{"report_id":"83f72599-f84e-4ff6-b44b-a866527f8559","version":6,"status":"done","tags":[],"date":"2026-05-20T08:35:41Z","url":{"schema":"http","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.140","port":0,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"title":"welcome-BET365","dom":{"size":423685,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (50144)","md5":"a757d7745a8b9d1de746059eb5a0ec80","sha1":"f1b25a8ba3fc6f39c3f3fc3bb3d7f27f9b7d7149","sha256":"638b21fa31d37cddb4038e93aba32c25ae8c518576412438df7af92ce59736af","sha512":"c1f1f2d2509f890dfc55ac5d142e5cec3eb26c52b13e243e2e03cca5162d6c2ccaf438d953a1dd73c875708203aba5f0b493dc68f12957ef68aca92829ab477f","ssdeep":"3072:jHiRc/WbcNv+JHEasJTO1lyTMIlPXS1V/:V+hEfTyfIg","tlshash":"8b943bf4435c43f1f40b8b8de8767e6132e230abbfc54548f3ad4ad19bb2a85942d856","dom_hash":"domhashff5cc7c5e627713817dd1172d79ab94d","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.140","port":0,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-24T08:35:41Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"img.esportsdata.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"img.esportsdata.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.f27g.top","ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"domain_registered":"2026-05-13","domain_rank":0,"first_seen":"2026-05-20T08:35:48.091999Z","last_seen":"2026-05-20T08:35:48.091999Z","alert_count":284,"request_count":71,"received_data":6201603,"sent_data":36892,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"GeeTest","description":"GeeTest is a CAPTCHA and bot management provider, protects websites, mobile apps, and APIs from automated bot-driven attacks, like ATO, credential stuffing, web scalping, etc.","website":"https://www.geetest.com","common_platform_enumeration":"","icon":"GeeTest.svg","categories":["Security"]}]},{"fqdn":"photo.365live88.com","ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"domain_registered":"2022-08-16","domain_rank":0,"first_seen":"2025-11-02T03:06:46.95373Z","last_seen":"2026-05-17T09:49:16.211547Z","alert_count":0,"request_count":20,"received_data":1379434,"sent_data":9640,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"static.geetest.com","ip":{"addr":"104.17.5.193","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-03-05","domain_rank":196356,"first_seen":"2015-01-16T07:12:35Z","last_seen":"2026-05-15T23:34:08.923708Z","alert_count":0,"request_count":1,"received_data":21655,"sent_data":412,"comment":"","tags":null,"fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"img.esportsdata.cc","ip":{"addr":"172.67.70.146","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-06-01","domain_rank":0,"first_seen":"2023-07-06T16:47:53Z","last_seen":"2026-05-18T20:29:45.6899Z","alert_count":4,"request_count":2,"received_data":11586,"sent_data":958,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T04:26:00.444422Z","times_seen":235714,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/chunk-svg.1777369843125.1e4dfc16.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"17dc7d24243be411dfc65e6d3bfc3fed","sha1":"040dff237c788f6720e1e7ad8903f103cb86db73","sha256":"4296d5094a19dae430c40d8315056ffcd226eafe5012f293d988d2b631c682e1","sha512":"742a36b45941527965abaaa6e1443e4668e5af5085a1166b561059df61a9f42f0096cbc9f80dd9cd845cefd166d5d84a4e6282eb16100e078d28e6c0305a6a26","ssdeep":"3072:h8nz2uaLZSZvx6Q/sIPrekK+m36Ua94sRZI7gbpF/:h8nz2uasNxpXPrekK+m36UHsE4pF/","tlshash":"bfa4fcb4c190f4edf704ce196e7c9e1c50321688e0a9e9e52da9fe0d9e85d6b241cdec","size":464072,"data":"","first_seen":"2026-04-29T03:41:13.396807Z","last_seen":"2026-07-10T22:25:54.152365Z","times_seen":442,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/13575.1777369843125.cda1d494.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"eda98cc14e8c025a359a009951750a20","sha1":"b54dc08d49209bb6953641b57cead1ec1e92d823","sha256":"636dbf0f9dbb30ed3d15582a38bbc4c1857fd1affbe8be077182666b906e7f3e","sha512":"fc6837e6c1ebb1b97998b81be6fab0614b1d30dd0494527bb2fdcaa139d3d26a16798468a172b13ad982cb3ac0651e22ed1d8af5ff62fc501babf9c04c104659","ssdeep":"1536:X17BBHFeKRKp+3ELSPtj6x2DgJoG7PIDmj9VA+s69JAFdE6WIzl+Ik1+eXMa7a4H:hjHoKRKphCnDgJoec+IDWIzls+7Xr0X7","tlshash":"4a141a84764170b8c396a165322f601ae22f789650dd9c24f3789aa47f7470df26fabc","size":194938,"data":"","first_seen":"2026-04-29T03:41:13.356911Z","last_seen":"2026-06-08T22:37:37.015763Z","times_seen":433,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/8544.1777369843125.875d684f.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"136fc52b262ec03558367f9d050dd488","sha1":"42d2e74acd67477c27524bb4b17399c3c8a5044c","sha256":"7c0850eefec0bebf32593d27d1d85e262ddea0700c9179c4a1396556d6ccf3c2","sha512":"c7c19dcaf0d7f95397efb2d6e96bf11b3e750a26bff4e9bf6a1ed4c53e3b16b75dd5a728e2d2b490b0431acc27ff1849088c26999912f191b672a683ee2b8333","ssdeep":"6144:y/rOTURxxB0Jjytg7DiQPkcsz1aL3p2YO+WidjHrrL:qiJjytgPJPT3p2YpHrrL","tlshash":"bb442c44b291f0b8879b42f7922b4056a17f48a1308cacb4f295ed90be7555c927fbfc","size":261999,"data":"","first_seen":"2026-04-29T03:41:13.358323Z","last_seen":"2026-06-08T22:37:36.998727Z","times_seen":432,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/31098.1777369843125.4108b3dd.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"31b93b7d8dfa0ca7f3f8477f00d0366b","sha1":"734c41538b3d1db2c12b2472b43ed1e86c79251d","sha256":"30c9d4b0f76502c14b849d636bb84d74c4e5caae97b1d650febe724d0f5cf2da","sha512":"dc141065235c7f28f7e4caed203c4d4cbf749bf1c651567bad15cd8225fd297099b4330a2b3d5d810e3a07af90a7e013ed13bd03a45d5018b9d8be708da4b872","ssdeep":"1536:d+0YvC9jlTKAUSseG1SY46DCdlBBo3AgXOG9AsqCfCXsvCfCXsLCfCXsyCfCXsfX:AKK5sY4brG7O3SnLJNpL","tlshash":"d174b6f4c248c6fdea04ce0a7e7d6f2d50723783f2ec56c446aaf8865e92857245c4da","size":352738,"data":"","first_seen":"2026-04-29T03:41:13.322286Z","last_seen":"2026-06-08T22:37:37.042508Z","times_seen":372,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T04:26:00.444422Z","times_seen":235714,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/index-399e2569.1777369843125.70d3d47c.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"6b35d598f9222431824849a2ef5b6359","sha1":"c7409a8c4b4e0d925aabc7be2afbb31941494256","sha256":"b82b7f362bca79155342b54e2494f4086e7181eba033c4b667ff885b2bc33439","sha512":"3fff55c5f39ae811ca094e65168d57fdd6ddeafb608e8209b24ed3587dbdcb4580c09ec8361c1db0557843a26bd10552e9a5a14ad827c876ecccef7036d8e689","ssdeep":"384:EZSANHmDGj4aePlBTSQwf+q0ht1wtzgNA2K88ZdZ11YcpK21p5F3oWf0Af/nBtUM:HnDGcPPlRef+BhtutUHKTZXYeT5FYxA9","tlshash":"0eb2b6e53392bdb4c24f9276f23a68ecc43f9151c34fc4f8d264bd947c98644aa92784","size":23796,"data":"","first_seen":"2026-04-29T03:41:13.403184Z","last_seen":"2026-06-08T22:37:37.025136Z","times_seen":423,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/21954.1777369843125.57c97863.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"0e41dd7729067b884faab37fcd9af417","sha1":"11acbef297a8f924deae47393678fb42c36ece7e","sha256":"9535e9e039663a829c5e5ffb31879f836c96c5e1f58306318b45a64f4a6687ea","sha512":"228b5a935e11e121070f4a6710af8ed39e21fe53a228c99bb4befc116c54f37693f2c9e5b08d202dd5b8375b84c4fbf63918cf013f6af5d4f71464f93524d3c3","ssdeep":"768:QPhaSfmzKrMdvf0eMQ/96loumY1PI1yBK9LudEz+yUy51y9y0yk6Dio+ILqpTeY:/81R6Ipyk6o","tlshash":"a7132088fac2b06dd3eb7330857f505ae66a1dc0668c5438e260d6917e7198dc1fb5f8","size":41968,"data":"","first_seen":"2026-03-18T07:07:19.558046Z","last_seen":"2026-07-16T20:28:12.868078Z","times_seen":453,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T04:25:41.35205Z","times_seen":731151,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T04:25:41.35205Z","times_seen":731151,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"8b733e809fcd514bdf9414ce77e3f5bb","sha1":"53f38e306721e3a00f340b966ac3f7642bebb57e","sha256":"a05c0b1be0d5a6858cd22804367a5d3a2d23e45de4cc9cfea2abd9fc65766b49","sha512":"07dc77674e4408902b7243c9036e85dc45bfa8ccdf839bd0f9aebf8f38209bb773c5c58733083e52f79fc22fb034dd03664c97f2c84d68646a138ab52bdaa6bd","ssdeep":"","tlshash":"0ec022a60b287f14110310230374f3ac5431c029bc15f202321f42018f50b0d0830a80","size":190,"data":"","first_seen":"2026-02-15T23:20:06.598758Z","last_seen":"2026-06-23T09:11:58.932454Z","times_seen":784,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/chunk-init-c0d76f48.1777369843125.2d292e02.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"eb71ab6debf3abe346c8c4d941813d15","sha1":"88116abc111aad2e9e1b1d0974de9d97cd891e0f","sha256":"3dca15bdb644d02cedbfe3adaeed7ff4c47508d664ad1ce6b361dcef7a5423b5","sha512":"eb604132673651b6a0646263fed02220557b65080b323b03513053af5662af520808cd469c00f7ad99ed16fcf9a2ab5374b89477cf8f8a9f8ed89f6a313afd7f","ssdeep":"1536:xTG5pxPvO2lSV822bv0bcbpM/igw/aIwC23QOoKILbjxo4wc0tvB6xVS/J+pKY3O:Mvz/Dp5/92xoKa/x5wc0dB5/J+UU0","tlshash":"6ef31b987392b1b847dba6e152371075b57e1dd73088e8f0c169a6803f31a9cd52afec","size":161198,"data":"","first_seen":"2026-04-29T03:41:13.437512Z","last_seen":"2026-06-08T22:37:37.047095Z","times_seen":434,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/index-a3dad144.1777369843125.66a58dcd.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"aa47bc946b9df160fc4c9d0ccd247727","sha1":"2b81fb3062bb6d32ce5cb43811300ec95a0f3cc1","sha256":"907a77df793605acb0f292d7b450584a9f7cc65e76b8ed19c7ed0b72e3a9f4cf","sha512":"73daf5dd0d9b5f8325bc9fd63618ff31bc76dbcd70b12961aa5d9cdac2b0b570fb832a3815c4cdeb269ed90bd5613e681da42d6b0e668303a7660c6017ee0f83","ssdeep":"6144:DybhFOufhkHLHEY/TtesplVyrYlRlNsmq9DG:+zBuHLHEY/TtesplVyesp96","tlshash":"05742c90f76ce1bd874e55fe7a3290a4902c1b41b0c89e59d29d2944fe6b385feb04bc","size":355104,"data":"","first_seen":"2026-04-29T03:41:13.301567Z","last_seen":"2026-06-08T22:37:37.047635Z","times_seen":414,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"46c37814c8d855f8d26c8922d6a21d09","sha1":"77a8a7d835aacf3d4c325605b153d011418518a8","sha256":"bf3b91fc06aeb59c3f2832583ce2b70b2b8f4dc45df941aef8611949220ddf84","sha512":"24308fb6d5a6b83f2f8a328fde19300d8ab2a8f2d8116ef4cb160275ed664391e3d52794d94de19ab1a0feadab0168bf0a5e86e2066ccad31c2af2bc0a0ffc4d","ssdeep":"","tlshash":"9531e0282eb29531d423617a1f5bf2843235e62f3148ef043f0dc7661f24d6ba6356d5","size":1702,"data":"","first_seen":"2026-02-15T23:20:06.601892Z","last_seen":"2026-06-23T09:11:58.934776Z","times_seen":718,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/chunk-init-1656f0b4.1777369843125.32336986.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"a1aee3b4fdd378acbf851a367f523d6d","sha1":"9b808ee6cd84b9e3969901470ae1c2d1df800ea0","sha256":"a20ad3a83af7751da30c420d96705aa78f39ddbf610789296ce2b47ec3788179","sha512":"71c83f283537df70e91f49c73fe8554e59830f75caf60f372888692946e7c08ca9f13519f082c45ff310ba269151a9a2955fdf6fbc37b68ca4f1e348303725bf","ssdeep":"1536:2twqIPBoVbzfsO9ZuqpiXXIOU6Qgpp6KkB2EnBDsAxdrkm4SgiqvHynjM5TCifM+:2twqhOIK2nCLdyACifMur06/D","tlshash":"30d3ec54b7d0b4b442cf13e6711b2475e3a61ca22058e8f0e31dee647f35689d26faac","size":136038,"data":"","first_seen":"2026-04-29T03:41:13.388607Z","last_seen":"2026-07-10T22:25:54.117178Z","times_seen":442,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/45540.1777369843125.8e1e0acf.