":"d2b5b78d95428a71382d7ec973ec25bb42939994","sha256":"d88a68f148c9a7412e33de9006a33b077b4eb138a37f99e950fb531f8885725c","sha512":"eaebefbf256db20200efb7672e7fbd1549a55f653947e51b17b4d2d03ae1d929cc54a02805dc46aeb148d31094055807db2ef3db0e99caf8ee4032a59174d561","ssdeep":"3072:VsMA8WEqgEy9wEAkbkXPj/o8V9T5EdDVDPLNtQV:VsMAisEAkbkXPj/o8V9T5EdDVDPLNtQV","tlshash":"3cd3999a5b30723bac2fd533fde1fbd84194b150c51216e6ea739d2d87ca7b62870206","first_seen":"2026-10-07T10:12:18.211255Z","last_seen":"2026-10-09T18:33:14.035961Z","times_seen":9,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ytbacksexo.xyz/hall/api/gohal/getClientConfig?siteCode=3792\u0026token=b2e3d672-9d88-47a7-81b4-9d7ffc62054f\u0026currency=VND\u0026language=vi\u0026platformType=5\u0026osType=4","fqdn":"ytbacksexo.xyz","domain":"ytbacksexo.xyz","tld":"xyz"},"ip":{"addr":"8.233.17.31","port":443,"asn":3356,"as":"LEVEL3","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.920Z","timestamp":1791570702920,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ytbacksexo.xyz","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Tue, 29 Sep 2026 13:10:22 GMT","end":"Mon, 28 Dec 2026 14:06:17 GMT"},"fingerprint":{"sha1":"04:0A:47:19:B0:39:99:10:59:DF:86:B3:5D:7C:0A:9C:BD:E2:E6:E6","sha256":"31:E0:07:6A:95:AF:27:B6:02:96:5F:18:19:44:AA:81:D9:DF:02:17:C7:1E:25:ED:01:84:C0:20:BB:82:4E:FB"}}},"request":{"raw":"GET /hall/api/gohal/getClientConfig?siteCode=3792\u0026token=b2e3d672-9d88-47a7-81b4-9d7ffc62054f\u0026currency=VND\u0026language=vi\u0026platformType=5\u0026osType=4 HTTP/1.1\r\nHost: ytbacksexo.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: vi\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nx-object-id: {\"uid\":\"\",\"browserLanguage\":\"en-US\",\"init\":{\"device\":\"\",\"created\":1791570702472,\"version\":1791251963000}}\r\nplatformType: 5\r\nx-device: 1-5\r\nx-data-mode: plain\r\nx-request-id: 06e70119-51f5-43f3-9a7f-a5889ca025b0\r\ndevice: 8034c51c-91ec-430d-af2a-41881722443b\r\ncurrency: VND\r\ntimestamp: 1791570702\r\nsiteCode: 3792\r\nlanguage: vi\r\ntoken: b2e3d672-9d88-47a7-81b4-9d7ffc62054f\r\ndeviceModel: Firefox v134.0\r\nphysicalDeviceModel: unknown\r\noperatingSystem: Windows\r\ndeviceBrand: unknown\r\nbrowserType: Firefox v134.0\r\nappSystem: Windows 10\r\ndomain: ad852.xyz\r\nwebauthnDomain: ad852.xyz\r\nclienttimezone: 0\r\nx-custom-referer: https://ad852.xyz/\r\nx-version: 7.5.141\r\nappVersion: v7.5.141\r\nbrowserfingerid: \r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 09 Oct 2026 18:31:44 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 201\r\nset-cookie: acw_tc=0a0f6bd317915707041728814e3a0396841f3e97b208e4bd0ae5a825c76ac0;path=/;HttpOnly;Max-Age=1800\nUserKey=zh7P7BAcyZmNmOP4oJ2MTYTE4FMBf_Aq4KEAb3MfWXzGbAwy6cVy-3QfP2NEk1by; Path=/; Expires=Sat, 09 Oct 2027 18:31:44 GMT; Max-Age=31535999; HttpOnly\r\nx-trace-id: 7a722688b1ad1934\r\nx-env-go-biz-gohal-server: 0\r\ncache-control: no-cache\r\nx-saas-server-id: 8576b68756-n5whk|44f90d47de48acc2baae12b2632a0dba\r\naccess-control-allow-methods: *\r\naccess-control-max-age: 1728000\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Trace-ID, newjwt, token\r\nvia: 1.1 google\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"acw_tc","value":"0a0f6bd317915707041728814e3a0396841f3e97b208e4bd0ae5a825c76ac0","quoted":false,"path":"/","max_age":1800,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"acw_tc=0a0f6bd317915707041728814e3a0396841f3e97b208e4bd0ae5a825c76ac0;path=/;HttpOnly;Max-Age=1800"},{"name":"UserKey","value":"zh7P7BAcyZmNmOP4oJ2MTYTE4FMBf_Aq4KEAb3MfWXzGbAwy6cVy-3QfP2NEk1by","quoted":false,"path":"/","expires":"2027-10-09T18:31:44Z","raw_expires":"Sat, 09 Oct 2027 18:31:44 GMT","max_age":31535999,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"UserKey=zh7P7BAcyZmNmOP4oJ2MTYTE4FMBf_Aq4KEAb3MfWXzGbAwy6cVy-3QfP2NEk1by; Path=/; Expires=Sat, 09 Oct 2027 18:31:44 GMT; Max-Age=31535999; HttpOnly"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":201,"size_decoded":1045,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"66c0568912678df4b5421e02b9625552","sha1":"e37bfaa5391b1095a1adb5ceeb57b6b0dd3da7c4","sha256":"d9de183529796c86d709afcc425f7e3ead02faffab666ad43b209d1899856e35","sha512":"5e69ff05b2addb0551bd914696fdd273f826fd544ba068966c1a2a0ef0a933ad821349e1a5cc5bbbb7a490ac9be4d7c264f7643681da52b97d165ef49cb4949d","ssdeep":"","tlshash":"0dd022a0662283839d88d6ad304631e83f285d01c80ea7fc8b8cc02a01d899c224ab61","first_seen":"2026-10-09T18:33:14.037494Z","last_seen":"2026-10-09T18:33:14.037494Z","times_seen":1,"resource_available":true,"data":null}},"time_used":627,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":627,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ytbacksexo.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-1/common/home/btn_dtfl_yxcd1_s2.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.078Z","timestamp":1791570703078,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-1/common/home/btn_dtfl_yxcd1_s2.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76be3cce2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24490\r\ncache-control: max-age=604800,public\r\netag: \"6D1C76D97F71E8AC310A555E95D6DAD4\"\r\nlast-modified: Fri, 25 Sep 2026 04:47:12 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: bRx22X9x6KwxClVeldba1A==\r\nx-oss-hash-crc64ecma: 10628254694611901769\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D364A87B9A3931F8F04B\r\nx-oss-server-time: 19\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1340\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":1340,"size_decoded":2011,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6d1c76d97f71e8ac310a555e95d6dad4","sha1":"31404f1caa393b39c29dfdd23b0fc13420ddcd01","sha256":"d7f296859ad8d8891813e14daad412b6050fd746210b194755fc7c838bf2327e","sha512":"7196eb9b6f096f601cc792ab0f69a6a071ee89813b7aee814790e75d9f57531bcc590094c6145ec6ded44fa003422a7585468dbc1223a65224c465291b1e128e","ssdeep":"","tlshash":"5621089c5b9f2f31cbe791ad00342a81c3666d80b5f8855a3deb7af0a05d235d700002","first_seen":"2026-10-09T17:45:43.795873Z","last_seen":"2026-10-09T18:33:14.041939Z","times_seen":4,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/200/3/2000104/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.659Z","timestamp":1791570703659,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/200/3/2000104/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c1d8ad2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"D3ED16D06A966F733F61F9666E20B746\"\r\nlast-modified: Sun, 27 Sep 2026 05:03:47 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: 0+0W0GqWb3M/YflmbiC3Rg==\r\nx-oss-hash-crc64ecma: 335429606943808683\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D366A87B9A3931B1084C\r\nx-oss-server-time: 19\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 22168\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":22168,"size_decoded":22910,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d3ed16d06a966f733f61f9666e20b746","sha1":"089a4169a36f689d829bb5be6bb6d68871bf1dc6","sha256":"c110bb4c4b933b3c0fc103277b361bb6ac7b4cb4ca021a6063cefe3fb7b882be","sha512":"7eb028393360191c0347993e157b83578c49e805d8d46d5c20560172653686e369d62070bf90d64bc6e1a8dea55ad41c94624f05491ba7b0cc8916bb7e248316","ssdeep":"384:79HRMNSzmy9PkUdD9acyXBTzafRcn0rxY6OPfewTfPdnWpBCv4kefNp8:7hdLP39SBTmJdxYPTHdCIvWc","tlshash":"19a2d03538f1803117bd4261b6c3ef8b7b2e8a065c9ce2a5f9fcd69584a771cc276485","first_seen":"2026-10-09T17:45:43.548774Z","last_seen":"2026-10-09T18:33:13.964554Z","times_seen":4,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/p/3792/L1/SQ/hot/1012/4/custom_VND.webp?p=1791191450","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.744Z","timestamp":1791570703744,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/p/3792/L1/SQ/hot/1012/4/custom_VND.webp?p=1791191450 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76c269352efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"79B7085155F0412933865FD6219FC779\"\r\nlast-modified: Sun, 27 Sep 2026 04:16:24 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: ebcIUVXwQSkzhl/WIZ/HeQ==\r\nx-oss-hash-crc64ecma: 11273582355045058010\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D366AFBCCE3535EA2A07\r\nx-oss-server-time: 20\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 