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"a0e497c34e367322be5d24c3b27d661c","sha1":"05738c9aad3a5d894b6d49780014a52200ef950d","sha256":"073a44ee1f965bd3739f07604455eb8940250c073f060303550cdd02ba87109b","sha512":"ea91edbfdf72b73e3fddb4a652393cfd4c1be31242b51f7caa28ee35cf3f66eb42bafff62ffacc3a2b89cdee253e84e2d8ec5e5c5bbc9832053bd5c00df77b3e","ssdeep":"6144:JYD4wFsYiSGfKnCKPP6Xm9sm3MCln1OSgpozfEe5a:JYD4wFsYiSAKNH3TY5","tlshash":"6024e894f294f1be075fc1f1d23b501af35b5e6120cc9ca0d296e6942e20b49da77eac","size":229366,"data":"","first_seen":"2026-04-29T03:41:13.329661Z","last_seen":"2026-07-10T22:25:54.148858Z","times_seen":440,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/config/telegram.js?t=1779266115064","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"4ef2154bcfb8399f256c2da15a4cb409","sha1":"e0f8f5578b2e0773ec1d79bb1cec54e1f5d6373d","sha256":"73fa4926373755b52fecfdf3145a0c9953c08af374ea69dda46fe2b3b9ddb022","sha512":"8b64643161386bdefbb7eab04416e78e5e183c50acba7b25b146aa6e733744a326566a01eb7eabb1a0a3f5b87ac8461a7ab3b9ad1c44de37ecea25af09e3eb41","ssdeep":"1536:WK4KZK+Klt3LbbdS4V+vO14KtA9phXTQ+fcZl8LDh7j8d3K+V4WMrnf/NunqxF00:Wj+dgdLbbdSA+1XTQRZ1jSBl","tlshash":"14b31c4c5cf3216285a7b1be8b9f925072759893304def203c4d9ba45f98d3c53eaad8","size":116886,"data":"","first_seen":"2025-05-31T08:16:48.368096Z","last_seen":"2026-07-23T00:35:01.996394Z","times_seen":2252,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T04:26:00.444422Z","times_seen":235714,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T04:26:00.444422Z","times_seen":235714,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T04:25:41.35205Z","times_seen":731151,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T04:26:00.444422Z","times_seen":235714,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T04:26:00.444422Z","times_seen":235714,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T04:26:00.444422Z","times_seen":235714,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T04:25:41.35205Z","times_seen":731151,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/configPage.js?v=4/28/2026,%2017:55:48","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e6aa74bb352ef198ba3e1c9a4b01b014","sha1":"2ea8bd6b5045475a36432f7665a129728e822d9e","sha256":"73828e873c0b6e847b37d78941ca436247471dfc90a12f743964f869f75abd5c","sha512":"2faaf24fdf1e4da637af8e9f82d1778bf061b00752dfca0c8f73432ba236a7b69410a7ad2a73727bc83e6cd631fd6555c3cc0d9d3a5d8a7f81818dd66566011f","ssdeep":"","tlshash":"be117aaf57444dffcf1d7e00a08b0a5ea8bc61d261889d4da8e9cf29e1c99002378978","size":949,"data":"","first_seen":"2025-09-04T00:49:32.949926Z","last_seen":"2026-07-23T00:35:02.005073Z","times_seen":2675,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"5281f83487c386b7836c0a61310eee71","sha1":"b69aa5eb7750fa2d18540f7a8f28dab10d4b2631","sha256":"5c4f27503b020517fa4d8a831ce6ea7c9b425cbda5603e8e6ce9119aa406cea4","sha512":"4d7ca7094121bc51fd7e24de7f2b9218624f1c7c2b5949e25ad2be53f4b1babc0ac6265a9e20acd2d51fec4e844baebdd7d1aa300a7f52f3b360bf36a8979ca2","ssdeep":"","tlshash":"5c8004047d5d50540000503014740c0d5c133c57403f0314340dcc013fd5c401447441","size":36,"data":"","first_seen":"2025-03-03T20:54:16.013922Z","last_seen":"2026-06-23T09:11:58.933356Z","times_seen":2969,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"49bea4e1330b9d3f17c1c143ce23cb3e","sha1":"3a8874032b5979ba1fadfe141c0ebf28baa32fc7","sha256":"07f2a8f457d336c5a0cb2267f53a4be2676d30140da225305675f4b3957eb68c","sha512":"9cf0ea9cec23fb496db40aae14fe1df1a305d4a847e23a724645052c742a5995250f9d7f3f0584d3226aa17c6af04201f72cf7fca01bf4c788df2ab4cf488ad0","ssdeep":"","tlshash":"b580040cdc5544570000501014500cc57c170417453f435f750c04451fd34700007c40","size":36,"data":"","first_seen":"2023-03-08T15:23:49Z","last_seen":"2026-06-23T09:11:58.930085Z","times_seen":3036,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T04:26:00.444422Z","times_seen":235714,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/chunk-common.1777369843125.4adb46f5.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"fd30be8efc49091ace6b6cba1d19f85e","sha1":"dcb13a103a96a9346297f81fa22518579b7694b7","sha256":"5aeec070f92421551adae5477625ba84ca8f44c1fc9c181efb18e241c0179776","sha512":"42df127ca6094903dba8af9a2166ce68c1386c59b2d7e48071f6c33ffe1c0e81b2a3673efd413142e6699be9719f79f6172c9f5aaea6fd8d45518f8d09aef6df","ssdeep":"1536:bvBBzbgGcdWUa2UTf6oryXHuLmbErF/G7D1dMI59HTsY5kN/voVGAClVbGD3tFkK:bvBBfRTf6yjFetHTsY5s/voVGAcgD3t","tlshash":"0ff3e8c5b3a0f07e9a1ed53779331499b12f758278c87c60f1a1ade67f1a704a436ca8","size":160123,"data":"","first_seen":"2026-04-29T03:41:13.32854Z","last_seen":"2026-06-08T22:37:37.031571Z","times_seen":432,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T04:25:41.35205Z","times_seen":731151,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T04:26:00.444422Z","times_seen":235714,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"0ce02dcf11f1634908b4afc4e1bcc632","sha1":"f8911bd806c6ddd3daab7f3eba10081d7af38f74","sha256":"46c7be5f428c72dac25551dbcf74f494989a3cf773ff04f9e115e15ad7dc2893","sha512":"c4f56e0a143f096a106956d55a60f07405a2418d8eec9917a027d0ede74e7119884002051c598445519ff87ad5526d035c221bbcfc65ce817539e6162f157ac3","ssdeep":"","tlshash":"1901735d483748107b2225bd537f5045f1a2516f9e87cc103c1e5b00eff48a72591bd9","size":750,"data":"","first_seen":"2025-08-16T16:35:14.594808Z","last_seen":"2026-06-23T09:11:58.933867Z","times_seen":2561,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/config/initGeetest4.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"87855e19802d75b55afa7bcf3af515c1","sha1":"4af373375728a98d623f2299a68a91e150f2672e","sha256":"9ec8a5ef8c8ffe369dd1a5c4730dce6570c0d90955798c0be4ac04ef1c8f4baa","sha512":"3baa6d9e916abfb3d38b7ebb9372c5987e8f10534bb978383751c0094f8f5a3e764f9b8e44a73d9d4871cbaeca7e1939f0ffaf9499af5c4a71f64c3588167d85","ssdeep":"192:23aP8Ha0D+Nu5dq+EvNiqc4K25MB5VYaiQwSL4SScQVy8QRHIsGiz0iX9rES6Myy:2fe61w1iXKb2sMGUI+KQTwwHlB","tlshash":"00621d0d68f764534553b4388b9fb014b5388a53042cde41be9ce354afa843d9bbabdc","size":14975,"data":"","first_seen":"2026-02-16T20:32:40.162764Z","last_seen":"2026-07-23T00:35:01.901693Z","times_seen":1816,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/83749.1777369843125.7bad5eaf.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"d036e00b216c6886ee096346a4aa7d9c","sha1":"8b6cdea36134802a22d5ab4009f69036ef63dd40","sha256":"444030e40d34fa938300dd2cc7b218f3fe47f6a865afd399ea5c1cd5dddae433","sha512":"bab25e53e886cf51cb47125cbb1582da65677fbafa057cc9f770b7a7889ea3bc8a59f60574c16404fba3d974b876f655642a1708a9beedb20b9b47d1b5ba68b0","ssdeep":"1536:lcK/KnqHB3vmeLUw/A6+GplTwsCNgOX8JwTl0sI5pQiVFFsdt+HmQ:rB3vzowo6XTIgOXawTl0sgQi2tkr","tlshash":"6a93e7c4b5f4f5f9279ec5a297364478b02127c5a0c8ace0d2e96e147f1ab92b0758fc","size":91167,"data":"","first_seen":"2026-04-29T03:41:13.335994Z","last_seen":"2026-06-08T22:37:36.995277Z","times_seen":394,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T04:25:41.35205Z","times_seen":731151,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"3d7029dce5d85a5da627234c9d9dec9a","sha1":"24fb150f1cc1df574ff3e2cafbaa0da15372f707","sha256":"b0ff82425661555aef2b423d91265672271ef5854e3e7b815e12f9b363fd34d9","sha512":"db505fbc49659020a42eb8e2064c9aa0aaebb166f309faf0245432a9a5ceb1d921a6cd040d445c99d38108057d3c9aa84556a5b47433b7401ae410239a28202f","ssdeep":"","tlshash":"f741027d826345a51973346a1f9e734836f340b31149e9113e5c8a802fa9a5f83b7bfa","size":2333,"data":"","first_seen":"2026-04-05T08:11:55.739213Z","last_seen":"2026-06-23T09:11:58.937113Z","times_seen":579,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/22872.1777369843125.dbee35b5.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e916996ddfb5f1c6e2f6cbf5a87b5565","sha1":"7b3812a3cf8758cd6ce5a442d899048e27d1790b","sha256":"a50d9c1f28c0948f0d468428aec46c5d300a84fb71ce27e6790ca8e0f40a955a","sha512":"c5fe69584b305477ce1b4bb12d6a9b4ce2c73ddeb07c133f14d7ec7782b743769b4f48824f326be1ea00c53835dda635e0011b055c6af3ad0876a0344d6be794","ssdeep":"3072:PHW7tB4Vgj5tNlxyUYwOW1YegxYffj7TEOiG1Zl+DJVkzEcx1nKs:PHW7tBwgttXxyUYwOW5ffjAG1T+DJVkV","tlshash":"76f30bd4f2c070f6475f85f2a2275065b26f4d92318c98b0e15ba6547f21b48c7abeec","size":158144,"data":"","first_seen":"2026-04-29T03:41:13.30041Z","last_seen":"2026-06-08T22:37:37.007921Z","times_seen":423,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T04:26:00.444422Z","times_seen":235714,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/35142.1777369843125.e8dc7ade.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"a5d97dbf77d44812ad4ab30e375fb143","sha1":"6bcf1ac84a9018203641f99e45abae922aef3e4c","sha256":"ca2b371b1bcef9e7641c24d421d68c7a3cef405f36a13597d724987a369a2727","sha512":"56bd2311e73f8ed688d893ac0c7d29d02bcda91e939a50f8cfc9bbe4435125c878b58ef47519618ca42aad8393b248455b87940c32121235c5850777aeac7b6d","ssdeep":"6144:xfhhkpltRm4iyveBHlBfb0wv1e7Ancbt83i2UfIL5LoSltLFe/fwwutUcAct37/k:xfhhkplTm4iyv0HlBfb0wv1aAncbt83s","tlshash":"26743c84b690b17483af86fb72169194d25e0e9460ccace4f27e6e40bf11746f87b5ec","size":341259,"data":"","first_seen":"2026-04-29T03:41:13.452388Z","last_seen":"2026-06-08T22:37:36.98211Z","times_seen":396,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.geetest.com/g5/gd.js","fqdn":"static.geetest.com","domain":"geetest.com","tld":"com"},"ip":{"addr":"104.17.5.193","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7d7af3f3975e0fb657b71508b79515f9","sha1":"b36988028196a947b1d67af0856a79e6cf054283","sha256":"41cadd609d64b1958d25afc39e73148bf669fd94f48e848dd47494e7de5762b7","sha512":"ed69806d7f263fec8f66cccf0de8757df3b17cad5629c242e1da0d668830870d42951b8a05cb6780ecf8034800313d02531393745209a5aa3e00ac5d936e1bed","ssdeep":"384:oGm+XLBnDztmdGnnsQn4DgIzHilQVdlsGxCnXdPVcVf:dm+7B6gUKMrxCtCd","tlshash":"5d92204e6cf5a0934a43b078c9af6114b538da53041c9d597d8ce3a4ef684389bbafdc","size":21040,"data":"","first_seen":"2026-04-05T08:11:55.721652Z","last_seen":"2026-07-22T14:17:04.102159Z","times_seen":599,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T04:26:00.444422Z","times_seen":235714,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T04:25:41.35205Z","times_seen":731151,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T04:25:41.35205Z","times_seen":731151,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T04:25:41.35205Z","times_seen":731151,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T04:26:00.444422Z","times_seen":235714,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T04:26:00.444422Z","times_seen":235714,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/theme.config.96698fb2.