23648\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23648,"size_decoded":24392,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"79b7085155f0412933865fd6219fc779","sha1":"b34d2f4ccda07b53615c5e9eca2221e0eca77322","sha256":"2bd47924b066d05cc808c4722ef7378ca0bb5b410fc9647f18e639062e26dfb0","sha512":"f1ed3c99614bd28e36fc69bcf7f6e7a03baaf5dd8733310f32f8af1a5abd1e45c6bc903482e3e0c89f79d2c650b624a47de38c01b7d52e5d7ee8addd2f039c96","ssdeep":"384:jKRbykjvCQsZHrSWJoaVKFNud0tiZ+JFEl60zJRDzDOY5DJTR2Dujb7Qi2imC7KC:jKRbBj6QoWAXVKDudFZQFEl6KJBnR2Dk","tlshash":"6fb2e13442568f9bbfd10c1a15bcd71b0e64a1c4515cf5a91a42fdf042fb324598ad7f","first_seen":"2026-10-09T17:45:43.392057Z","last_seen":"2026-10-09T18:33:13.975716Z","times_seen":4,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/commonChunk.DhTRCrz5.css","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.108Z","timestamp":1791570702108,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/commonChunk.DhTRCrz5.css HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: text/css\r\ncontent-encoding: br\r\ncf-ray: a47f76b8285d2efa-OSL\r\ncf-cache-status: HIT\r\nage: 25005\r\ncache-control: max-age=31622400\r\npriority: u=0,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:01 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: z6g4/74H4/Ycyypg17gA3Q==\r\nx-oss-hash-crc64ecma: 14807124115928057897\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D16034AB6E3137BB1A28\r\nx-oss-server-time: 18\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":180988,"size_decoded":30705,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"cfa838ffbe07e3f61ccb2a60d7b800dd","sha1":"c587c83c018c40b23d86295198c89778835abb94","sha256":"cc3828139041a75e6930e73655dbfdad23189fc0aa797827b296a044a5dce6a6","sha512":"52cd56998f4262dfe6c5b43cc693be0982b1d769fbb8faf036293df70400639e311f624b8b88518d3b67a3327b25599c351bd8ec42536d11b0b4b34740ed3a1f","ssdeep":"1536:RWqAn+2dJr8CPUWvFxIEXiuxB/sm/YuDV1Q4HG21E6ObfnAeXqIJnZU83csHfzNu:RW2Fjw04SIXp03wfh3r8pqh","tlshash":"b60419b99d30743de6376232aadaa7fc6139f000d5035499f613ae1a47c6bb11a3173b","first_seen":"2026-10-09T17:19:18.882593Z","last_seen":"2026-10-09T18:33:14.043105Z","times_seen":7,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/hall/api/backstage/system/guestHome/currency/VND/language/vi.gzip.json","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.897Z","timestamp":1791570702897,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /hall/api/backstage/system/guestHome/currency/VND/language/vi.gzip.json HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: application/json\r\ncontent-encoding: br\r\ncf-ray: a47f76bd1bd92efa-OSL\r\ncf-cache-status: HIT\r\ncache-control: s-maxage=600,max-age=0,public\r\netag: W/\"2857B87A55DCBF5F3ECBA60641F20629\"\r\npriority: u=3,i=?0\r\nlast-modified: Fri, 09 Oct 2026 18:04:56 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: KFe4elXcv18+y6YGQfIGKQ==\r\nx-oss-hash-crc64ecma: 16414233283200891128\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC92D9C7859E43034C40838\r\nx-oss-server-time: 1\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4688,"size_decoded":5364,"mime_type":"application/json","magic":"data","md5":"f7bf52b76e955be1fc5dd5bc69ad95d0","sha1":"da79827a0ae878cfeb321f3521d5efc7b2050d9b","sha256":"18f7c6a9b0b3507cac19f775e11928e08937ec46ed4e52f5022e1f575909da86","sha512":"241432ac8ea1b73ac0ee2519e0e0a5af2f23adf7dd8d052af2bf2e65abb7dce713a069041778de34e84c355483c309e78798ad71a922429625b630f3b4f6d447","ssdeep":"192:CfIvk+9d025D2eYfIAe7utJZ8dWPvucO1Yxm2F:QIs+n025D2lptb6W+cOw","tlshash":"e3e17d009280e364c49f99e6486d1bd0a223ca9edd246eedc118d0fa5e35f66176cf33","first_seen":"2026-10-09T18:12:43.482565Z","last_seen":"2026-10-09T18:33:14.044105Z","times_seen":2,"resource_available":true,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":79,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-1/common/_sprite/icon_btm_kf.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.107Z","timestamp":1791570703107,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-1/common/_sprite/icon_btm_kf.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76be6d092efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 23458\r\ncache-control: max-age=604800,public\r\netag: \"A8AF6B6B74A3A00236B2A9CB554C4F38\"\r\nlast-modified: Fri, 25 Sep 2026 04:47:12 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: qK9ra3SjoAI2sqnLVUxPOA==\r\nx-oss-hash-crc64ecma: 3908372635146041398\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D76C447B51313156D5BF\r\nx-oss-server-time: 16\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 938\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":938,"size_decoded":1607,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a8af6b6b74a3a00236b2a9cb554c4f38","sha1":"e8a910c2cf77c13b78a82df2afdb34160d556cd7","sha256":"cc38dd03d44f6e1c743927de9170d64368da32b1f329eebbfe9b6cc25694cfc4","sha512":"21df349bfc6dc7369c2b1b2fbc2dc18597224af29c1ab8e9c7a81a154ecaf9db4ca38d48e611b327e82e0b67660272b8344d48249a6b05c5a3e0e0293b1b81a3","ssdeep":"","tlshash":"a71184496cb871698f1c4a56ce9dd0d338e5012d6331ba55b233fc61c1eaa23486e6c0","first_seen":"2026-10-09T17:45:43.790691Z","last_seen":"2026-10-09T18:33:14.045298Z","times_seen":4,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_ClubRebateChunk.BoVNrNqr.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.412Z","timestamp":1791570703412,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/1_ClubRebateChunk.BoVNrNqr.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/AsyncAsideIndex.DJTJPSZz.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76c04ee32efa-OSL\r\ncf-cache-status: HIT\r\nage: 27342\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: ja7Do8Cbk2ndr0IkzOWN/w==\r\nx-oss-hash-crc64ecma: 14219546942950148659\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C84136D39F38333360E0\r\nx-oss-server-time: 4\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":58592,"size_decoded":17312,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (58590)","md5":"8daec3a3c09b9369ddaf4224cce58dff","sha1":"ff17730d4c1a2361ea8bd2c4197d446cc4f9b043","sha256":"718ec9caa270512cdebec013cbe88ded64f5604e6ba0105dab636a4e91c470e4","sha512":"771524ab53a442dda9d75e448a12f94a6f30475763408158c08bf94218f6adcb29d7b4920b923fd0652f43ef20f75ac83da9d64f646bf5a38f3494bab949b5a9","ssdeep":"1536:Vyj8aPVyWtduxMfuz1uywA5sw04d0rXpcuQAtLckR:Vyoaq1w4dAXyuNtckR","tlshash":"6c43e8cd747ae5b9fa799da8a0784d50611d1b4e400550f9a0fe8e213748ff8b26cb3e","first_seen":"2026-10-09T17:19:18.950734Z","last_seen":"2026-10-09T18:33:14.04626Z","times_seen":6,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"conn.webpush.theengagelab.com/v2/get/webdevices","fqdn":"conn.webpush.theengagelab.com","domain":"theengagelab.com","tld":"com"},"ip":{"addr":"43.134.137.157","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:47.407Z","timestamp":1791570707407,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.webpush.theengagelab.com","organization":""},"issuer":{"commonName":"RapidSSL TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 07 May 2026 00:00:00 GMT","end":"Sat, 21 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"CF:43:D4:33:C6:77:40:E1:A8:79:10:1A:3A:DA:E1:9C:70:B5:1B:EC","sha256":"D1:4F:71:7C:73:4A:0C:A4:15:EF:41:41:B5:F8:DF:41:F4:2C:47:8A:D4:DA:BE:15:E6:37:7A:67:F8:4A:64:AB"}}},"request":{"raw":"OPTIONS /v2/get/webdevices HTTP/1.1\r\nHost: conn.webpush.theengagelab.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 204 No Content\r\nServer: nginx\r\nDate: Fri, 09 Oct 2026 18:31:47 GMT\r\nConnection: keep-alive\r\nAccess-Control-Allow-Headers: authorization\r\nAccess-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE\r\nAccess-Control-Allow-Origin: *\r\nVary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":319,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-09T20:29:43.461907Z","times_seen":18980891,"resource_available":true,"data":null}},"time_used":249,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":249,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/game_pictures/g/3792/SQ/200/3/2000135/custom_VND.webp?g=1790486854","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.749Z","timestamp":1791570703749,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /game_pictures/g/3792/SQ/200/3/2000135/custom_VND.webp?g=1790486854 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76c2693e2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: public,s-maxage=86400,max-age=2592000,stale-while-revalidate=86400,immutable,proxy-revalidate\r\netag: \"23FED4D974629CB2F8639DE50EC7DF24\"\r\nlast-modified: Sun, 27 Sep 2026 04:52:54 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: I/7U2XRinLL4Y53lDsffJA==\r\nx-oss-hash-crc64ecma: 16663364862856337027\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D366A87B9A393116094C\r\nx-oss-server-time: 17\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 17174\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17174,"size_decoded":17918,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"23fed4d974629cb2f8639de50ec7df24","sha1":"a6fde4e84cf591dfb8e239e8e35c86d3373bb61a","sha256":"799ee4323bd31557f9a5c062b488dd0a38bb287242d4f1050f5cf799a0f4ae41","sha512":"efefe51880fef49b876e713ef4d26f33c43f0a018d8ae2b05176f891c72f4fa1e881fcd7596614e06ebb031adbab08cab8d0a00a6fb8e643eb965db908f9c4b8","ssdeep":"384:oa2rmqjTny9SxC438cIpOdewU/tX84xMrHFiHFIyPL:o/LyG84H4xMoywL","tlshash":"2772df9d92a19e17255b2f5ca406c26ee9083829fe8a628f1457e00a598b059567ea30","first_seen":"2026-10-09T17:45:43.827782Z","last_seen":"2026-10-09T18:33:13.988684Z","times_seen":4,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/hall/api/lobby/highFrequencyConfig/currency/VND.gzip.json","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.900Z","timestamp":1791570702900,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /hall/api/lobby/highFrequencyConfig/currency/VND.gzip.json HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/json\r\ncontent-encoding: br\r\ncf-ray: a47f76bd1bdf2efa-OSL\r\ncf-cache-status: EXPIRED\r\ncache-control: s-maxage=300,public,max-age=0\r\npriority: u=3,i=?0\r\nlast-modified: Fri, 09 Oct 2026 18:30:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: lLVfMl78f654JYGt9w5brw==\r\nx-oss-hash-crc64ecma: 14554376632938079063\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC9330F108AF538386024E2\r\nx-oss-server-time: 2\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18800,"size_decoded":19451,"mime_type":"application/json","magic":"data","md5":"00b38426118ef291168e81fa54e16064","sha1":"3a0173104b036fd0a4a6f8494bf7640a6790bb0e","sha256":"ca36ab7e78b180102b8b1ac66790f9601621bf0da38806ddaf2d27f1ba9a2f2a","sha512":"60389a6a13771103a44f109e9e51be35850e5c64e7f98c695f1e4ac5dd69ab8b07395657410765eb4f91e30be4806dca4cb4839faecbbd3b677e31a41a609bc6","ssdeep":"768:qVmpgGtU4ykBj6l+DPYQ/ap//1tWr9Zu9RShEuy:AGlyNRQ/apFty9xh9y","tlshash":"14c2d013a752f392c2a69dffd82149cc43241398b7916db4e96c8d725a8211f77ef8c0","first_seen":"2026-10-09T18:33:14.047335Z","last_seen":"2026-10-09T18:33:14.047335Z","times_seen":1,"resource_available":true,"data":null}},"time_used":311,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":303,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_ClubRebateChunk.z3YfvvYT.css","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.910Z","timestamp":1791570702910,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/1_ClubRebateChunk.z3YfvvYT.css HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: text/css\r\ncontent-encoding: br\r\ncf-ray: a47f76bd2bee2efa-OSL\r\ncf-cache-status: HIT\r\nage: 27343\r\ncache-control: max-age=31622400\r\npriority: u=2,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:01 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: QdayRFPy8S401H62Y9QZ0A==\r\nx-oss-hash-crc64ecma: 12190806852095081587\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C83EE702E230357FF842\r\nx-oss-server-time: 4\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":32551,"size_decoded":6274,"mime_type":"text/css","magic":"ASCII text, with very long lines (32550)","md5":"41d6b24453f2f12e34d47eb663d419d0","sha1":"e2eb5e0291db468fc306812bf00b180a4fbeb3c2","sha256":"98bff2866fb7d5e3fcf649d0318df0732271d2c2a91903fecbbc86039507aa57","sha512":"a11edc160d138df2f63607369272db3f1606cf599862ceae4bdffe02d3febedeebde13651853b5da7c5a937b1d36ed09853ff6b6eef7aef98f6df3f0279130d3","ssdeep":"384:NCWWvHFtlRDPiQ1qYoqNQTfz0DvN+K5Hd1ZdUsKd6k+cGvwMD40578PZ:N8vlYQ1qYolwrN1BZeMbvvD405i","tlshash":"8fe28729ab307239682bd4225dd1fbc8d114e250c61b12daf927dd3d0bc6bb32e7156e","first_seen":"2026-10-07T11:29:32.58569Z","last_seen":"2026-10-09T18:33:14.048711Z","times_seen":6,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"conn.webpush.theengagelab.com/v1/auth?user_str=a5496675-d7ba-410c-88be-475c79dbc669\u0026appkey=9ec737c30e02452cba9b30ce\u0026is_temporary=n","fqdn":"conn.webpush.theengagelab.com","domain":"theengagelab.com","tld":"com"},"ip":{"addr":"43.134.137.157","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:45.012Z","timestamp":1791570705012,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.webpush.theengagelab.com","organization":""},"issuer":{"commonName":"RapidSSL TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 07 May 2026 00:00:00 GMT","end":"Sat, 21 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"CF:43:D4:33:C6:77:40:E1:A8:79:10:1A:3A:DA:E1:9C:70:B5:1B:EC","sha256":"D1:4F:71:7C:73:4A:0C:A4:15:EF:41:41:B5:F8:DF:41:F4:2C:47:8A:D4:DA:BE:15:E6:37:7A:67:F8:4A:64:AB"}}},"request":{"raw":"GET /v1/auth?user_str=a5496675-d7ba-410c-88be-475c79dbc669\u0026appkey=9ec737c30e02452cba9b30ce\u0026is_temporary=n HTTP/1.1\r\nHost: conn.webpush.theengagelab.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nConnection: keep-alive\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 09 Oct 2026 18:31:45 GMT\r\nContent-Type: application/json\r\nContent-Length: 210\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nVary: Origin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":210,"size_decoded":404,"mime_type":"application/json","magic":"JSON text data","md5":"250647bbd72aff9a1182e98fd95b12be","sha1":"b369551b6514b7588c087a61c81a3d8000358c15","sha256":"679433e1b1d08a86b8128269ed14c3cc3b3c93c46411acfd668e24e194208f11","sha512":"b3a80d39bcf47d0826fd08518cad37e7bcdbf26120582971a78f300f0f666edd5bce9915470646719f80b4f7606797441ef3c1d7cd7edb60937f74319c8f0fc6","ssdeep":"","tlshash":"91d02304204728467431003c5881bce90ddec5004c4d40011e815d2fc429315b7bd50f","first_seen":"2026-10-09T18:33:14.053596Z","last_seen":"2026-10-09T18:33:14.053596Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1017,"timings":{"blocked":0,"dns":5,"connect":247,"send":0,"wait":248,"receive":0,"ssl":516},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"conn.webpush.theengagelab.com/v2/notification_subscribe","fqdn":"conn.webpush.theengagelab.com","domain":"theengagelab.com","tld":"com"},"ip":{"addr":"43.134.137.157","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:46.894Z","timestamp":1791570706894,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.webpush.theengagelab.com","organization":""},"issuer":{"commonName":"RapidSSL TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 07 May 2026 00:00:00 GMT","end":"Sat, 21 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"CF:43:D4:33:C6:77:40:E1:A8:79:10:1A:3A:DA:E1:9C:70:B5:1B:EC","sha256":"D1:4F:71:7C:73:4A:0C:A4:15:EF:41:41:B5:F8:DF:41:F4:2C:47:8A:D4:DA:BE:15:E6:37:7A:67:F8:4A:64:AB"}}},"request":{"raw":"OPTIONS /v2/notification_subscribe HTTP/1.1\r\nHost: conn.webpush.theengagelab.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 204 No Content\r\nServer: nginx\r\nDate: Fri, 09 Oct 2026 18:31:46 GMT\r\nConnection: keep-alive\r\nAccess-Control-Allow-Headers: authorization\r\nAccess-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE\r\nAccess-Control-Allow-Origin: *\r\nVary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":319,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-09T20:29:43.461907Z","times_seen":18980891,"resource_available":true,"data":null}},"time_used":249,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":249,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_EmbeddedGameChunk.C45ma66o.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.406Z","timestamp":1791570703406,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/1_EmbeddedGameChunk.C45ma66o.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/AsyncAsideIndex.DJTJPSZz.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76c04ed42efa-OSL\r\ncf-cache-status: HIT\r\nage: 24672\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: VorR07rP502GdjyG4o16FQ==\r\nx-oss-hash-crc64ecma: 5394523805148137655\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D2AE75EC4639364DD61E\r\nx-oss-server-time: 13\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":60917,"size_decoded":22409,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (42069)","md5":"568ad1d3bacfe74d86763c86e28d7a15","sha1":"de68009fe25665c2cd51ead7572f71de822d20e7","sha256":"7d83a116caf217b21b7d7b4f571afbc1807adbdc995923b479719b9cd360f77a","sha512":"96ca65bcb5394d1654e1ca3296ba6c38731c912a69e6faf9b3292d6102bd3596bfa327cf06e2f5b21fc45015dcf1eba19aeba13f876cb4313bbee20482f101e2","ssdeep":"1536:lafZeOg6Oln3APQqV7/IRfzeEAPHDmFY7dgF1VKp4cE:lafZeOQOi7eHHDmFXVKpJE","tlshash":"a2532b8db7b916b872a60c4ca4671d5256542b03fd08d0faf67f8eaf13d5500a2bdb38","first_seen":"2026-10-09T17:19:18.889008Z","last_seen":"2026-10-09T18:33:14.056604Z","times_seen":7,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/utils.Cx8ZANrS.