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"6a9a87f3e8804b6c2e87c2ef64cb06ac","sha1":"b57b77abc2f2694ee5b5404a08100b3bdbae1dbb","sha256":"1597153bb2084ffdd78db4687cd9efcd0d7d54f7f460c9b717988ff3dc4f640c","sha512":"5d9bbb05a39e07f2ccf8ac572dcc12d0ae5af13998abb2a6167619b1774272761b562cbbd40b287c404261553e88a7c872e1cfd2943678f59422161d10cee15a","ssdeep":"1536:D2JREobpmtlIRM4Sb2mcTa2mnzyJog9CcHWhM:qYtlGu1Jnz45Hl","tlshash":"23b3bb7ae20c963a6177acbfb46de111c12e9c0cab1d5fdef03d60a25710669c831de9","size":108069,"data":"","first_seen":"2026-04-29T03:41:13.38605Z","last_seen":"2026-06-08T22:37:37.050222Z","times_seen":434,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T04:26:00.444422Z","times_seen":235714,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"3d053d2da6a5968d7b648d3f7360092a","sha1":"32ae5713edeb00288a3f8f3c02462a5d0ca9dbb3","sha256":"8896d194e4c39e87f52924073dd2d56b4aaab46fc9f7c56a57534545eef1d7f3","sha512":"01f9b63cd24ab6e0e097637341b78cda657192f98e37a39f0f75548f8fe0180418a86594df76858aee7d514282ac4dfb8263e1729ff325035897b841d09206a3","ssdeep":"","tlshash":"82f0a00e0ee548131963707a4c0f9201203b2513414eea08bffe9bb24f92a688a679cc","size":550,"data":"","first_seen":"2025-03-03T20:54:16.018132Z","last_seen":"2026-06-23T09:11:58.931662Z","times_seen":3033,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T04:25:41.35205Z","times_seen":731151,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T04:25:41.35205Z","times_seen":731151,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/home.1777369843125.1e63fe95.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"ac7180fee301b4b62de750803a778412","sha1":"b70eb6223cbd147c8dc23df4d073e9dc641927d5","sha256":"25b167f413e31989cc5856e80f67902b0e84efed7087cea17ec1b5b0dcda5b68","sha512":"4fe2d812d406c786a2204a4f4b370217f4cccb1bf61cbea821e648667325ad32057d1aa30504952de28142b1f4fa0c523f55298834cb567631cc2b7cd37355b6","ssdeep":"3072:f+YNGVSIMctwiYJBuopQuFdBlGLuJuhxffj7TEOiGRlp:f+YNGVSIMctwi+PjFwzffjAGHp","tlshash":"b5140880b5f0e275576fd2b7d7371024b2271686d0ccac60e1f66b187e28796b236db8","size":193619,"data":"","first_seen":"2026-04-29T03:41:13.306134Z","last_seen":"2026-06-08T22:37:37.025672Z","times_seen":419,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T04:25:41.35205Z","times_seen":731151,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"25ba01da3f0b1b471747da4637862cd0","sha1":"0c5b0ce449b041467ab3bf825d2cb6c5dc9c8250","sha256":"5f9229d7d1276d1475836391ce453b7432244854be7368ae4c4c590f22789af0","sha512":"58d82418709bd36179a89dd6af167368c35512e8abc68ead43e9be0e5c5fd5027d83289b2ee30e6a211239b4d67790af51039cba61a54b4184e556741437c4a4","ssdeep":"192:K2wqx5Cvtib5XOQRzlaECoXZTAoV51nsPhwzvBa/id3+36a/E/97g6I52MdobsIc:K2VwiYwJvSoVXsp+pa/iZcVk97g6nMu6","tlshash":"8e323b69a5b71bba25673036277f301889b080630319fd947c0ff61e4fa5436629bbe3","size":11906,"data":"","first_seen":"2025-11-05T12:10:48.37972Z","last_seen":"2026-06-07T02:49:57.833516Z","times_seen":1842,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T04:26:00.444422Z","times_seen":235714,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/home","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-23T04:47:50.278176Z","times_seen":89898,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"ba4d957ec99a023d40fedffe8f2c9132","sha1":"32e9e162bad0ea93fde3f137877e95bbbb574327","sha256":"24e8b158f0130e4778f80107b4c038c9edda27db68dd815e66221cc1fb5837b0","sha512":"d0e45e79632f3ec13d043d91c87ef458d1ded7256a3aebe641b09e205ccd00b863424342238a41b73fd7173eaf8a260640fb3110c8a48422ef03050b691d5e2c","ssdeep":"","tlshash":"0311c05a59d18132665b303735bd43887724a013d184df413dcc99557f98da5cabf6c4","size":934,"data":"","first_seen":"2025-09-26T05:04:14.419402Z","last_seen":"2026-06-23T09:11:58.936615Z","times_seen":1988,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T04:25:41.35205Z","times_seen":731151,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T04:25:41.35205Z","times_seen":731151,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T04:26:00.444422Z","times_seen":235714,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/7653.1777369843125.5eafcc69.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"4849391ecd3ae7038c8eca5da5af6cd4","sha1":"6316de5585ce9c3c90e92da7f445df0f1eb06f39","sha256":"7ace68dcf17129b57d79ff5a5ce030178b60d463fa0b0d1027ff5a62981ae2ef","sha512":"04bf30f23c9fc4ee7df1d106f541932dec50cf5794d313087378b16ed5430d29f75a5891abf4e84657525774f2ee231ac62d9e7640000390ee29a08bf23fbae4","ssdeep":"","tlshash":"47310e98b6a171b243af5af98f3f168bf16794c064edb094d096e2e07cb420c4937d29","size":1501,"data":"","first_seen":"2026-03-20T12:57:26.686565Z","last_seen":"2026-06-08T22:37:37.040561Z","times_seen":517,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T04:26:00.444422Z","times_seen":235714,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T04:25:41.35205Z","times_seen":731151,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T04:25:41.35205Z","times_seen":731151,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T04:26:00.444422Z","times_seen":235714,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T04:25:41.35205Z","times_seen":731151,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/65246.1777369843125.8333614a.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"4f72169b9753bbfd046b32e8a9c4c9d8","sha1":"76310a9e002235a02b1842b0ff3985e2bd53ef46","sha256":"26b88e6905d829b63d80a3ce48041e1fd4fe98923072fb1d19b371d117e41045","sha512":"05d8f29fd1ac787d4f27a2d8ee901437e310e0ca663822c6270d05c1de8d33a024e312797a984083b277aa054cde3c5995340a26c25bac74fa6c11b339bcfc3a","ssdeep":"1536:j2+iDvYvNjx4Uyao0L8oDNzAuMMsTAQ0mqt2pXYzA4dANVQ:q+iDYvPo0L8oZzAuMMsTA7mqt9zA4dAQ","tlshash":"de73a501f78272384fa7e290220f2026e16e191505ac5bd8f179ffb93ef0954aa7d7b4","size":73494,"data":"","first_seen":"2025-12-17T20:52:09.055572Z","last_seen":"2026-07-13T05:08:27.627172Z","times_seen":1261,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T04:25:41.35205Z","times_seen":731151,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"8358e39b9d8a646712cc1fdb0f8b2d3b","sha1":"5467bb3366de35f0e9de85bdae870f28562330c7","sha256":"79fc7b6a0a011af3df9ca3266ffa99ab96b07cba60c02936f02aec722b42568d","sha512":"561db76b834be6b3fbbdd7a23daf3f094d0a9221d95397c9478984eb23e95d993c7282e9756100b761e43a811c775627a0ddd94c7486c0f9a56030b1eaed9944","ssdeep":"","tlshash":"4ba002932f5c844111122895c461b58da5a0d545fd9aac1821a4541a92307980811914","size":59,"data":"","first_seen":"2026-05-20T08:35:52.676933Z","last_seen":"2026-05-20T08:35:52.676933Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"www.f27g.top/ecb/8f83064249b06e0660afdb30b60772fdcdfbb3036fb467600d10b16d76dc640e","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:24.617Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /ecb/8f83064249b06e0660afdb30b60772fdcdfbb3036fb467600d10b16d76dc640e HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://www.f27g.top\r\nXign: NqPlnLp8Ke4MuzmbL3cuz7C/PQUoz844A5pCHOaXptLmNm1iW4enb+0IkjYWyw5drGwh5M/hotzlXLAF0V9SZZd4DZGAaaQP6JmmMJ66xNQw3tN5VWPi0qaMWhvwDY1wcQPNsjx8hmaBCGMoiHiVIxErUIl7KlpUFSCuCiG5ODI=\r\ntimestamp: 1779266124594\r\nsign: 7t281u174l56d137\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: zM66WbX6JffCzAPYKHD3Gxnmh7JPTEYH\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:25 GMT\r\ncontent-type: application/json\r\nexpires: Wed, 20 May 2026 08:45:24 GMT\r\ncache-control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nx-xss-protection: 1; mode=block\r\npragma: public\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=63072000; includeSubdomains; preload\r\naccess-control-allow-origin: *\r\nx-custom-check: true, true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266125=GYVCFswnvyg6HUDSML+socExrp5UkAsWNubxuJgkNJQuyrepjSJnquBEXK2tbNomTUMCEmx2bz/Zx81xexnn2501I5gu8oHvfpeTU+hwKZFg1eq7QRbu98y5EL0eF6/cm5BVPfzYlzamy2ubYGl01c2U3Au75r8nzF/ZL2oWQOUGxyrLv0uiwPId12KQ41yf\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44867bf9b8ed\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3856,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"1a08e369f4100aa24609367e91aa212e","sha1":"abfb5f04f7d8d6931438c39ff46cfc9567f53ddc","sha256":"c521d33891aa0a15ac5f5c9261a22d4b52049b5d341839f39e6f1eff8f97d041","sha512":"f1250b8bb3e3fb7e6fc2603d2cb4e53b8e37754f8e8f32aabdb7a29c71377d5715d4de963d156582cc7f113b2d5529ab7a9b865b6f70c5350354e02313f522fe","ssdeep":"96:eOG3iMFIobip4mzPeGLtCGBeHHY6vL+9036RnxhQ4h9Y2y2Ju5XPqF:VL0bXYN4eeYG367hQ4h9YEM+","tlshash":"e6c18e4da3b0738417fe21e3b1b74d948b509b39b3a3f608cb7c8287c566654909d1f5","first_seen":"2026-05-20T08:35:52.481482Z","last_seen":"2026-05-20T08:35:52.481482Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3021,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3021,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_96811f47-5a2c-446d-a8ca-696df160de09.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.198Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_96811f47-5a2c-446d-a8ca-696df160de09.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:32 GMT\r\ncontent-type: image/webp\r\ncontent-length: 46184\r\netag: \"c0ef8343c60fc9c02bde9fb0823e1ef6\"\r\nlast-modified: Sat, 06 Dec 2025 06:26:38 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kV84QgWEtG3C3yanW4AGOWS%2BXpR1QUTZxvFDFFCMC42flG8J5oopViD6VCQ42DXNOJjwBfKUUrinnQw1GTkdSUU0WTAYqPZEzf5%2FIBSFo4v056jDgbT5J4pn3nmU0q8Dim8Xa7tR%2B6sG8XcqfR8vCII%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 76252\r\ncf-cache-status: HIT\r\ncf-ray: 9fe2bc92bae602cc-HKG\r\ncache-control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\nserver: Nginx\r\nl-safe: 1779266132=N/QnbzZ2AZFVQCEm7JFlxb/Bt7QEyfiTmWOO5avUYGYcydOyUTUE3M+0/CnQju09ro3iPnqv37qegrHX9VflpfsX9bMR5/oKM4OsbdPf6EbSiiSnruQUqfEsDB+h69ibi1EJhuc7KosgEraRD3RBO/XcIUBLNdjiD+/Y2KNympoAi1Od8cSlPIPJAvj7ymRQ\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0919e44869a0fc99c\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":46184,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c0ef8343c60fc9c02bde9fb0823e1ef6","sha1":"3a5e1c7a0e16e4df0a591749d4a8a1d01b381277","sha256":"1042e3632605c2e70706209ece9e2b341695afc4e57d5512818e458078c55040","sha512":"950b59f182c21e7d78ac56d6c1cb0f22a295ede2a579f9513c69166b2c227d5ebc4a8e16d5528f530488d5c36d8b88d9c29bb251820627d596156f90445a90f6","ssdeep":"768:fs+YB8yjw8RTKT4uT+QCkrgAEnaCA/RE4qehyRcQsII+IYJxT8sJk2RaA2b:fsDjxR+LT+vkrgAZ/R1hyqQ5IeJxTbR0","tlshash":"182302b81bd5a7b7cec731f89ce2890a4d17c2d5e183b0667d686bd6aa114c1f4c0ed1","first_seen":"2026-04-24T23:10:16.848247Z","last_seen":"2026-07-23T00:35:02.061197Z","times_seen":964,"resource_available":false,"data":null}},"time_used":4644,"timings":{"blocked":-1,"dns":0,"connect":0,"send":2810,"wait":937,"receive":897,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/0c5d93595cc14e05bb121c016fe09e38?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.310Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/0c5d93595cc14e05bb121c016fe09e38?