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.427Z","timestamp":1791570703427,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/utils.Cx8ZANrS.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/GlobalEventListenerIndex.BYsJMIjY.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76c06eef2efa-OSL\r\ncf-cache-status: HIT\r\nage: 24672\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: lamwXzEoZxzqEb/qfPNPGw==\r\nx-oss-hash-crc64ecma: 5927944863425590993\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D2AE7594F9313365AA9E\r\nx-oss-server-time: 44\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1983,"size_decoded":1649,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (1982)","md5":"95a9b05f3128671cea11bfea7cf34f1b","sha1":"c516c808a6507f57850b7e448df545afae3206f4","sha256":"3e44a8131c43747b1e0f52c2506a8c7c1c900ee39546f0b64b585f64f3d791cc","sha512":"3481fcdc801dc0945be19911d530908afdcebbadf764cf8c05d673daff3d9aa695a6a18938c05c20fb86fa80be161bd4c7116d539bb34c10c9553857068ffc27","ssdeep":"","tlshash":"20414536a7b65335779059dda8322122e074a612382ce1d4703b0f1b3d8ebc94bf09ee","first_seen":"2026-10-09T17:19:18.744233Z","last_seen":"2026-10-09T18:33:14.057656Z","times_seen":7,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/common/web/home/btn_sc_off_2.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.481Z","timestamp":1791570703481,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/common/web/home/btn_sc_off_2.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76c0bf222efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: max-age=604800,stale-while-revalidate=86400,immutable,proxy-revalidate,public\r\netag: \"ADF0800E031CFF7D59106FE817B660C1\"\r\nlast-modified: Wed, 07 Oct 2026 02:14:13 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: rfCADgMc/31ZEG/oF7ZgwQ==\r\nx-oss-hash-crc64ecma: 1444142512097110568\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D36675EC463234416628\r\nx-oss-server-time: 10\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 684\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":684,"size_decoded":1409,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"adf0800e031cff7d59106fe817b660c1","sha1":"105c4cdba9771fbf4a9ab44cc9898d58fd3668e5","sha256":"beff374b37469062554a6f44b78a685434ed71245648a3c7883b9a347fa5f2bd","sha512":"ebbebc6656976fdaca3ed7dbd545c6ad865984dbaf696e160a4fe7bffce55cd2548ec09883e04bd595032c1150bbc82eb482aa3584409fccff518e226ec5cd71","ssdeep":"","tlshash":"7301887b017d9af18505dd8954a6b2b4f047396e8c007f32c6b155f575011bd703743b","first_seen":"2024-08-03T23:56:14Z","last_seen":"2026-10-09T18:33:14.011668Z","times_seen":64,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ytbacksexo.xyz/hall/api/netstat/attribution/match","fqdn":"ytbacksexo.xyz","domain":"ytbacksexo.xyz","tld":"xyz"},"ip":{"addr":"8.233.17.31","port":443,"asn":3356,"as":"LEVEL3","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:44.496Z","timestamp":1791570704496,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ytbacksexo.xyz","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Tue, 29 Sep 2026 13:10:22 GMT","end":"Mon, 28 Dec 2026 14:06:17 GMT"},"fingerprint":{"sha1":"04:0A:47:19:B0:39:99:10:59:DF:86:B3:5D:7C:0A:9C:BD:E2:E6:E6","sha256":"31:E0:07:6A:95:AF:27:B6:02:96:5F:18:19:44:AA:81:D9:DF:02:17:C7:1E:25:ED:01:84:C0:20:BB:82:4E:FB"}}},"request":{"raw":"OPTIONS /hall/api/netstat/attribution/match HTTP/1.1\r\nHost: ytbacksexo.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: appsystem,appversion,browserfingerid,browsertype,clienttimezone,currency,device,devicebrand,devicemodel,domain,language,operatingsystem,physicaldevicemodel,platformtype,sitecode,timestamp,token,webauthndomain,x-custom-referer,x-data-mode,x-device,x-object-id,x-request-id,x-version\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 200 \r\ndate: Fri, 09 Oct 2026 18:31:44 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 0\r\nset-cookie: acw_tc=0a0f6be417915707048462521e0a1380c81068bf7e1af0d1a78c582d61f4e9;path=/;HttpOnly;Max-Age=1800\r\nx-saas-server-id: 8576b68756-fnbp8|c642211e946e76d85f9c1762504450d3\r\naccess-control-allow-methods: *\r\naccess-control-max-age: 1728000\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: appsystem,appversion,browserfingerid,browsertype,clienttimezone,currency,device,devicebrand,devicemodel,domain,language,operatingsystem,physicaldevicemodel,platformtype,sitecode,timestamp,token,webauthndomain,x-custom-referer,x-data-mode,x-device,x-object-id,x-request-id,x-version\r\naccess-control-expose-headers: X-Trace-ID, newjwt, token\r\nvia: 1.1 google\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":[{"name":"acw_tc","value":"0a0f6be417915707048462521e0a1380c81068bf7e1af0d1a78c582d61f4e9","quoted":false,"path":"/","max_age":1800,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"acw_tc=0a0f6be417915707048462521e0a1380c81068bf7e1af0d1a78c582d61f4e9;path=/;HttpOnly;Max-Age=1800"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":895,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-09T20:29:43.461907Z","times_seen":18980891,"resource_available":true,"data":null}},"time_used":531,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":531,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ytbacksexo.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"accounts.google.com/gsi/status?client_id=887744056096-dm6sfvm20pkul4s2is0kgvi0bnh1jd61.apps.googleusercontent.com\u0026cas=2DbULWAVvsUpSbXOuravQaXCQKxMoad%2BBNN0U4UHtQc\u0026bs=AUD%2B1QJhwLFQIgL25h%2FmMPSBZUZ0nELdT6H4yLr7%2BQE\u0026has_opted_out_fedcm=false\u0026is_itp=true","fqdn":"accounts.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"172.253.148.84","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:44.723Z","timestamp":1791570704723,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:00:11 GMT","end":"Fri, 11 Dec 2026 20:00:10 GMT"},"fingerprint":{"sha1":"81:58:83:A3:C8:EB:81:F3:A5:FE:6C:6B:D8:F7:B3:E8:49:83:32:0F","sha256":"30:B5:2C:EA:47:6E:0A:AB:5B:94:50:CC:FC:33:CB:F9:57:B2:4B:F1:B4:5D:3D:7D:BB:10:A6:02:81:8E:54:F5"}}},"request":{"raw":"GET /gsi/status?client_id=887744056096-dm6sfvm20pkul4s2is0kgvi0bnh1jd61.apps.googleusercontent.com\u0026cas=2DbULWAVvsUpSbXOuravQaXCQKxMoad%2BBNN0U4UHtQc\u0026bs=AUD%2B1QJhwLFQIgL25h%2FmMPSBZUZ0nELdT6H4yLr7%2BQE\u0026has_opted_out_fedcm=false\u0026is_itp=true HTTP/1.1\r\nHost: accounts.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 403 \r\ncontent-type: application/json; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: https://ad852.xyz\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: Mon, 01 Jan 1990 00:00:00 GMT\r\ndate: Fri, 09 Oct 2026 18:31:44 GMT\r\ncontent-disposition: attachment; filename=\"json.txt\"; filename*=UTF-8''json.txt\r\nreport-to: {\"group\":\"coop_dd7de8473bddc59c6b748810a67a39b1\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1\"}]}\r\ncontent-security-policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'nonce-COPGKE31CghYJ3hbjiVkLA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"coop_dd7de8473bddc59c6b748810a67a39b1\"\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":null,"data":{"size":58,"size_decoded":1361,"mime_type":"application/json; charset=utf-8","magic":"ASCII text","md5":"c27a3c05f78f5bd06b77d38e8ba14b0a","sha1":"cf9da15bebcc65b022687ebeeff358b74b230aaf","sha256":"f5653e0c7cb5fb7e7337f749c5d64166fc10ae19ef79c1a60928fa52cc113ef2","sha512":"918022f40bb51f032b248dc9bbfcceb331220643b0bfbcb8b111f08fc39aa9cfd3731ddb97cd68231eab9fb0274c8197b7e4c703fd0b6038547b3d0c34996200","ssdeep":"","tlshash":"9aa0023c8910951563d80a96165a4fde09437089154c133431e4d8a5d541c9b20ba515","first_seen":"2026-10-09T18:33:14.058435Z","last_seen":"2026-10-09T18:33:14.058435Z","times_seen":1,"resource_available":true,"data":null}},"time_used":117,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":117,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_MineChunk.CjWOueOl.css","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.914Z","timestamp":1791570702914,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/1_MineChunk.CjWOueOl.css HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: text/css\r\ncontent-encoding: br\r\ncf-ray: a47f76bd3bf32efa-OSL\r\ncf-cache-status: HIT\r\nage: 27343\r\ncache-control: max-age=31622400\r\npriority: u=2,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:01 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: KLjade2O+Db0XksFjrWkLg==\r\nx-oss-hash-crc64ecma: 12011978053557430907\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C83E0A93063538639551\r\nx-oss-server-time: 5\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":85743,"size_decoded":13764,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"28b8da75ed8ef836f45e4b058eb5a42e","sha1":"94ddb3ba77c7cedc166d04b97ea33bbccc338a8e","sha256":"a717566f4ac747556f466a86eb7fa1e62f5c2dd949c4dd3cd73b25387032fcac","sha512":"a47a2364c7c624a9f85e5075beb2ab45430af41df25837383ed6ba9d5a1d4cf8938a481445e2364e3ca7bbdb0c8cfc494e136ce21776de18df574aeb6c4d1a1f","ssdeep":"1536:hkHN8Hy0tSpHunxarH/I0hj3u6oPGi60nlop04SabeM:heYnlopOabx","tlshash":"9d83f9889f60f13af967a715f8e3b39862957161c7439dddf9239e368bcb365002031a","first_seen":"2026-10-09T17:45:43.637488Z","last_seen":"2026-10-09T18:33:14.060004Z","times_seen":4,"resource_available":true,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/props.BALfofGW.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.395Z","timestamp":1791570703395,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/props.BALfofGW.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/AsyncAsideIndex.DJTJPSZz.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76c03eb92efa-OSL\r\ncf-cache-status: HIT\r\netag: W/\"92C34B490E6151D6858E74C4DD152438\"\r\nage: 27340\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: ksNLSQ5hUdaFjnTE3RUkOA==\r\nx-oss-hash-crc64ecma: 4768141045063892064\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C842E702E23035C73443\r\nx-oss-server-time: 2\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":607,"size_decoded":924,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (606)","md5":"92c34b490e6151d6858e74c4dd152438","sha1":"b27b625230344edad480d26e3ee157f170be46bc","sha256":"9b8c67e363d74a0d486d311aa34513cb60fb1b24f42d4034e2e0e1459fcd5174","sha512":"d4f4fe9a00100aa75ad03ab04ee020c1e20a9b7ef5d8de4df2270c7778faab2564356a22709db843854a191b701436fcb35d44a98b05dd0c2a03790effa2697c","ssdeep":"","tlshash":"25f0af2b784de6539fd78d3a60651b894908ce5de8243ae0ab973579478bceca60d310","first_seen":"2026-08-23T14:57:34.897016Z","last_seen":"2026-10-09T18:33:14.060946Z","times_seen":14,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ytbacksexo.xyz/hall/ipCheck?siteCode=3792\u0026currency=VND\u0026language=vi\u0026platformType=5","fqdn":"ytbacksexo.xyz","domain":"ytbacksexo.xyz","tld":"xyz"},"ip":{"addr":"8.233.17.31","port":443,"asn":3356,"as":"LEVEL3","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:44.256Z","timestamp":1791570704256,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ytbacksexo.xyz","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Tue, 29 Sep 2026 13:10:22 GMT","end":"Mon, 28 Dec 2026 14:06:17 GMT"},"fingerprint":{"sha1":"04:0A:47:19:B0:39:99:10:59:DF:86:B3:5D:7C:0A:9C:BD:E2:E6:E6","sha256":"31:E0:07:6A:95:AF:27:B6:02:96:5F:18:19:44:AA:81:D9:DF:02:17:C7:1E:25:ED:01:84:C0:20:BB:82:4E:FB"}}},"request":{"raw":"GET /hall/ipCheck?siteCode=3792\u0026currency=VND\u0026language=vi\u0026platformType=5 HTTP/1.1\r\nHost: ytbacksexo.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: vi\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nx-object-id: {\"uid\":\"\",\"browserLanguage\":\"en-US\",\"init\":{\"device\":\"\",\"created\":1791570702472,\"version\":1791251963000}}\r\nplatformType: 5\r\nx-device: 1-5\r\nx-data-mode: plain\r\nx-request-id: e801f114-8503-4976-9c6c-7a03e7fa8e0d\r\ndevice: 8034c51c-91ec-430d-af2a-41881722443b\r\ncurrency: VND\r\ntimestamp: 1791570703\r\nsiteCode: 3792\r\nlanguage: vi\r\ndeviceModel: Firefox v134.0\r\nphysicalDeviceModel: unknown\r\noperatingSystem: Windows\r\ndeviceBrand: unknown\r\nbrowserType: Firefox v134.0\r\nappSystem: Windows 10\r\ndomain: ad852.xyz\r\nwebauthnDomain: ad852.xyz\r\nclienttimezone: 0\r\nx-custom-referer: https://ad852.xyz/\r\nx-version: 7.5.141\r\nappVersion: v7.5.141\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\ntoken: \r\nbrowserfingerid: \r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Fri, 09 Oct 2026 18:31:44 GMT\r\ncontent-type: application/json\r\nset-cookie: acw_tc=0a0f6bd317915707049098850e3a034db8f36624a48802f01b01da9a3e3e0a;path=/;HttpOnly;Max-Age=1800\r\nvary: Accept-Encoding\r\nx-trace-id: e50532d007ddb34a\r\ncache-control: no-cache\r\nx-saas-server-id: 8576b68756-bbz56|ee4e0fd269d2bd3b24a415ea1ba63811\r\naccess-control-allow-methods: *\r\naccess-control-max-age: 1728000\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Trace-ID, newjwt, token\r\ncontent-encoding: gzip\r\nvia: 1.1 google\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":[{"name":"acw_tc","value":"0a0f6bd317915707049098850e3a034db8f36624a48802f01b01da9a3e3e0a","quoted":false,"path":"/","max_age":1800,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"acw_tc=0a0f6bd317915707049098850e3a034db8f36624a48802f01b01da9a3e3e0a;path=/;HttpOnly;Max-Age=1800"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":243,"size_decoded":840,"mime_type":"application/json","magic":"JSON text data","md5":"6b28feb4949a7f6551be3d63db59adc8","sha1":"964d64d6d9589641f013db6886ee47156aaa11d2","sha256":"c5e8eaa26056fdda929020f331a24911ab178397bf0f8b4ffad0ed63cf7b1022","sha512":"2af27fdd912896c64e0dc594280d845ad45f849cda0d02a08ece7cf8992419fcf8756a18f2a80233eedbf38bd269f13c619388ed3994772b83f3a787c5110eb0","ssdeep":"","tlshash":"fed0a704005c4876ee11e3069c07eae05f7e4a5674cb9aace64e6f7481a51dcd14572f","first_seen":"2026-10-09T18:33:14.063377Z","last_seen":"2026-10-09T18:33:14.063377Z","times_seen":1,"resource_available":true,"data":null}},"time_used":284,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":279,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ytbacksexo.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/cocos/bewcdn.json?t=1791570704610","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:44.616Z","timestamp":1791570704616,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /cocos/bewcdn.json?t=1791570704610 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:44 GMT\r\ncontent-type: application/json\r\npriority: u=4,i=?0\r\ncf-ray: a47f76c7dcc52efa-OSL\r\ncf-cache-status: MISS\r\naccept-ranges: bytes\r\ncache-control: public, max-age=0, s-maxage=86400, must-revalidate\r\netag: \"C4C56880D36A505452C7F1426E631951\"\r\nlast-modified: Thu, 30 Jul 2026 12:18:09 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: xMVogNNqUFRSx/FCbmMZUQ==\r\nx-oss-hash-crc64ecma: 3051544697344373756\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC93310108AF538384731E2\r\nx-oss-server-time: 1\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 31\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":31,"size_decoded":725,"mime_type":"application/json","magic":"JSON text data","md5":"c4c56880d36a505452c7f1426e631951","sha1":"fc86776f2c7cec9c37734a00b07d807c9f572508","sha256":"55ac0061e3bdf43ab73a86c604e98b6a4b94541af472941f4199155449a0282d","sha512":"360ceb7a30198c1c8c42dc3d4ede386b6fd00158af6e1091d0db25c04502ebd60bbc4217c67586b88249cf4a14f5deb74feb3bcc2d5a3a94fe24902112e0b1d1","ssdeep":"","tlshash":"e380002a8cb088b0e8c22ac28c08822a282a8b0822220a30ac8c000e8328200ea00800","first_seen":"2026-10-09T17:19:18.802848Z","last_seen":"2026-10-09T18:33:14.068602Z","times_seen":6,"resource_available":true,"data":null}},"time_used":219,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":219,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"conn.webpush.theengagelab.com/v2/notification_subscribe","fqdn":"conn.webpush.theengagelab.com","domain":"theengagelab.com","tld":"com"},"ip":{"addr":"43.134.137.157","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:46.892Z","timestamp":1791570706892,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.webpush.theengagelab.com","organization":""},"issuer":{"commonName":"RapidSSL TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 07 May 2026 00:00:00 GMT","end":"Sat, 21 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"CF:43:D4:33:C6:77:40:E1:A8:79:10:1A:3A:DA:E1:9C:70:B5:1B:EC","sha256":"D1:4F:71:7C:73:4A:0C:A4:15:EF:41:41:B5:F8:DF:41:F4:2C:47:8A:D4:DA:BE:15:E6:37:7A:67:F8:4A:64:AB"}}},"request":{"raw":"POST /v2/notification_subscribe HTTP/1.1\r\nHost: conn.webpush.theengagelab.