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:29 GMT\r\ncontent-type: image/png\r\ncontent-length: 181035\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 5639\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"0c5d93595cc14e05bb121c016fe09e38\"; filename*=utf-8''0c5d93595cc14e05bb121c016fe09e38\r\ncontent-md5: y87kZfJYUy4AVwv1usvHAA==\r\ncontent-transfer-encoding: binary\r\netag: \"FtM9DhJOSoCLbdy9LcxYqCDBMu8I\"\r\nlast-modified: Wed, 13 May 2026 18:31:25 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: SCxhuKZNR\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 3pgAAACeF0j9M7EY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":181035,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 420 x 420, 8-bit/color RGBA, non-interlaced","md5":"cbcee465f258532e00570bf5bacbc700","sha1":"d33d0e124e4a808b6ddcbd2dcc58a820c132ef08","sha256":"415ae3eab8ec4f26633e7d7e945025f15a5eb2b91a785c4ddec2c5471b046792","sha512":"2740dbb9a812e3a25b6f20987cf77cd5c51ab720e4ed321938a5e4c3b96d301d7fbb55f03e7a8c5c27695a37ccd8a821708e80c8df9b88d2841078cc14460073","ssdeep":"3072:EfsZCHc78X45EA1V4Ep4SmuTSS/V1eYbgeM/S8E3F0msYTObX2qRwTOhKrfRgUVQ:EfN8X5QqWuTSSresgeM/SRd1IXLwOcGL","tlshash":"ae0423974ff3e7e0c917ce0517cd9663004ab3bb268425430b087797dca9adac6e8766","first_seen":"2026-05-20T07:27:33.699335Z","last_seen":"2026-05-20T08:35:52.490609Z","times_seen":6,"resource_available":false,"data":null}},"time_used":2620,"timings":{"blocked":545,"dns":14,"connect":239,"send":0,"wait":261,"receive":1278,"ssl":277},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/bb8913120a64476088d05294b51efc1e?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.365Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/bb8913120a64476088d05294b51efc1e?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:29 GMT\r\ncontent-type: image/png\r\ncontent-length: 41088\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 2784\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"bb8913120a64476088d05294b51efc1e\"; filename*=utf-8''bb8913120a64476088d05294b51efc1e\r\ncontent-md5: AvWjSok1joBhBDVA82qUkw==\r\ncontent-transfer-encoding: binary\r\netag: \"FsFF0rVnByJRQEx_E6tRkJyNqrJs\"\r\nlast-modified: Wed, 13 May 2026 18:31:30 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: qbSgEQPew\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: TekAAADknvaVNrEY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41088,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 245 x 247, 8-bit/color RGBA, non-interlaced","md5":"02f5a34a89358e8061043540f36a9493","sha1":"c145d2b567072251404c7f13ab51909c8daab26c","sha256":"3ff325c8a0c5bdce8dddc89bf0e58c9819025afb5771dbddeac46b2ed7406e67","sha512":"cc3ca7bad4c633b8f5a062624e5a4d034ef370d4272c3382e5da82b4fcb99158c904adb0072274842e1bb6b017438350bdd201b50960020019b4886aae8cf9e3","ssdeep":"768:R467ZvPX2pO1ZveWtJPrTgXoilC8BIKAaR8MmNn/BJTxvJWz82PeoMX:+qPXIO1Z2EJIXoilNIFu8MmXJTxh+MX","tlshash":"8c03f24e58954c2a7943a83714fc1fe372f201897011fedcc4bd6f6496893e65db87a8","first_seen":"2026-05-20T07:57:57.029438Z","last_seen":"2026-05-25T12:20:50.128896Z","times_seen":9,"resource_available":false,"data":null}},"time_used":1952,"timings":{"blocked":490,"dns":0,"connect":0,"send":0,"wait":1026,"receive":436,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/kc523-1/sponsor/sponsor.json?1777369782162","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.616Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor.json?1777369782162 HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: application/json\r\ncontent-length: 646\r\nlast-modified: Sun, 24 Aug 2025 06:03:49 GMT\r\netag: \"68aaab45-286\"\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866c7fb8b4\r\nx-cache-status: BYPASS\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":646,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"10d2161de8cf99c474812f4c43645a26","sha1":"71884ef7281cdcb5084088f16d4550ce8790e634","sha256":"bb02fd7438bb49dd4decb6f76a71f11e93355332fd9f965d6f9f13bb8175aeca","sha512":"bf0fd1232309fcc5582d5c42644e1c7b4b8d235b1066e988ff55e0dd94a956f89742401f00c2d904359041c8e0c2bac8e9316252fab60db5eb0a3b4c935172f0","ssdeep":"","tlshash":"d8f0f44ad8b25b93211fb57c58cd050470294a8f0eccaac4baac987c4f598ddd1e839e","first_seen":"2023-06-16T04:51:50Z","last_seen":"2026-07-23T00:35:01.929213Z","times_seen":2646,"resource_available":false,"data":null}},"time_used":3404,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2810,"receive":594,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/img/ESPORT.4f4b51d4.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.218Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /img/ESPORT.4f4b51d4.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-101b0\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266132=N/QnbzZ2AZFVQCEm7JFlxb/Bt7QEyfiTmWOO5avUYGYcydOyUTUE3M+0/CnQju09ro3iPnqv37qegrHX9VflpfsX9bMR5/oKM4OsbdPf6EbSiiSnruQUqfEsDB+h69ibi1EJhuc7KosgEraRD3RBO/XcIUBLNdjiD+/Y2KNympoAi1Od8cSlPIPJAvj7ymRQ\r\nage: 76249\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0919e448698e4c992\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65968,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"29610094acb703084f79c42c17547a7c","sha1":"3c824ba387e36bcce1a5f1d0d14b513fb278db9d","sha256":"8c3dc9ee49224eff4a37ec488ff0a413f3150ec7a62640a466a802750a573146","sha512":"db986acc62bb0d35583a1c298b468e1fa7869269c738eadc82b944b1a8f9b2c0723087db8a065d60495938e834337e72e3c438089d1d02ff90f4983e0d6461fb","ssdeep":"1536:ObUUUNbT8bJcHe4DyC8KLT/KKeRfm4AH7XAlzS7M2Z:rbgNcHwE/eshbE/2Z","tlshash":"b25302e1df60cb022efe65ca89acf12ae204a0a61476453f7a231d6f3744016af973c4","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-23T00:35:02.041889Z","times_seen":2239,"resource_available":false,"data":null}},"time_used":4971,"timings":{"blocked":1858,"dns":1,"connect":299,"send":2776,"wait":336,"receive":-1,"ssl":611},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"static.geetest.com/g5/gd.js","fqdn":"static.geetest.com","domain":"geetest.com","tld":"com"},"ip":{"addr":"104.17.5.193","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:15.107Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.geetest.com","organization":"Wuhan Jiyi Network Technology Co., Ltd."},"issuer":{"commonName":"GeoTrust G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Fri, 19 Dec 2025 00:00:00 GMT","end":"Fri, 18 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"CA:8B:31:34:03:03:4F:25:DE:AF:F1:76:9E:25:19:08:18:0C:04:EA","sha256":"F3:25:0F:0B:68:0B:B5:E2:F6:2A:F2:FE:E9:AA:10:6C:61:1C:7D:A6:FA:3F:D9:45:0F:E6:58:6D:71:F9:2E:2E"}}},"request":{"raw":"GET /g5/gd.js HTTP/1.1\r\nHost: static.geetest.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:15 GMT\r\ncontent-type: application/javascript\r\ncf-ray: 9fea01c3aaba8deb-OSL\r\ncf-cache-status: HIT\r\nage: 543655\r\ncache-control: public, max-age=86400\r\ncontent-encoding: gzip\r\netag: \"7D7AF3F3975E0FB657B71508B79515F9\"\r\nexpires: Thu, 21 May 2026 08:35:15 GMT\r\nlast-modified: Mon, 30 Mar 2026 13:35:27 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\ncontent-md5: fXrz85deD7ZXtxUIt5UV+Q==\r\nx-oss-hash-crc64ecma: 275051795077788302\r\nx-oss-object-type: Normal\r\nx-oss-request-id: 69CA7DA1318BA43434E50547\r\nx-oss-server-time: 8\r\nx-oss-storage-class: Standard\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21040,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"7d7af3f3975e0fb657b71508b79515f9","sha1":"b36988028196a947b1d67af0856a79e6cf054283","sha256":"41cadd609d64b1958d25afc39e73148bf669fd94f48e848dd47494e7de5762b7","sha512":"ed69806d7f263fec8f66cccf0de8757df3b17cad5629c242e1da0d668830870d42951b8a05cb6780ecf8034800313d02531393745209a5aa3e00ac5d936e1bed","ssdeep":"384:oGm+XLBnDztmdGnnsQn4DgIzHilQVdlsGxCnXdPVcVf:dm+7B6gUKMrxCtCd","tlshash":"5d92204e6cf5a0934a43b078c9af6114b538da53041c9d597d8ce3a4ef684389bbafdc","first_seen":"2026-04-05T08:11:55.721652Z","last_seen":"2026-07-22T14:17:04.102159Z","times_seen":599,"resource_available":true,"data":null}},"time_used":128,"timings":{"blocked":43,"dns":53,"connect":1,"send":0,"wait":22,"receive":0,"ssl":7},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/config/telegram.js?t=1779266115064","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:15.134Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /config/telegram.js?t=1779266115064 HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:49 GMT\r\netag: W/\"69f08425-1c896\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266115=ud1RxWc4o642H/BkKCo6Aou8uBCszXJBX4YrRXnJoMGOZtO23U3mgpmEy8o4nhZut8tjleBzMvjD+6HY6BUfJZm/WqWxYMkqhgon6GBBbYCSo/Q25DkpOG18Kl2L1Fnz20dy/spCuS0SSJwM7pW/ZEK78glK4hpCd9hiziv1JQ87UreukqHKUYa9oGbrN5hn\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e448657e8b88c\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":116886,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (483)","md5":"4ef2154bcfb8399f256c2da15a4cb409","sha1":"e0f8f5578b2e0773ec1d79bb1cec54e1f5d6373d","sha256":"73fa4926373755b52fecfdf3145a0c9953c08af374ea69dda46fe2b3b9ddb022","sha512":"8b64643161386bdefbb7eab04416e78e5e183c50acba7b25b146aa6e733744a326566a01eb7eabb1a0a3f5b87ac8461a7ab3b9ad1c44de37ecea25af09e3eb41","ssdeep":"1536:WK4KZK+Klt3LbbdS4V+vO14KtA9phXTQ+fcZl8LDh7j8d3K+V4WMrnf/NunqxF00:Wj+dgdLbbdSA+1XTQRZ1jSBl","tlshash":"14b31c4c5cf3216285a7b1be8b9f925072759893304def203c4d9ba45f98d3c53eaad8","first_seen":"2025-05-31T08:16:48.368096Z","last_seen":"2026-07-23T00:35:01.996394Z","times_seen":2252,"resource_available":true,"data":null}},"time_used":1622,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1622,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/img/bj3.a7dbd558.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.665Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /img/bj3.a7dbd558.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.f27g.top/css/home.1777369843125.0fc9d8d4.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-16cb\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nage: 76242\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866c84b8be\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5835,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1003 x 171, 8-bit/color RGBA, non-interlaced","md5":"b79234bcd23ce7e063481b3605bcdd45","sha1":"eace4c48cc352cfb10fb6fcffed50748f18aa78d","sha256":"2dbca2ee9a515b178cb6a5ce670a5dafa30941ad8c753fa3e94642f8dacca13d","sha512":"40fa685181391f1ca805440f53683045d1fbd5c0f36cf471f53641c6f289481f42fefc4d1f2b2fdfe8a20d7488ef0537f10352492e46af76770b49fe8876def7","ssdeep":"96:brOIaX7VK+RUSrZ3rnZ1L++y+hsVoK4CBVVikox3n0muoE7Nqh7zwGto:K7VK+RBZ3l1i+y+3peikr3oEJqh7MCo","tlshash":"91c18f03f313ed339b875f190abe4dc3498b2f9a4725a7d6285b5aa89654819c062e82","first_seen":"2025-08-29T11:05:53.328141Z","last_seen":"2026-07-23T00:35:02.05251Z","times_seen":2422,"resource_available":false,"data":null}},"time_used":2769,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2769,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/img/LIVE.88ccbf98.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.215Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /img/LIVE.88ccbf98.