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Length: 48\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nAuthorization: Basic MTgwNjIyMzQ5MTphNjJkYTgxNjA4ODYwOTlmMWYyMDFlNzExMTllMjQ1Nzk1Y2EyY2NlOjM0ODU5MGRmZGEyZWE3N2I=\r\nConnection: keep-alive\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":70,"data":"RºB¢)¾1¤ÂF]óÌWYc‹Ý(ºZË\u001fÌ]rÀ÷W#\u0002‰öRkU~êtsv3øÒê"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 09 Oct 2026 18:31:47 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nVary: Accept-Encoding, Origin\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14195,"size_decoded":5498,"mime_type":"application/json","magic":"JSON text data","md5":"9fabcc0402fffc07decdc58f2286cd95","sha1":"a66d0b68fa67edf18627edef07abac306ebffaaf","sha256":"dfabb29d2747d4215ecffd053899505dc3ff1e208d532b18e84575905dbb4014","sha512":"384d3243fafae3bd7658a948a2376b450cf2e1c3fdef12debadf3bd334ca903d24172ab04695fedbf0d698900430afdc6686536029d206bcbbe392a08a14f671","ssdeep":"192:oXn9YykzGUppe1OMNftSezFDNUWDqisgO2L4l1j5+RH8cUtH:SORY1HltpDvigE7iH8cUtH","tlshash":"e052939f35270a31a5d32de5cff3915a703737107626c2203eae444667ca1688ae27ef","first_seen":"2026-10-09T17:45:43.431466Z","last_seen":"2026-10-09T18:33:14.070535Z","times_seen":4,"resource_available":true,"data":null}},"time_used":250,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":250,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/vendors/vendor-stable.DEnvQj4j.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.106Z","timestamp":1791570702106,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/vendors/vendor-stable.DEnvQj4j.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76b8285c2efa-OSL\r\ncf-cache-status: HIT\r\nage: 25005\r\ncache-control: max-age=31622400\r\npriority: u=1,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: qFzDUNsZlIuDYRu5H8DKpw==\r\nx-oss-hash-crc64ecma: 8487763807333327415\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D16075EC463232C7460D\r\nx-oss-server-time: 34\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":344988,"size_decoded":125094,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (34903)","md5":"a85cc350db19948b83611bb91fc0caa7","sha1":"0d92e9935dd7ffc640a0d44eb20150014b8dc2fd","sha256":"b6585208cc1e1a50a19923def5d91558fe7462abd3dbf6af80b6b3adc4799d4b","sha512":"b6ba8970c7003a17b5a79b56fb68701bcf93468d2f3621ccd83a7d3f3b9365f638965365db01bd4928ce9293c64a30f72687cd2c1d54e255bd089033b0c14415","ssdeep":"6144:qCnwtLgNQ1gC4IZn9LDyIJfXyUZm9SesUR4rdfM8uqpy+Bc:PoLKQeC4IZ9HVU9SeslrVAqg+Bc","tlshash":"797406d932d6b02243b659f5507b0006f33d2925b84dd498f1ade8da3d7680a82bbf7d","first_seen":"2026-10-09T17:19:18.780869Z","last_seen":"2026-10-09T18:33:14.072017Z","times_seen":7,"resource_available":true,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ytbacksexo.xyz/hall/ipCheck?siteCode=3792\u0026currency=VND\u0026language=vi\u0026platformType=5","fqdn":"ytbacksexo.xyz","domain":"ytbacksexo.xyz","tld":"xyz"},"ip":{"addr":"8.233.17.31","port":443,"asn":3356,"as":"LEVEL3","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:44.257Z","timestamp":1791570704257,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ytbacksexo.xyz","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Tue, 29 Sep 2026 13:10:22 GMT","end":"Mon, 28 Dec 2026 14:06:17 GMT"},"fingerprint":{"sha1":"04:0A:47:19:B0:39:99:10:59:DF:86:B3:5D:7C:0A:9C:BD:E2:E6:E6","sha256":"31:E0:07:6A:95:AF:27:B6:02:96:5F:18:19:44:AA:81:D9:DF:02:17:C7:1E:25:ED:01:84:C0:20:BB:82:4E:FB"}}},"request":{"raw":"OPTIONS /hall/ipCheck?siteCode=3792\u0026currency=VND\u0026language=vi\u0026platformType=5 HTTP/1.1\r\nHost: ytbacksexo.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: appsystem,appversion,browserfingerid,browsertype,clienttimezone,currency,device,devicebrand,devicemodel,domain,language,operatingsystem,physicaldevicemodel,platformtype,sitecode,timestamp,token,webauthndomain,x-custom-referer,x-data-mode,x-device,x-object-id,x-request-id,x-version\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 09 Oct 2026 18:31:44 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 0\r\nset-cookie: acw_tc=0a0f6c2c17915707046092157e67afd79238dae704d6bb7e0467f88eee0f8b;path=/;HttpOnly;Max-Age=1800\r\nx-saas-server-id: 8576b68756-l79zl|62a26b44aa7ce836c78ee3e1a756225f\r\naccess-control-allow-methods: *\r\naccess-control-max-age: 1728000\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: appsystem,appversion,browserfingerid,browsertype,clienttimezone,currency,device,devicebrand,devicemodel,domain,language,operatingsystem,physicaldevicemodel,platformtype,sitecode,timestamp,token,webauthndomain,x-custom-referer,x-data-mode,x-device,x-object-id,x-request-id,x-version\r\naccess-control-expose-headers: X-Trace-ID, newjwt, token\r\nvia: 1.1 google\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"acw_tc","value":"0a0f6c2c17915707046092157e67afd79238dae704d6bb7e0467f88eee0f8b","quoted":false,"path":"/","max_age":1800,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"acw_tc=0a0f6c2c17915707046092157e67afd79238dae704d6bb7e0467f88eee0f8b;path=/;HttpOnly;Max-Age=1800"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":0,"size_decoded":915,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-09T20:29:43.461907Z","times_seen":18980891,"resource_available":true,"data":null}},"time_used":534,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":533,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ytbacksexo.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/locales/vi.DAxNX6cn.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.609Z","timestamp":1791570702609,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/locales/vi.DAxNX6cn.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/commonChunk.0oGKmx_H.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76bb4a602efa-OSL\r\ncf-cache-status: HIT\r\nage: 27343\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: mCUAQs1tyMGlScGXCkO24Q==\r\nx-oss-hash-crc64ecma: 9809363270728644779\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C83E8F02F936317D47A8\r\nx-oss-server-time: 7\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":779501,"size_decoded":193575,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (32913)","md5":"eadf3fd1e5d64ccbf8461e713afd56ed","sha1":"3f9a9eb784644848c41ce0e0c2cb0432f9182e51","sha256":"0c6714e651627fdb655f27af31b0b0f3fa1db93c1eadf8f944ae9aa9ea3336cd","sha512":"eae233da40e69e9ae72d36760e995c08321a6b23f938d041229587d91e4fdf5ac52089cddf9e5d060df296d93489d0062d162ab0e12a53ab3050c82ee73ab47f","ssdeep":"12288:xXkZ6h/ZLasGdjJS4gZ6tu34AGKNA8ZMrAoDh874lSFHwYJMUqtvJuOno7rUyq1G:xXk/jMf34ApZMD874lSFH4/Pno7rUyqs","tlshash":"78f4ea0112a4302a857d461ee1eda84d5fde786ff380cfe82aec05b55a46db17e2178f","first_seen":"2026-10-09T17:19:18.948631Z","last_seen":"2026-10-09T18:33:14.073419Z","times_seen":7,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":22,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/common/common/home/img_game_tj1_zj.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.755Z","timestamp":1791570703755,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/common/common/home/img_game_tj1_zj.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a47f76c279462efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24489\r\ncache-control: max-age=604800,public\r\netag: \"89E6B52266A7F59B6D4577D4386F5CB6\"\r\nlast-modified: Wed, 23 Sep 2026 00:36:34 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: iea1Iman9ZttRXfUOG9ctg==\r\nx-oss-hash-crc64ecma: 14499579524150722030\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D36694539438305ABB99\r\nx-oss-server-time: 21\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 982\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":982,"size_decoded":1652,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"89e6b52266a7f59b6d4577d4386f5cb6","sha1":"74b20bd9cc0373d4b427433341ec7d957e9a0345","sha256":"e1661304019519f9b7eedf804ff08a764615fa6022763faa37d2140ba4ffd335","sha512":"99d52848aefffaa429af36d1b8fd3eca6162c514e965c3c92e58143e0f82ad1a98faa11a4d31706cbbcf1202a8a38341bf749af2fe12a4e16d318395de9aa874","ssdeep":"","tlshash":"81110c99072553728df92f3e1a6be61632742029c40ef301c60306f555f04a94ebe710","first_seen":"2026-10-03T13:22:48.478446Z","last_seen":"2026-10-09T18:33:13.810587Z","times_seen":21,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webpushstat-sgp.engagelab.com/v4/web/report","fqdn":"webpushstat-sgp.engagelab.com","domain":"engagelab.com","tld":"com"},"ip":{"addr":"43.163.81.198","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:46.866Z","timestamp":1791570706866,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.engagelab.com","organization":""},"issuer":{"commonName":"RapidSSL TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 25 Aug 2026 00:00:00 GMT","end":"Thu, 11 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"2D:37:4A:17:47:09:76:A5:C3:14:DA:C6:FA:75:C8:68:99:90:1A:D0","sha256":"5A:9B:4F:D1:E3:1F:F2:80:4A:C1:E3:15:B5:C1:05:A0:28:53:24:47:F0:25:6B:88:22:2B:1E:BD:C3:5F:F7:F1"}}},"request":{"raw":"OPTIONS /v4/web/report HTTP/1.1\r\nHost: webpushstat-sgp.engagelab.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type\r\nReferer: https://ad852.xyz/\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 204 No Content\r\nServer: nginx\r\nDate: Fri, 09 Oct 2026 18:31:47 GMT\r\nConnection: keep-alive\r\nAccess-Control-Allow-Headers: authorization,content-type\r\nAccess-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE\r\nAccess-Control-Allow-Origin: *\r\nVary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":332,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-09T20:29:43.461907Z","times_seen":18980891,"resource_available":true,"data":null}},"time_used":703,"timings":{"blocked":-1,"dns":1,"connect":174,"send":0,"wait":176,"receive":0,"ssl":352},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-1/common/_sprite/icon_dt_1tg.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.093Z","timestamp":1791570703093,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-1/common/_sprite/icon_dt_1tg.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76be4ced2efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 24490\r\ncache-control: max-age=604800,public\r\netag: \"CA7D67A32C0ED1A8B96D02CA9607FBA9\"\r\nlast-modified: Fri, 25 Sep 2026 04:47:12 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: yn1noywO0ai5bQLKlgf7qQ==\r\nx-oss-hash-crc64ecma: 17862863402161507748\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D364A87B9A3931A2F14B\r\nx-oss-server-time: 73\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 974\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":974,"size_decoded":1644,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ca7d67a32c0ed1a8b96d02ca9607fba9","sha1":"7d2538a1eaf49d28c651ef79c4d8ccbdd0f87829","sha256":"92740b9bbac26dc1d3c679b0e16730b264819f0bbec179445d261899804c8cdc","sha512":"c194f3e551550a1256dd849ff188932c4ffef87430b1c756f963e3c52f931fb9b30a911765f32d72ab095c0c81550be62f909bbc7071dfd7888ff97f98288066","ssdeep":"","tlshash":"c011a5258331a0daf824881a205cd63da7c256c480f694507eac6f7484dc0f719989e1","first_seen":"2026-10-09T17:45:43.616382Z","last_seen":"2026-10-09T18:33:14.074832Z","times_seen":4,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_PromoteChunk.VT1akud3.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.119Z","timestamp":1791570703119,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/1_PromoteChunk.VT1akud3.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/commonChunk.0oGKmx_H.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76be7d182efa-OSL\r\ncf-cache-status: HIT\r\nage: 27342\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: II5nQifWJPWvnKdY5vPp0Q==\r\nx-oss-hash-crc64ecma: 8683065074520851226\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C840669A4C3432857849\r\nx-oss-server-time: 5\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":405923,"size_decoded":89508,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65128)","md5":"208e674227d624f5af9ca758e6f3e9d1","sha1":"f50a556c6414370ada4863d273ae575d74e25b7d","sha256":"1a578291bdfe86d6aed2f1806c6c270d53cacc2086f09b053088929c84e1e322","sha512":"b82882a75e06b6b9fb8fedab5e3ef119ff103abc00dd238c3c1dfc132f1dea54b40ec110d9768d2c081857b839b71d97857c64d01e983ad80ef704bff33f69f6","ssdeep":"6144:lrEmjIiGLURJQxiyheJg4Fb6chZwveNabCKbvVt+FC2IJfiYZdMuGUO:uGQsj1TAxiMGUO","tlshash":"9784e78df469d474f63ead18a0b50851a31c7b8e9014c4e861fe4f2067d6fb8b69933e","first_seen":"2026-10-09T17:19:19.103906Z","last_seen":"2026-10-09T18:33:14.076428Z","times_seen":7,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/1_AgentCenterChunk.D6aUSIbi.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.409Z","timestamp":1791570703409,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/1_AgentCenterChunk.D6aUSIbi.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/AsyncAsideIndex.DJTJPSZz.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76c04ee02efa-OSL\r\ncf-cache-status: HIT\r\nage: 27342\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: fIwfJv5oYmZP055kB7oYdg==\r\nx-oss-hash-crc64ecma: 13623383526101612325\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C8400A9306353824AC51\r\nx-oss-server-time: 6\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":229568,"size_decoded":63001,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (65483), with no line terminators","md5":"7c8c1f26fe6862664fd39e6407ba1876","sha1":"8e7cfca8fce8fc5bd76db056f6380edbc5376b51","sha256":"e15349f524fde86f66c8f4cd7121d34de970420dcf2744cea4f62fb508b7902a","sha512":"c3e3e6c78b4bb23b3d0a7d6a9b1941069bbf7924c300e4887c77ce5f49c25bfacc3d08ab7be4b7206b6bde1b44d859feef1f564ebccd61fb618f7ec19e4fd38f","ssdeep":"3072:I5X2EIORjjNq7p7UwN13y2ifGBoIBDWCcFdQKmThwqM48YZVAFFuz/380pEP:uXROHiSWCUQKEwdDYfRE0s","tlshash":"43240988b4b9e534fb7e6d69b0750c90620c2b469014d4f8f1fe8f64678afb4b15933a","first_seen":"2026-10-09T17:19:19.050755Z","last_seen":"2026-10-09T18:33:14.077382Z","times_seen":7,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ytbacksexo.xyz/hall/api/gohal/bffApi","fqdn":"ytbacksexo.xyz","domain":"ytbacksexo.xyz","tld":"xyz"},"ip":{"addr":"8.233.17.31","port":443,"asn":3356,"as":"LEVEL3","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:42.882Z","timestamp":1791570702882,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ytbacksexo.xyz","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Tue, 29 Sep 2026 13:10:22 GMT","end":"Mon, 28 Dec 2026 14:06:17 GMT"},"fingerprint":{"sha1":"04:0A:47:19:B0:39:99:10:59:DF:86:B3:5D:7C:0A:9C:BD:E2:E6:E6","sha256":"31:E0:07:6A:95:AF:27:B6:02:96:5F:18:19:44:AA:81:D9:DF:02:17:C7:1E:25:ED:01:84:C0:20:BB:82:4E:FB"}}},"request":{"raw":"POST /hall/api/gohal/bffApi HTTP/1.1\r\nHost: ytbacksexo.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: vi\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain\r\nx-object-id: {\"uid\":\"\",\"browserLanguage\":\"en-US\",\"init\":{\"device\":\"\",\"created\":1791570702472,\"version\":1791251963000}}\r\nplatformType: 5\r\nx-device: 1-5\r\nx-data-mode: chipher\r\nx-request-id: d83a06fc-e187-4926-beb4-ddb6b5157a02\r\ndevice: 8034c51c-91ec-430d-af2a-41881722443b\r\ncurrency: VND\r\ntimestamp: 1791570702\r\nsiteCode: 3792\r\nlanguage: vi\r\ntoken: b2e3d672-9d88-47a7-81b4-9d7ffc62054f\r\ndeviceModel: Firefox v134.0\r\nphysicalDeviceModel: unknown\r\noperatingSystem: Windows\r\ndeviceBrand: unknown\r\nbrowserType: Firefox v134.0\r\nappSystem: Windows 10\r\ndomain: ad852.xyz\r\nwebauthnDomain: ad852.xyz\r\nclienttimezone: 0\r\nx-custom-referer: https://ad852.xyz/\r\nx-version: 7.5.141\r\nappVersion: v7.5.141\r\nbrowserfingerid: \r\nContent-Length: 1388\r\nOrigin: https://ad852.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1388,"data":"nTXYxGmPgZkaupRoDu4gV8QsNCNDN9Vzn8c3X9e7cSzykL24W4SW3IOEJlsK6ChrZ2tIu6V6zlVnvOxWH+EheHc3vhmPNq5e5l3jWVXWb0hwOAb18GXsLglPK90nMkCSzBwQjWUzAbt4SgzBqb5J01qj5e4zbSii7XD2CvhFTVAHH83coYIU3tylOWHTAk6v/b1ATvtZ+eR6K+qWj2vTDk+V/KaOw7RtY28eDHwoJAsXku3olov13Aro56IsRYig9Q7SOT8DudMvRQEJlB/3mrRgdC6x313xqJ0z5Hc5DKjtyDN/IB8JVx699mJB5QGaJ0vEK8J7pWv1IIviqmAWeGVlmILrnFTahBAu0bQdNtCw7rhv9rYh3WR5Lii/PIhNn+IyEl2Sg6cLk71lFuVl8/gYEJkwYq9ZpbzgwP5ickvi/81I2qauFAgP4p3ls7WIfJFV36/1vDT233GW2XWfLh1poDyVZi2HB1azUsTSXILuz29+ZjOaeLFwplrOSzgXGh5YBFHSvSOxKpY9rKBwy7WJ9VrhkBOu1x9VIbr93f/K1v7S9ubUMyDCBYSaUMs9YMGCtDNeIUoSAdVojU3vHrpTYG33JlK37DsOWULg2G3QLf5ftJESMTNlx/NG8UCYyByDxdonrKP4+RXU/E4/QEVFyf/zIvguM9P3LYutPugPRlizF9q0ay/6KpiS/DzRpv8CkrOPP17ifEH7VhFffnD1zDlqgoF6p/Y8/OWZ8kxHvSJcNmtFIPQY5aYYLUod3UDAg+xPUmtv3w5o5Ym2ik6hxjV72XLguBNiFJy17u7DUsrfEFAc02Qek84uJQYjl4jIhS6NMfHYAOfGkbS8uA5k3WBlk4ycPPfFyaapsARUNzJOhazdjNmSPMwFAkU1I5LW9SFUj3EgKzChdGiK9YWs+Z6zgf3nPJjCLIpff2UU23O3xd2pDGfXi9Oh7L/zWb/otBiK/JTuJEk+pT7/3l19/FvKW/Z3JyWnF3W5S6v5SRvHoWzw8xWBI4zrSwb5kxeLRDyXEQWifYWjJmV5I+AaJctCGsYQPBrTm5cpSb5mDWgWZPwS8sLqcOFzwFd00C0+iCMfISuFVbpoxfqY2F0cUwFL+K5XUtD0h28IxTOm1+ClDe2xyigljy2gO7W2exhMWToFdqhNyvK3ROPoQ8poynqkRMb4zpchM3SLPcUJkUml+Ji49w7fO/4llBtAA8c7bp8p3qTD71yQ9/oGz1MAZJkMzmvNluzApPoskm1d4dtABtFU65DvOsyZGBPQoQdTYv9zAU27F0wMEtbsw0TQnFCIZHiz37g1L6tbqBZyoiVKWDsI7sEbpPg95JChIZAokGW8rMERAQcDrCXjBBxgq5C9Lee33vkLC17VM+M="}},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: text/plain; charset=utf-8\r\nset-cookie: acw_tc=0a0f6c3817915707036834921e522694ca4fcff31ec4551dbc8d2aad93503b;path=/;HttpOnly;Max-Age=1800\nUserKey=r6rO4ynNZKJ1p65I-uK4CkP-veqJCOf2EuMhQ8USpDWByD6hwODQCm1vW_5sXoqu; Path=/; Expires=Sat, 09 Oct 2027 18:31:43 GMT; Max-Age=31535999; HttpOnly\r\nvary: Accept-Encoding\r\nx-trace-id: 