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-f0e1\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266132=N/QnbzZ2AZFVQCEm7JFlxb/Bt7QEyfiTmWOO5avUYGYcydOyUTUE3M+0/CnQju09ro3iPnqv37qegrHX9VflpfsX9bMR5/oKM4OsbdPf6EbSiiSnruQUqfEsDB+h69ibi1EJhuc7KosgEraRD3RBO/XcIUBLNdjiD+/Y2KNympoAi1Od8cSlPIPJAvj7ymRQ\r\nage: 76249\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0919e448698e6c998\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61665,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"372d01a2bda7ccdca1e7966af39c2327","sha1":"d438c1947b711d032c5621a6b4b08bbbca2c338d","sha256":"4eac7be4c06fa607ef5e95789e3ead43806bfeff97872ed6567e3810f2f661bc","sha512":"9f04160df8696cf984cd77604dddaea73969479e4f1c5050e53351df7f11e85d8ecccb14ecb87dcd58bea0ba04d9ba5ea3f99c69a179ba88ad38d5416b7a94d3","ssdeep":"1536:jTjrlfQBxhFWiXt2lnJE9mARbSK0k2C8ve1HfarCtt:jH1QjwWUC9mA10jC8WZfaQt","tlshash":"dd53124a2ecc3a1f7bf21e5e06f286814d36a186d0f9ba5bc6e70ef1218521de0e4535","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-23T00:35:01.928128Z","times_seen":2249,"resource_available":false,"data":null}},"time_used":3714,"timings":{"blocked":-1,"dns":0,"connect":0,"send":2778,"wait":936,"receive":-1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/img/home-bg.1e09954b.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.393Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /img/home-bg.1e09954b.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.f27g.top/css/home.1777369843125.0fc9d8d4.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-fae\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266132=N/QnbzZ2AZFVQCEm7JFlxb/Bt7QEyfiTmWOO5avUYGYcydOyUTUE3M+0/CnQju09ro3iPnqv37qegrHX9VflpfsX9bMR5/oKM4OsbdPf6EbSiiSnruQUqfEsDB+h69ibi1EJhuc7KosgEraRD3RBO/XcIUBLNdjiD+/Y2KNympoAi1Od8cSlPIPJAvj7ymRQ\r\nage: 76246\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0919e448698e6c997\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4014,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 278 x 80, 8-bit colormap, non-interlaced","md5":"ed0eb6c81f949885511fbbe4d666a2f0","sha1":"d74fb98c3b01727753bb182eb5ee5d6eedf3da4a","sha256":"7fecf4ed61ab1535aafe2800474ac643b49264b83f54fc1da596d7334868ae75","sha512":"dd2f749e24e6b35f80fa77856c9c8b1cb1e0cacb9250b947403283e152d8bb9e7bf539df00ca6743d4162aeac014e47ce82191b62847fabe6cbb5693b4cd7fec","ssdeep":"","tlshash":"1a816c7eb31a4997296ff194138b387d74b0709d0b546934388a9c31a4791fcf39e526","first_seen":"2025-08-29T11:05:53.155399Z","last_seen":"2026-07-23T00:35:02.063264Z","times_seen":2255,"resource_available":false,"data":null}},"time_used":3544,"timings":{"blocked":-1,"dns":0,"connect":0,"send":2608,"wait":936,"receive":-1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/css/chunk-common.1777369843125.32ab7c45.css","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:15.109Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /css/chunk-common.1777369843125.32ab7c45.css HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:15 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-33e9\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266115=ud1RxWc4o642H/BkKCo6Aou8uBCszXJBX4YrRXnJoMGOZtO23U3mgpmEy8o4nhZut8tjleBzMvjD+6HY6BUfJZm/WqWxYMkqhgon6GBBbYCSo/Q25DkpOG18Kl2L1Fnz20dy/spCuS0SSJwM7pW/ZEK78glK4hpCd9hiziv1JQ87UreukqHKUYa9oGbrN5hn\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e448656bdb87e\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13289,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (13289), with no line terminators","md5":"c564fca03e3163e6f230cfce16abd0b7","sha1":"f711dd11fd523e3299c13d9ed37d504671ed824d","sha256":"802bcd434c500feaf5a28cbd6adac354ef122e595965c6f9c440ecfd987d1cb6","sha512":"12d14dbdf4f1c1c446aceb866146eff40a66c77f74b8f331d3e9c4fc7c3f01c849b051a31020b2e2b5134fc2c1dd5c807f9cc398eec91edbdd5c7b1d95691984","ssdeep":"192:4dQK/X4cBY4mZGX1lsUTLA7gYEbz/i//LN4hHSQZA2VxM2XwKjv0:M8oTGEbz/i//LihHBrxP0","tlshash":"c452b731d634b53ce57be226f9d09adc6024d417e2730baeea653b3ac5ca4d215332c8","first_seen":"2026-04-29T03:41:13.417048Z","last_seen":"2026-07-15T14:42:34.148658Z","times_seen":447,"resource_available":false,"data":null}},"time_used":435,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":435,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/9049a8d0ae4b407280cf48482adc3e20?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.356Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/9049a8d0ae4b407280cf48482adc3e20?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:29 GMT\r\ncontent-type: image/png\r\ncontent-length: 105605\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 3687\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"9049a8d0ae4b407280cf48482adc3e20\"; filename*=utf-8''9049a8d0ae4b407280cf48482adc3e20\r\ncontent-md5: o+CTzTuByA3xJ4/5MXQ24A==\r\ncontent-transfer-encoding: binary\r\netag: \"FrT4YfzqU21aw8JJ4H_KKT-Pbqt7\"\r\nlast-modified: Wed, 13 May 2026 18:31:28 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: Q4W1IP9Er\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: logAAAABsa3DNbEY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":105605,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 225 x 224, 8-bit/color RGBA, non-interlaced","md5":"a3e093cd3b81c80df1278ff9317436e0","sha1":"b4f861fcea536d5ac3c249e07fca293f8f6eab7b","sha256":"5dc869a58d18541792443f02bcda898b342162995fe950029013d771a3885d6a","sha512":"b19b108b19aa0334135b477c83ad952044d92df820c7ad6e84b81f396c86c9d001f6161e081be46137cf3c0a3963200ee9dbe3a54ea5807afb2089690619ec48","ssdeep":"3072:tMYLu5T8C/3xfrw2rGjXjHXGDvDfLPsyzM/WdBq:etT8s39JK7XGjPpIkc","tlshash":"6aa31226a9fe05542d183fcd95cdcfe6e4600e6610fac6e1a43fd39a1ee0981c1dd2b4","first_seen":"2026-02-22T12:20:37.294148Z","last_seen":"2026-05-20T08:35:52.498214Z","times_seen":8,"resource_available":false,"data":null}},"time_used":2139,"timings":{"blocked":499,"dns":0,"connect":0,"send":0,"wait":1027,"receive":613,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/config/initGeetest4.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:15.104Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /config/initGeetest4.js HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:49 GMT\r\netag: W/\"69f08425-3a7f\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266115=ud1RxWc4o642H/BkKCo6Aou8uBCszXJBX4YrRXnJoMGOZtO23U3mgpmEy8o4nhZut8tjleBzMvjD+6HY6BUfJZm/WqWxYMkqhgon6GBBbYCSo/Q25DkpOG18Kl2L1Fnz20dy/spCuS0SSJwM7pW/ZEK78glK4hpCd9hiziv1JQ87UreukqHKUYa9oGbrN5hn\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e448656bbb87d\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14975,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"87855e19802d75b55afa7bcf3af515c1","sha1":"4af373375728a98d623f2299a68a91e150f2672e","sha256":"9ec8a5ef8c8ffe369dd1a5c4730dce6570c0d90955798c0be4ac04ef1c8f4baa","sha512":"3baa6d9e916abfb3d38b7ebb9372c5987e8f10534bb978383751c0094f8f5a3e764f9b8e44a73d9d4871cbaeca7e1939f0ffaf9499af5c4a71f64c3588167d85","ssdeep":"192:23aP8Ha0D+Nu5dq+EvNiqc4K25MB5VYaiQwSL4SScQVy8QRHIsGiz0iX9rES6Myy:2fe61w1iXKb2sMGUI+KQTwwHlB","tlshash":"00621d0d68f764534553b4388b9fb014b5388a53042cde41be9ce354afa843d9bbabdc","first_seen":"2026-02-16T20:32:40.162764Z","last_seen":"2026-07-23T00:35:01.901693Z","times_seen":1816,"resource_available":true,"data":null}},"time_used":436,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":436,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/kc523-1/sponsor/sponsor_nav_web_2.png?1777369782162","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.639Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_2.png?1777369782162 HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: image/png\r\nlast-modified: Sun, 24 Aug 2025 06:03:49 GMT\r\netag: W/\"68aaab45-1922\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nage: 76243\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866c7fb8b8\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6434,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 206 x 332, 8-bit colormap, non-interlaced","md5":"e31cb9f70abcc458288bb53868031352","sha1":"965f7cb9aaf0d166c21b8681b0671d17e019c74e","sha256":"33295ad776e1fde54dace5b0343c9aab9a2d70cfa8848e5cbd09065c340e294f","sha512":"acd328b1f4cb6e1c7267696487f637ea5ae4b724f7ab32516632a3eb2c8b4e374fa472ab77120230258fb49a23f54ba3988b155004b46e69519fe3ef57ee79c9","ssdeep":"192:RYc0QiGWn0WG2WmjNJMjOluoj/xrASMJmoJESULHT:RYc0QiGlHmjOo1j/xPMAG2Lz","tlshash":"c9d18ea6ea2a4a52cf8d0d633efc5b0671508e582f390826809a1d1d57767fa24a13e7","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T20:44:13.472322Z","times_seen":2133,"resource_available":false,"data":null}},"time_used":2787,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2787,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/82c1049f177b4dc3bc38254b4122826e?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.377Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/82c1049f177b4dc3bc38254b4122826e?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:30 GMT\r\ncontent-type: image/png\r\ncontent-length: 111951\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 75598\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"82c1049f177b4dc3bc38254b4122826e\"; filename*=utf-8''82c1049f177b4dc3bc38254b4122826e\r\ncontent-md5: nVIImPSaRuCgD+74IkDLgA==\r\ncontent-transfer-encoding: binary\r\netag: \"FicGVqV09HODONUR2u4X3ARAdVHD\"\r\nlast-modified: Wed, 13 May 2026 18:31:44 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: 10nYAfkLy\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: pGIAAADIZtZc9LAY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":111951,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"9d520898f49a46e0a00feef82240cb80","sha1":"270656a574f4738338d511daee17dc04407551c3","sha256":"b939c9b097de39bf3d75f3d77c995b85bb4fec2f82e4fe9f7d2776cfd921cdf9","sha512":"6a30daf6942951db884cae9b35cbeee05c6a4b31c6b6fa67cb21a186fb8163e5629181cb5a00046ff696cdc5144bc9ed4436c59a112dfe23b6aa3c0509da5018","ssdeep":"3072:dZ5X3mZ7h4Q/qWrkbw+EfaB8Cd/udZZf+gmDeTCErscl9kshdyjH3vV:dZl3mRhrqGkbw+Jld28W3z95qXvV","tlshash":"03b312acc30ff231ea795c790c167285e362552d47edfa13b22a79c1b2d345c859b12b","first_seen":"2025-01-03T06:47:24.523779Z","last_seen":"2026-07-21T13:19:18.634004Z","times_seen":171,"resource_available":false,"data":null}},"time_used":2161,"timings":{"blocked":479,"dns":0,"connect":0,"send":0,"wait":1027,"receive":655,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/chunk-init-c0d76f48.1777369843125.2d292e02.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:15.117Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /js/chunk-init-c0d76f48.1777369843125.2d292e02.js HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:49 GMT\r\netag: W/\"69f08425-275ae\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266115=ud1RxWc4o642H/BkKCo6Aou8uBCszXJBX4YrRXnJoMGOZtO23U3mgpmEy8o4nhZut8tjleBzMvjD+6HY6BUfJZm/WqWxYMkqhgon6GBBbYCSo/Q25DkpOG18Kl2L1Fnz20dy/spCuS0SSJwM7pW/ZEK78glK4hpCd9hiziv1JQ87UreukqHKUYa9oGbrN5hn\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e448656c4b883\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":161198,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"eb71ab6debf3abe346c8c4d941813d15","sha1":"88116abc111aad2e9e1b1d0974de9d97cd891e0f","sha256":"3dca15bdb644d02cedbfe3adaeed7ff4c47508d664ad1ce6b361dcef7a5423b5","sha512":"eb604132673651b6a0646263fed02220557b65080b323b03513053af5662af520808cd469c00f7ad99ed16fcf9a2ab5374b89477cf8f8a9f8ed89f6a313afd7f","ssdeep":"1536:xTG5pxPvO2lSV822bv0bcbpM/igw/aIwC23QOoKILbjxo4wc0tvB6xVS/J+pKY3O:Mvz/Dp5/92xoKa/x5wc0dB5/J+UU0","tlshash":"6ef31b987392b1b847dba6e152371075b57e1dd73088e8f0c169a6803f31a9cd52afec","first_seen":"2026-04-29T03:41:13.437512Z","last_seen":"2026-06-08T22:37:37.047095Z","times_seen":434,"resource_available":true,"data":null}},"time_used":1043,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1043,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/65246.1777369843125.8333614a.