6be558da98e13e6b\r\nx-env-go-biz-gohal-server: 0\r\ncache-control: no-cache\r\nx-saas-server-id: 8576b68756-jq9n9|eefb09bb97d4f9d19b7e3505b009415b\r\naccess-control-allow-methods: *\r\naccess-control-max-age: 1728000\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Trace-ID, newjwt, token\r\ncontent-encoding: gzip\r\nvia: 1.1 google\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"acw_tc","value":"0a0f6c3817915707036834921e522694ca4fcff31ec4551dbc8d2aad93503b","quoted":false,"path":"/","max_age":1800,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"acw_tc=0a0f6c3817915707036834921e522694ca4fcff31ec4551dbc8d2aad93503b;path=/;HttpOnly;Max-Age=1800"},{"name":"UserKey","value":"r6rO4ynNZKJ1p65I-uK4CkP-veqJCOf2EuMhQ8USpDWByD6hwODQCm1vW_5sXoqu","quoted":false,"path":"/","expires":"2027-10-09T18:31:43Z","raw_expires":"Sat, 09 Oct 2027 18:31:43 GMT","max_age":31535999,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"UserKey=r6rO4ynNZKJ1p65I-uK4CkP-veqJCOf2EuMhQ8USpDWByD6hwODQCm1vW_5sXoqu; Path=/; Expires=Sat, 09 Oct 2027 18:31:43 GMT; Max-Age=31535999; HttpOnly"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12864,"size_decoded":10617,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (12864), with no line terminators","md5":"537b6a8e39b0f55ccedbb227fe4f0449","sha1":"edc7fbbf2a9d38a4c543552d3b9da9989bf884d8","sha256":"6f1078649f164f6f7d0c57993af3580d77420f931e4f2b18e8072c3200d6a185","sha512":"3e1a22794d26c0a1ded377d812250959d33fa7106b6afbee946869480775680b66fb8969e0399029b6f18c4166ca1df3ebbc45b061ab05ff6c9dd0e3098aacd9","ssdeep":"192:+7T0JNwzw5TBrCU6EsK35PgdNVZjI8ORkHE7PAt6HSg/7ANFWJT5/ZwHEVLxD:+H0rC/I31CN7cFR/4t6HSw7zJT9keLB","tlshash":"2642c04caf022b6225cc7fc1156af916af590e4cd0613d938ab3f61ebd4c09581c9678","first_seen":"2026-10-09T18:33:14.078496Z","last_seen":"2026-10-09T18:33:14.078496Z","times_seen":1,"resource_available":true,"data":null}},"time_used":325,"timings":{"blocked":-1,"dns":0,"connect":0,"send":2,"wait":323,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ytbacksexo.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-1/common/home/icon_dt_pmd.webp?manualVersion=1\u0026version=v7.5.141","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.089Z","timestamp":1791570703089,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-1/common/home/icon_dt_pmd.webp?manualVersion=1\u0026version=v7.5.141 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nstrict-transport-security: max-age=15552000\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a47f76be4ce52efa-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 27341\r\ncache-control: max-age=604800,public\r\netag: \"BE518617148668F73C2B14DB80075355\"\r\nlast-modified: Fri, 25 Sep 2026 04:32:31 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: vlGGFxSGaPc8KxTbgAdTVQ==\r\nx-oss-hash-crc64ecma: 12196033944022095214\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8C8410A9306383230BE51\r\nx-oss-server-time: 21\r\nx-oss-storage-class: Standard\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1740\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":1740,"size_decoded":2411,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"be518617148668f73c2b14db80075355","sha1":"3d4a3eab700ae2c3602d4dfccaea031d8e7fb924","sha256":"67e07a930d256ad8595f137c80aaabb729e276bed2a113385612545d5fe0e3c0","sha512":"c784ce29e791e33669a02f48866bf7dfffdc69a84f740b09db932ecfa39c4e397a8986ca6e9b48abbab0a6d24b572b7a7274bd7dcbab9f86bc55d1ff12d324de","ssdeep":"","tlshash":"98310809e30b9849aca9fe7462b506d26ad75ebb027fc7ab1372b0998454a5078d0c1c","first_seen":"2026-10-09T17:45:43.536436Z","last_seen":"2026-10-09T18:33:14.080434Z","times_seen":4,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/siteadmin/skin/lobby_asset/144-0-1/assets.hash.json?timestamp=1791570704648","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:44.666Z","timestamp":1791570704666,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /siteadmin/skin/lobby_asset/144-0-1/assets.hash.json?timestamp=1791570704648 HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ad852.xyz/\r\nSec-GPC: 1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nConnection: keep-alive\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:44 GMT\r\ncontent-type: application/json\r\ncontent-encoding: br\r\ncf-ray: a47f76c82d002efa-OSL\r\ncf-cache-status: MISS\r\ncache-control: max-age=604800,public\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 02:21:07 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Origin\r\ncontent-md5: RDJ3Y54CFVu2jDgmHdjWIQ==\r\nx-oss-hash-crc64ecma: 3150568755147463299\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC93310108AF53838A331E2\r\nx-oss-server-time: 2\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":283402,"size_decoded":53219,"mime_type":"application/json","magic":"JSON text data","md5":"443277639e02155bb68c38261dd8d621","sha1":"5da3ceb256af3147f1a1029c5efc0e4ad5918d96","sha256":"1f67c9d4741ac25baff04e3fb2535be627328c6598f894705b63f3cc6c9256f4","sha512":"29893576542e4b441b9d4ca89e9d4fc21c48fb4871606001616aa3a1c3003c308217cc53e28e33a502474da97c60d244642d753c98d751c003a91a5c097f3a35","ssdeep":"3072:OqgNsVAA/fHasXdih/XFBZKHNEQ5qkmMLvvGao3TF:bsclXKNBZKHNX5qaLnGaA","tlshash":"a854fc7612d8ec1272dd64f422bbbdd5a9a55f81e7801c41a03bbe21f4d3e448a1f63e","first_seen":"2026-10-09T17:19:18.794634Z","last_seen":"2026-10-09T18:33:14.081267Z","times_seen":6,"resource_available":true,"data":null}},"time_used":253,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":235,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad852.xyz/assets/theme-0/enum.DZ4s6Hb8.js","fqdn":"ad852.xyz","domain":"ad852.xyz","tld":"xyz"},"ip":{"addr":"104.18.24.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ad852.xyz/","date":"2026-10-09T18:31:43.429Z","timestamp":1791570703429,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ad852.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 07:23:17 GMT","end":"Thu, 03 Dec 2026 08:23:12 GMT"},"fingerprint":{"sha1":"43:AE:9B:A7:02:41:BF:BA:1D:B5:45:1C:F4:29:15:BE:9B:F7:D6:66","sha256":"05:2B:85:2A:1A:4E:41:7C:44:BF:9E:AC:C8:D3:80:87:F7:F9:47:3F:4F:EC:16:3D:1F:61:07:27:2E:8D:75:6F"}}},"request":{"raw":"GET /assets/theme-0/enum.DZ4s6Hb8.js HTTP/1.1\r\nHost: ad852.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ad852.xyz/assets/theme-0/GlobalEventListenerIndex.BYsJMIjY.js\r\nCookie: __cf_bm=z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5; web__lobby__persisted__device=%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D; web__lobby__persisted__user=%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"z1a9KlhtVTPW3pFijrlVStqOSEB4.Wv_EQqjXldNrGc-1791570701.6105738-1.0.1.1-aicMa0Fv67HqxGMTaKjSsCJLgtHkkK2yeiqXEuM0Cka.KnV0idLJS1Thp90JVXGNw2iZ9QTLl7QAuesCbueFtWH5c8htPc6FN8T.T8mqKcU_CDvbuHyzIkYV0AqeGSp5"},{"name":"web__lobby__persisted__device","value":"%7B%22uuid%22%3A%228034c51c-91ec-430d-af2a-41881722443b%22%7D"},{"name":"web__lobby__persisted__user","value":"%7B%22userInfos%22%3A%7B%22game_gold%22%3A2000%2C%22account_type%22%3A1%2C%22platfromid%22%3A%22web_lobby_guest_account%22%2C%22mode%22%3A0%2C%22currency%22%3A%22VND%22%7D%7D"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nstrict-transport-security: max-age=15552000\r\nx-oss-storage-class: Standard\r\ndate: Fri, 09 Oct 2026 18:31:43 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-encoding: br\r\ncf-ray: a47f76c06ef02efa-OSL\r\ncf-cache-status: HIT\r\netag: W/\"7DC8363CFC6A05184E3235CD48D3FCBB\"\r\nage: 24672\r\ncache-control: max-age=31622400\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 07 Oct 2026 08:49:02 GMT\r\nserver: cloudflare\r\nvary: Origin\r\ncontent-md5: fcg2PPxqBRhOMjXNSNP8uw==\r\nx-oss-hash-crc64ecma: 2269259784238930174\r\nx-oss-meta-version: v7.5.141\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 6AC8D2AEA05E363636C55584\r\nx-oss-server-time: 3\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":299,"size_decoded":851,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"7dc8363cfc6a05184e3235cd48d3fcbb","sha1":"575b30d834843216571fc7d69f95e524f36fd1b3","sha256":"222e1d08a78dc825ee32e45438686d6824fdafaedac1dd8f079899d582250a0e","sha512":"3f6b01ce008bb7f595c11a1b76d6c79c7802e283060aedc89691f355e2439abc57a32b04737c6465716ebb09d91900e4c595a2ce6d2423415fee832612d5af8f","ssdeep":"","tlshash":"5ee0ec830264ae9cb8444d5adbb8988162e12ce6cfab32de0bd91a6734c1bd44cd8015","first_seen":"2025-12-23T10:54:41.061691Z","last_seen":"2026-10-09T19:17:20.76735Z","times_seen":7922,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"ad852.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}