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.621Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /js/65246.1777369843125.8333614a.js HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-11f16\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866c7fb8b6\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":73494,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (48666)","md5":"4f72169b9753bbfd046b32e8a9c4c9d8","sha1":"76310a9e002235a02b1842b0ff3985e2bd53ef46","sha256":"26b88e6905d829b63d80a3ce48041e1fd4fe98923072fb1d19b371d117e41045","sha512":"05d8f29fd1ac787d4f27a2d8ee901437e310e0ca663822c6270d05c1de8d33a024e312797a984083b277aa054cde3c5995340a26c25bac74fa6c11b339bcfc3a","ssdeep":"1536:j2+iDvYvNjx4Uyao0L8oDNzAuMMsTAQ0mqt2pXYzA4dANVQ:q+iDYvPo0L8oZzAuMMsTA7mqt9zA4dAQ","tlshash":"de73a501f78272384fa7e290220f2026e16e191505ac5bd8f179ffb93ef0954aa7d7b4","first_seen":"2025-12-17T20:52:09.055572Z","last_seen":"2026-07-13T05:08:27.627172Z","times_seen":1261,"resource_available":true,"data":null}},"time_used":2804,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":2804,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/ecb/8f8306425fb46e096ba9db3ab31b67b681fbb31575ff397b0117","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:24.612Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /ecb/8f8306425fb46e096ba9db3ab31b67b681fbb31575ff397b0117 HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://www.f27g.top\r\nXign: ILyN0N7UCcIA/u7B3vzNB8ah9SRBpbRY4UYlYWuuowsQu1Y2ymTZWAJBvgh811BygSjyckL6RqkkxuHLIiDbX9Go7dn+IUIgLpvHaa2phlJ0hXsLb+x6FK9NVxBR99k/r2Ic7Y8f2l3dqp+AhdQ+uKB28v3Uy39KbW0PtYdWIMA=\r\ntimestamp: 1779266124594\r\nsign: 53b6o1k49695p23l\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: zM66WbX6JffCzAPYKHD3Gxnmh7JPTEYH\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:25 GMT\r\ncontent-type: application/json\r\nexpires: Wed, 20 May 2026 08:45:24 GMT\r\ncache-control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nx-xss-protection: 1; mode=block\r\npragma: public\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=63072000; includeSubdomains; preload\r\naccess-control-allow-origin: *\r\nx-custom-check: true, true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266125=GYVCFswnvyg6HUDSML+socExrp5UkAsWNubxuJgkNJQuyrepjSJnquBEXK2tbNomTUMCEmx2bz/Zx81xexnn2501I5gu8oHvfpeTU+hwKZFg1eq7QRbu98y5EL0eF6/cm5BVPfzYlzamy2ubYGl01c2U3Au75r8nzF/ZL2oWQOUGxyrLv0uiwPId12KQ41yf\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44867beeb8eb\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2172,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"5b022e3c246d6ad840a47d4bb295d717","sha1":"da068a014049d0c3e632528593d28a78f3356ba6","sha256":"eb2f7608a2223d8eba04c1c648b646f64b73527754c35ae657e72a997abd00ba","sha512":"cf2f645dec4207f414e10e6d929e46910e4d3ecce6e6b9bf650d7b047608bbd824e5b2cdfbcdacdb8041f268dbfea046361f53f740b477738536bc33afe76388","ssdeep":"","tlshash":"e3616d76575193d0a214a6f8b0c0094c707ff2e2fc575709c985a546c72f024b4be22e","first_seen":"2026-05-20T08:35:52.501533Z","last_seen":"2026-05-20T08:35:52.501533Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3024,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3024,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/6457e1a363014f9599c355df8607ed5b?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.389Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/6457e1a363014f9599c355df8607ed5b?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:30 GMT\r\ncontent-type: image/png\r\ncontent-length: 27217\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 48920\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"6457e1a363014f9599c355df8607ed5b\"; filename*=utf-8''6457e1a363014f9599c355df8607ed5b\r\ncontent-md5: ZQiUbJpf4iqHhLkFsl6MeQ==\r\ncontent-transfer-encoding: binary\r\netag: \"Fg4UaIZrZbDVorodZPl-Wr9UreyW\"\r\nlast-modified: Thu, 14 May 2026 19:04:00 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: abeIFNKQ4\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: Jv4AAACg312gDLEY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27217,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit gray+alpha, non-interlaced","md5":"6508946c9a5fe22a8784b905b25e8c79","sha1":"0e1468866b65b0d5a2ba1d64f97e5abf54adec96","sha256":"893c1114ae76ae3a992db25f75b2f788b0b4b0239d06a02a02d254fd6be71485","sha512":"0bc956d3d26a7853dc611e4c7d3ba5685b540665040adec770f3ed02970b6124e8a0a970aec13056a8bcd5a81aa10897efeb6837b01432003fab1feb15d2bbe4","ssdeep":"768:ZCG5epoj42Sf3AQoGrc1GDUyomPUmVZckFfjKKW/:ZNMy+fwvqoVQXjKKU","tlshash":"6ec2e2e68c147b28629bbb5e8cf93b40c57315978cdc878c552153c83a813b641c3bfa","first_seen":"2024-12-13T17:33:29.045823Z","last_seen":"2026-05-20T08:35:52.502462Z","times_seen":314,"resource_available":false,"data":null}},"time_used":1735,"timings":{"blocked":470,"dns":0,"connect":0,"send":0,"wait":1024,"receive":241,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/css/83749.1777369843125.2e202a68.css","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.447Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /css/83749.1777369843125.2e202a68.css HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-6f2f\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866bd6b8ab\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28463,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (28463), with no line terminators","md5":"1ead8072763d5fe20963f033dc63d94e","sha1":"36eeb0853a1b5681ab464dc1ef3682160e420e60","sha256":"8f014d5d9b2798ecfc473bac7c23f80295b94af3cbeff054fcaf973b286f8240","sha512":"92670a870b9db4259e71072ab72699e3431fa9eb53027f4b90c954b51eaf1869f5f50987808e5c625e9101ea4ea3aca655b81ba73f3ba2ced4cd480eb9a915cc","ssdeep":"384:DYCKpsUIc1F8l1TANI34yQyqPPQwmfzIfRbHx6+OhCcbakzeYaTONdqdK:DYCKpcPE64yDqbodqdK","tlshash":"07d2739ae5d4b13e6c1fbb35ebc5a1ecb1399450df620e7af202762547c3af1012216d","first_seen":"2026-04-29T03:41:13.425526Z","last_seen":"2026-07-23T00:35:01.949983Z","times_seen":1238,"resource_available":false,"data":null}},"time_used":2975,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":2975,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/83749.1777369843125.7bad5eaf.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.449Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /js/83749.1777369843125.7bad5eaf.js HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-1641f\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866bd8b8ac\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":91167,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64072), with no line terminators","md5":"d036e00b216c6886ee096346a4aa7d9c","sha1":"8b6cdea36134802a22d5ab4009f69036ef63dd40","sha256":"444030e40d34fa938300dd2cc7b218f3fe47f6a865afd399ea5c1cd5dddae433","sha512":"bab25e53e886cf51cb47125cbb1582da65677fbafa057cc9f770b7a7889ea3bc8a59f60574c16404fba3d974b876f655642a1708a9beedb20b9b47d1b5ba68b0","ssdeep":"1536:lcK/KnqHB3vmeLUw/A6+GplTwsCNgOX8JwTl0sI5pQiVFFsdt+HmQ:rB3vzowo6XTIgOXawTl0sgQi2tkr","tlshash":"6a93e7c4b5f4f5f9279ec5a297364478b02127c5a0c8ace0d2e96e147f1ab92b0758fc","first_seen":"2026-04-29T03:41:13.335994Z","last_seen":"2026-06-08T22:37:36.995277Z","times_seen":394,"resource_available":true,"data":null}},"time_used":2975,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2975,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/kc523-1/sponsor/sponsor.json?1777369782162","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.613Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor.json?1777369782162 HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: application/json\r\ncontent-length: 646\r\nlast-modified: Sun, 24 Aug 2025 06:03:49 GMT\r\netag: \"68aaab45-286\"\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866c7fb8b3\r\nx-cache-status: BYPASS\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":646,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"10d2161de8cf99c474812f4c43645a26","sha1":"71884ef7281cdcb5084088f16d4550ce8790e634","sha256":"bb02fd7438bb49dd4decb6f76a71f11e93355332fd9f965d6f9f13bb8175aeca","sha512":"bf0fd1232309fcc5582d5c42644e1c7b4b8d235b1066e988ff55e0dd94a956f89742401f00c2d904359041c8e0c2bac8e9316252fab60db5eb0a3b4c935172f0","ssdeep":"","tlshash":"d8f0f44ad8b25b93211fb57c58cd050470294a8f0eccaac4baac987c4f598ddd1e839e","first_seen":"2023-06-16T04:51:50Z","last_seen":"2026-07-23T00:35:01.929213Z","times_seen":2646,"resource_available":false,"data":null}},"time_used":3406,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":2812,"receive":594,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/img/LOTTERY.4e81790a.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.219Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /img/LOTTERY.4e81790a.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-e929\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266132=N/QnbzZ2AZFVQCEm7JFlxb/Bt7QEyfiTmWOO5avUYGYcydOyUTUE3M+0/CnQju09ro3iPnqv37qegrHX9VflpfsX9bMR5/oKM4OsbdPf6EbSiiSnruQUqfEsDB+h69ibi1EJhuc7KosgEraRD3RBO/XcIUBLNdjiD+/Y2KNympoAi1Od8cSlPIPJAvj7ymRQ\r\nage: 76248\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0919e448698e6c995\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59689,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"f86c9671c7aed55212fe0eb5219a664d","sha1":"6e765dfb0ce3c646d8c808940071554e78e7d409","sha256":"4ba3fff550a17eff9585d6acbc4a96bd515149510f6a8bb7638985fb4b41a181","sha512":"706aa66f138a3459eaf34f5b7a8ffed3dfacecec6adf14a2e83f1149143cfbb059f97aaaac2032587a80c0e30c62e5b46b07b4dc6f3cf5925e6e1db2a8ed45d6","ssdeep":"1536:Cyp1EBaRnsFt9ZXZj0wEYsRvqm1waPbZsY:CLB+sFtzXN0w2ym1fFsY","tlshash":"914302f36beb0bc5b07adbcf4ed354f0067a71496b42dcd44f4120e61ea6199bac420a","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-23T00:35:01.910943Z","times_seen":2232,"resource_available":false,"data":null}},"time_used":3712,"timings":{"blocked":-1,"dns":0,"connect":0,"send":2776,"wait":936,"receive":-1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/a1236756b8a94a1485102a78698fff59?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.391Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/a1236756b8a94a1485102a78698fff59?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:30 GMT\r\ncontent-type: image/png\r\ncontent-length: 30034\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 48920\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"a1236756b8a94a1485102a78698fff59\"; filename*=utf-8''a1236756b8a94a1485102a78698fff59\r\ncontent-md5: +wHD1DXCuXvqQgexp8fOig==\r\ncontent-transfer-encoding: binary\r\netag: \"Fr_z8jzxWKa5BM49UJSleZqqxSSk\"\r\nlast-modified: Thu, 14 May 2026 19:04:01 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: 9pmK0cYp4\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: m0kAAABA612gDLEY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":30034,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"fb01c3d435c2b97bea4207b1a7c7ce8a","sha1":"bff3f23cf158a6b904ce3d5094a5799aaac524a4","sha256":"3db0feefc11a26f581f0fa0c04c61df6214799a3cdc48e413367d4bd9a07e41a","sha512":"4528bf7062ed22e6974628d54c2164747ccd459fbe986ec24623b4df1fa3eda860a4c0737a257bd183652891766918dfc1ee2d57ddeb874809245c1e924afb4a","ssdeep":"768:zRU9EXfCxUhMKI8DZYohgbfGFK1nnZvUXyQ0FO:zCEqxKRXxhohZvUj","tlshash":"a6d2e1718f78183d55c04a55348d15a844efca3c939c92b662e2cf89c93e2ec9f1a9fd","first_seen":"2025-01-29T13:39:14.809113Z","last_seen":"2026-05-24T05:41:01.498075Z","times_seen":270,"resource_available":false,"data":null}},"time_used":1784,"timings":{"blocked":468,"dns":0,"connect":0,"send":0,"wait":1025,"receive":291,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x422_936e6f39-c72d-42ec-ab51-2bd5a806c902.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.188Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x422_936e6f39-c72d-42ec-ab51-2bd5a806c902.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:32 GMT\r\ncontent-type: image/webp\r\ncontent-length: 15760\r\netag: \"dbd5bbca2ac98b7327bec49ec9e17a87\"\r\nlast-modified: Tue, 02 Dec 2025 14:11:52 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Qp6gSK5wDwwomgaBpp1XZHafrtXJnQRzI5plsfnuwpOyp7GVGVMOyDMhX1UMWDad2oi6QwP%2FJSy%2BAR57KFHuAg%2FXE%2BsJg3cyT9ekW6p2SMpl7US2JfBU0PvprocCX%2B1afzDvTKwwQ3yjgw1IELwnImg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 76253\r\ncf-cache-status: HIT\r\ncf-ray: 9fe2bc8baa561095-HKG\r\ncache-control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\nserver: Nginx\r\nl-safe: 1779266132=N/QnbzZ2AZFVQCEm7JFlxb/Bt7QEyfiTmWOO5avUYGYcydOyUTUE3M+0/CnQju09ro3iPnqv37qegrHX9VflpfsX9bMR5/oKM4OsbdPf6EbSiiSnruQUqfEsDB+h69ibi1EJhuc7KosgEraRD3RBO/XcIUBLNdjiD+/Y2KNympoAi1Od8cSlPIPJAvj7ymRQ\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0919e44869a0fc9a1\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15760,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"dbd5bbca2ac98b7327bec49ec9e17a87","sha1":"7ad876b6c3f6922c1cff9db452948604cfc691cf","sha256":"12e3a0e3de790b5f640b48e4fede8f5d1c881e23b4d710d1971282362277eee3","sha512":"c96a4f88a602c4bd5d8ccc3a0ae44ca9d85d5a75175b8b8c219c527d2ed1338b8d65e9bc52e9c1e844f34aa76e6d0d1d81c4eea6b28592de710a4f4922b11701","ssdeep":"384:z25GXKCP2DdvL8cWHImH7LKcCZzFwu/6unzgL4X9:S55Ce/xsln46un88","tlshash":"f462d0149f5537278cc4787941315fbf7f601c42b208e45296ffa86bba2c2957a146f3","first_seen":"2026-04-24T23:10:16.813188Z","last_seen":"2026-07-23T00:35:01.997941Z","times_seen":921,"resource_available":false,"data":null}},"time_used":4670,"timings":{"blocked":-1,"dns":0,"connect":0,"send":2829,"wait":938,"receive":903,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/5b0031d5066240988c569d7a4267c65f?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.314Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/5b0031d5066240988c569d7a4267c65f?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:30 GMT\r\ncontent-type: image/png\r\ncontent-length: 145966\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 5640\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"5b0031d5066240988c569d7a4267c65f\"; filename*=utf-8''5b0031d5066240988c569d7a4267c65f\r\ncontent-md5: +l13dNnI2qoVIFnKZwkT6Q==\r\ncontent-transfer-encoding: binary\r\netag: \"FvqsRGCRfubIZ8zGehqxc0F1fULr\"\r\nlast-modified: Wed, 13 May 2026 18:31:26 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: yDNtZmGXE\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: DMsAAACrNEj9M7EY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":145966,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 272 x 272, 8-bit/color RGBA, non-interlaced","md5":"fa5d7774d9c8daaa152059ca670913e9","sha1":"faac4460917ee6c867ccc67a1ab17341757d42eb","sha256":"65da4bbeb9be28a38f4c746bc0486e89abd82e538dfb818708342b006346b6a0","sha512":"335567a15fe71fddbbf17b6c93e5718e96417a3fecbeac9a03dabc168848c87fc337c4d24940d5120cfdf58b7a0049d3c2937eb5bedd0ace399b3be1a869ed80","ssdeep":"3072:mPAMvQQPjX3QB9CuUM3RIK0VnqZTXy43d8n1uhimSKGo/DRzxwcKdZ:SADQrQB9CuRuFVqBDS1mSK792cUZ","tlshash":"afe312dbf2c47371c5aacba290edab546a52c6b9cf924f34511abcec5725382010a74f","first_seen":"2026-05-20T07:27:33.730243Z","last_seen":"2026-05-24T05:41:01.321299Z","times_seen":8,"resource_available":false,"data":null}},"time_used":2906,"timings":{"blocked":571,"dns":19,"connect":244,"send":0,"wait":1033,"receive":730,"ssl":305},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/8a0dbcb03f574f6ba82aa5e26c07a1e7?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.327Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/8a0dbcb03f574f6ba82aa5e26c07a1e7?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:30 GMT\r\ncontent-type: image/png\r\ncontent-length: 11254\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 5699\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"8a0dbcb03f574f6ba82aa5e26c07a1e7\"; filename*=utf-8''8a0dbcb03f574f6ba82aa5e26c07a1e7\r\ncontent-md5: PsXF36DzsgQpDnDA1d/fLA==\r\ncontent-transfer-encoding: binary\r\netag: \"FqgRqRHSxlpFKQPN-Kwmh9AU6czr\"\r\nlast-modified: Wed, 13 May 2026 18:31:27 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: hcH5pEyky\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 1bgAAABa3G3vM7EY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11254,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"3ec5c5dfa0f3b204290e70c0d5dfdf2c","sha1":"a811a911d2c65a452903cdf8ac2687d014e9cceb","sha256":"f1d557354b0841bb0bf93f23bd975437d8464c532ead52db38509a95884ecfcd","sha512":"9a6a723c0494289f24158448d6787c4d1c8a493e9244bc3b4716b7053d0b9981ac308651127b34a9b1e047cd52176d1f899a6b8c7e3f8946b590511505ee630c","ssdeep":"192:G857VqWYcRGdF3n7tSUdn4pG5vg+MrSVeGncdyVIywBxGwTRefPjF61JV/e9eJaO:pw+GdF30Ho5vg+MrSVZbCRefPjQ1JVGW","tlshash":"7f32df31a04d7b058d2eb8f734a119805376bba7334205aca45d17618b2eabd9e7063f","first_seen":"2025-03-23T09:25:37.445633Z","last_seen":"2026-07-04T06:21:56.411638Z","times_seen":20,"resource_available":false,"data":null}},"time_used":2443,"timings":{"blocked":556,"dns":0,"connect":255,"send":0,"wait":1034,"receive":302,"ssl":288},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/kc523-1/noData/cms_noimg.png?1777369782162","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.397Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /kc523-1/noData/cms_noimg.png?1777369782162 HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Sun, 24 Aug 2025 06:03:49 GMT\r\netag: W/\"68aaab45-269a\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266132=N/QnbzZ2AZFVQCEm7JFlxb/Bt7QEyfiTmWOO5avUYGYcydOyUTUE3M+0/CnQju09ro3iPnqv37qegrHX9VflpfsX9bMR5/oKM4OsbdPf6EbSiiSnruQUqfEsDB+h69ibi1EJhuc7KosgEraRD3RBO/XcIUBLNdjiD+/Y2KNympoAi1Od8cSlPIPJAvj7ymRQ\r\nage: 76245\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0919e44869a0fc99b\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9882,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 700, 8-bit/color RGBA, non-interlaced","md5":"85e60fd8767b18839ffb552a5d543f8a","sha1":"341cfd68a5b39cb246af6ade1e3171c857d2df5a","sha256":"4b7ad68306ffac25830d1016ba86154890deef8bd77a03257b767b37de1c8338","sha512":"785f028aab80d3f96794431f84025483f490d7d642022404a7b14ccb4785aa52fe4a21048d44acda3bd160eedeaccfb4959a677986dfe47ef038d80724f2acb2","ssdeep":"96:74iGykVWI7TGvGJUgTFSebsBzYofEC16+TqBK7R7LWKaR8a8D7uZNgAMXFL73:74iyHunEFSebsvP1nTP7IF2uAAMX5","tlshash":"141259118573d43cd82ce57926df6fb93b709f996890476e8328e7342f2a2f78d60848","first_seen":"2023-05-01T09:33:58Z","last_seen":"2026-07-23T00:35:01.913525Z","times_seen":3048,"resource_available":false,"data":null}},"time_used":3535,"timings":{"blocked":-1,"dns":0,"connect":0,"send":2598,"wait":937,"receive":-1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/843d10ce3b8c4065a4d47bac1222a83e?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.380Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/843d10ce3b8c4065a4d47bac1222a83e?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:30 GMT\r\ncontent-type: image/png\r\ncontent-length: 81344\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 74098\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"843d10ce3b8c4065a4d47bac1222a83e\"; filename*=utf-8''843d10ce3b8c4065a4d47bac1222a83e\r\ncontent-md5: PD1YqJB4MQgIokSjQxoMUw==\r\ncontent-transfer-encoding: binary\r\netag: \"FpyCW5jMZySFj697a3UMMGmPIFan\"\r\nlast-modified: Wed, 13 May 2026 18:31:49 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: Kkm6Kr9Ec\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 9lgAAABZxSO69bAY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":81344,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 312 x 306, 8-bit/color RGBA, non-interlaced","md5":"3c3d58a89078310808a244a3431a0c53","sha1":"9c825b98cc6724858faf7b6b750c30698f2056a7","sha256":"7aaa4f062ad24fc373f38371856e7c08f64790659652e14e6032aa6aa16c8e07","sha512":"5b82e3173737d472a4cf99145a7d7f4ec7b6c58dcd896942def02ef589287d89e66ff32f2953eb2873cdbed72df1cfccacb4903de74aa411002f1b00ea47638b","ssdeep":"1536:OOeIsnMw7CW9/C6YkYCRENhKH5aw0AWLPbAWNIhApETDH:bAnB7CkfYkYCRO5uoTByhgQ","tlshash":"838312c0608cac59cc00da9cc74ab9244abdc46404f8f869979b4adb57a8927f7f47b7","first_seen":"2025-04-01T11:41:17.737976Z","last_seen":"2026-07-21T13:29:27.915162Z","times_seen":193,"resource_available":false,"data":null}},"time_used":2210,"timings":{"blocked":477,"dns":0,"connect":0,"send":0,"wait":1026,"receive":707,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/css/index-399e2569.1777369843125.a7b0b4f4.css","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:15.112Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /css/index-399e2569.1777369843125.a7b0b4f4.css HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:15 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-faee\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266115=ud1RxWc4o642H/BkKCo6Aou8uBCszXJBX4YrRXnJoMGOZtO23U3mgpmEy8o4nhZut8tjleBzMvjD+6HY6BUfJZm/WqWxYMkqhgon6GBBbYCSo/Q25DkpOG18Kl2L1Fnz20dy/spCuS0SSJwM7pW/ZEK78glK4hpCd9hiziv1JQ87UreukqHKUYa9oGbrN5hn\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e448656beb880\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":64238,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (64238), with no line terminators","md5":"1f30d2cd291b70a1848607e3460d9278","sha1":"e91e48518ec94fcaacf418789927f34d7527dc99","sha256":"8ce1851c7bd6e7db80ee5ee8da7a0c808f29756dda3c941bb3811dc3bd3e5afd","sha512":"3cf09b1afc740c4a219a45a233489d76587ec8bd80a57c52ab133f33fdffa8a3fe35a0a27e386270ebeaa9e86d156897e44733b8eb83ee6935fe67749c30cd0f","ssdeep":"768:E0ouVbMisnf7X8vtr9UL5srs7hAqpLe20TCKiNkZICSA2ohGyHukQ9aaV+TJtU+G:HoGws9isrQAqVe6KekWRlkQ9hf+Pe","tlshash":"c6538d3123e0286ee27b6b16ec51e659352b8602f127625af703362fc1d72f5c67b742","first_seen":"2026-03-20T12:57:26.768432Z","last_seen":"2026-07-23T00:35:01.918065Z","times_seen":1437,"resource_available":false,"data":null}},"time_used":732,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":732,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/chunk-svg.1777369843125.1e4dfc16.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:15.116Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /js/chunk-svg.1777369843125.1e4dfc16.js HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-714c8\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266115=ud1RxWc4o642H/BkKCo6Aou8uBCszXJBX4YrRXnJoMGOZtO23U3mgpmEy8o4nhZut8tjleBzMvjD+6HY6BUfJZm/WqWxYMkqhgon6GBBbYCSo/Q25DkpOG18Kl2L1Fnz20dy/spCuS0SSJwM7pW/ZEK78glK4hpCd9hiziv1JQ87UreukqHKUYa9oGbrN5hn\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e448656c2b882\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":464072,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65532), with no line terminators","md5":"17dc7d24243be411dfc65e6d3bfc3fed","sha1":"040dff237c788f6720e1e7ad8903f103cb86db73","sha256":"4296d5094a19dae430c40d8315056ffcd226eafe5012f293d988d2b631c682e1","sha512":"742a36b45941527965abaaa6e1443e4668e5af5085a1166b561059df61a9f42f0096cbc9f80dd9cd845cefd166d5d84a4e6282eb16100e078d28e6c0305a6a26","ssdeep":"3072:h8nz2uaLZSZvx6Q/sIPrekK+m36Ua94sRZI7gbpF/:h8nz2uasNxpXPrekK+m36UHsE4pF/","tlshash":"bfa4fcb4c190f4edf704ce196e7c9e1c50321688e0a9e9e52da9fe0d9e85d6b241cdec","first_seen":"2026-04-29T03:41:13.396807Z","last_seen":"2026-07-10T22:25:54.152365Z","times_seen":442,"resource_available":true,"data":null}},"time_used":1045,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1045,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size704x442_7f760e34-ebbd-4cfc-bc28-666cc8a6234f.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.208Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size704x442_7f760e34-ebbd-4cfc-bc28-666cc8a6234f.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:32 GMT\r\ncontent-type: image/webp\r\ncontent-length: 44494\r\netag: \"693c20ba4107f736124e16931ead8d60\"\r\nlast-modified: Sat, 06 Dec 2025 06:30:27 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8OzzE8eUBKp9DRgyXPY2%2BTiN8OOzW%2BSds2NgITf2DHR53IljJbc9%2BRUbWDPkXPiM%2BwUlWC0jQC2iiL4rhAqbRy1fF5%2B9ObSgsyOO9FuyQA8j8fme3FVcZD0osbGn1E3E9WsbZNqK2L%2FQpc7d9WZmJ20%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 76252\r\ncf-cache-status: HIT\r\ncf-ray: 9fe2bc93fdd45de6-HKG\r\ncache-control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\nserver: Nginx\r\nl-safe: 1779266132=N/QnbzZ2AZFVQCEm7JFlxb/Bt7QEyfiTmWOO5avUYGYcydOyUTUE3M+0/CnQju09ro3iPnqv37qegrHX9VflpfsX9bMR5/oKM4OsbdPf6EbSiiSnruQUqfEsDB+h69ibi1EJhuc7KosgEraRD3RBO/XcIUBLNdjiD+/Y2KNympoAi1Od8cSlPIPJAvj7ymRQ\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0919e44869a0fc9a3\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44494,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"693c20ba4107f736124e16931ead8d60","sha1":"6a247e864c0c0a9c40bb5be357de99524abf3e2e","sha256":"342bf65608ae9d71296ffcfbbfb4580c00ba782557c802be6496ec374d5fad11","sha512":"ae136a2a5baba143d5afd3fe4270a5ce2bd0a96655f2f56a65f2d9ea26ada4a90c63b36c96b6b79adb32dc0ac9f118040f236cfcdae958f82c05f3f600dc79da","ssdeep":"768:ssqja8OCwQkPOoS4nNgT3p8tZgn5DVWGgNS4RipleSQ6c5xlGY89B:JVQGS8A+wn5D4GgrkKKc5jGY89B","tlshash":"5a13019a26762833b187c36d0030062c1b78b89f3654c54ea4ed7924975f09ec7eca6f","first_seen":"2026-04-24T23:10:16.7563Z","last_seen":"2026-07-23T00:35:01.899424Z","times_seen":960,"resource_available":false,"data":null}},"time_used":4636,"timings":{"blocked":-1,"dns":0,"connect":0,"send":2792,"wait":938,"receive":906,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/img/away-bg.00d4ba2a.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.395Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /img/away-bg.00d4ba2a.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.f27g.top/css/home.1777369843125.0fc9d8d4.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-f2b\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266132=N/QnbzZ2AZFVQCEm7JFlxb/Bt7QEyfiTmWOO5avUYGYcydOyUTUE3M+0/CnQju09ro3iPnqv37qegrHX9VflpfsX9bMR5/oKM4OsbdPf6EbSiiSnruQUqfEsDB+h69ibi1EJhuc7KosgEraRD3RBO/XcIUBLNdjiD+/Y2KNympoAi1Od8cSlPIPJAvj7ymRQ\r\nage: 76246\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0919e448698e6c994\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3883,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 277 x 80, 8-bit colormap, non-interlaced","md5":"ce3e5a71ef5dcf15c030882243e12315","sha1":"d4fdd1329ecac30941a67bd5108bad525c791c12","sha256":"3c2aad01ce2fce6463d6ed3bde348515922dd019d8a670b07b53d66b39c68d3d","sha512":"f6a55d8c079529988760a1c22541c097af159a3653f5ffe89c5c31ee20371f2c879c64797319f4176be77c821294f0f72d83ad77f2a0141203c857c8f987966c","ssdeep":"","tlshash":"6f815cf693e66bd0d5675106a3a14c89624d69d925a325530923f45ec3bb1ac02fe381","first_seen":"2025-08-29T11:05:53.10673Z","last_seen":"2026-07-23T00:35:02.041338Z","times_seen":2231,"resource_available":false,"data":null}},"time_used":3540,"timings":{"blocked":-1,"dns":0,"connect":0,"send":2604,"wait":936,"receive":-1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/css/7653.1777369843125.0ab0fca2.css","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.319Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /css/7653.1777369843125.0ab0fca2.css HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-1439\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866b4ab8a9\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5177,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (5177), with no line terminators","md5":"a0ef4268641ef0b005737ce8cc0c4b44","sha1":"9bb50b9000a419e7a701392b0d7d6c992cf585bb","sha256":"f64c7a7e6ecd620d1c7f8cc67e1eda83a0a115a8d86f3954efdaba3c09d62e66","sha512":"07605ebd7e16aef28f0ad5ed406f29ea9b77e8ba6b2079c810aacf8faf0b4a8d18d4f7775c62860cbf6d4379729a60076103a4daa833c860ddebeee3793ccbe2","ssdeep":"48:ZSPkOO2s2L5Pukasq+nArLkrL4QuQKhUjUkM5P6CdRDRWURcWaTHR/:iOvyP2r4rEDFP61LR/","tlshash":"d1b1412f01703349641bad6807dc67098325d8b399eb37da259d2a0dcbc3f861eb718b","first_seen":"2025-06-26T16:31:28.933081Z","last_seen":"2026-07-23T00:35:02.019571Z","times_seen":3518,"resource_available":false,"data":null}},"time_used":3106,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/b20d1ae0f3134c1c9c139b10570f0273?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.343Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/b20d1ae0f3134c1c9c139b10570f0273?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:30 GMT\r\ncontent-type: image/png\r\ncontent-length: 26678\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 3567\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"b20d1ae0f3134c1c9c139b10570f0273\"; filename*=utf-8''b20d1ae0f3134c1c9c139b10570f0273\r\ncontent-md5: 1xt5Z9NPnSlvCahpeVO3Sw==\r\ncontent-transfer-encoding: binary\r\netag: \"Fgfb8RUVlFaZxpbnf-8fvAHwapM1\"\r\nlast-modified: Sat, 14 Mar 2026 20:51:21 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: hMbA7AXjv\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: aCMAAAAvednfNbEY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26678,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 113 x 110, 8-bit/color RGBA, non-interlaced","md5":"d71b7967d34f9d296f09a8697953b74b","sha1":"07dbf11515945699c696e77fef1fbc01f06a9335","sha256":"4d2e2391ffc2ea0178f089a99e332ab0122b5c32cda99b36e77a4fc8dbaa0701","sha512":"f8620b11e8c6573a0ee72041342065d668152583a5edf477248a4b20e3dc679d9fb2d90526110dcc7601b5e07e08924498c845d016ae6f2b2a1f6d6da49a40d5","ssdeep":"768:CjQ1fpp9/bMv5IIeu+opGNA6F1KjLf1SUQ3iN:pxTQRIHAWKF","tlshash":"57c2e1036b718c262577c96d73626f6007bc0c601bf0f895a390177d3caa9357eb296e","first_seen":"2025-12-20T07:15:41.033015Z","last_seen":"2026-05-20T08:35:52.510666Z","times_seen":11,"resource_available":false,"data":null}},"time_used":1899,"timings":{"blocked":-1,"dns":0,"connect":247,"send":0,"wait":1033,"receive":316,"ssl":300},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:24.606Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://www.f27g.top\r\nXign: vF0dbdtkWApGfbS7ZIRXAMsAW1rPxW9QiMafhDxssLWJeVARIJqapwjKzjAV3uiuAuI8tUHIMzkp/9zsLNfsja4wWEUydFQwf1k29VXP5SnZ1U3kPVcqQHeTdddnnfQubA3Ye019SI3G7VSI27Rubd7XACPTQiK9sBIpHFnxnMA=\r\ntimestamp: 1779266124594\r\nsign: 26752v3o6p221o21\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: zM66WbX6JffCzAPYKHD3Gxnmh7JPTEYH\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:25 GMT\r\ncontent-type: application/json\r\nexpires: Wed, 20 May 2026 08:45:24 GMT\r\ncache-control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nx-xss-protection: 1; mode=block\r\npragma: public\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=63072000; includeSubdomains; preload\r\naccess-control-allow-origin: *\r\nx-custom-check: true, true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266125=GYVCFswnvyg6HUDSML+socExrp5UkAsWNubxuJgkNJQuyrepjSJnquBEXK2tbNomTUMCEmx2bz/Zx81xexnn2501I5gu8oHvfpeTU+hwKZFg1eq7QRbu98y5EL0eF6/cm5BVPfzYlzamy2ubYGl01c2U3Au75r8nzF/ZL2oWQOUGxyrLv0uiwPId12KQ41yf\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44867bebb8e9\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6719,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"cb5b7032eac4f4887152ccb0a81d2937","sha1":"ea907347404add073fbf1671dc3e9cf2d2714aed","sha256":"05f27a036843c136315ec51618a9ca9677211751c22a73baef348765f2c7b6cd","sha512":"aaa8899361091b98661f8b82f1613bdad85f564714a2df9c7f9bdca9dee5bad7535811f54127296b5e0202d4030860fe9dda5cf1915e4582a21432ad7375d4dd","ssdeep":"192:V+LsJDB1n42xEGEqWgfLdZITj0X8yJI7t/8lRMtDwfRdfRz:YIJrn40ugfL20Nup/8A54RBt","tlshash":"7322aec47f09f358ab70e6f007b018915384947ccbda5c64db308a9317db93a5aedae9","first_seen":"2026-05-20T08:35:52.511175Z","last_seen":"2026-05-20T08:35:52.511175Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3029,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3029,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/img/EGAME.d289cd48.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.220Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /img/EGAME.d289cd48.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-e89a\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266132=N/QnbzZ2AZFVQCEm7JFlxb/Bt7QEyfiTmWOO5avUYGYcydOyUTUE3M+0/CnQju09ro3iPnqv37qegrHX9VflpfsX9bMR5/oKM4OsbdPf6EbSiiSnruQUqfEsDB+h69ibi1EJhuc7KosgEraRD3RBO/XcIUBLNdjiD+/Y2KNympoAi1Od8cSlPIPJAvj7ymRQ\r\nage: 76248\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0919e448698e4c993\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59546,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"eb8991eb9e0db175522c914343f0a10a","sha1":"ce2d41b154df64421d46bceaeb9878da455592dd","sha256":"b837b4e9fc693e5c65eb049c56547caefe1cf73ea31ae59f95ae46d052fd36b2","sha512":"7d2a886e3ac412f6ea1b1ba290064373e1d07a0751bdd7f546af3116ad057d1f17bbe4847179cdf87297a967c0290280ec0c51ab9bfdeb1da0b881e366eb19a8","ssdeep":"1536:hvA9R/SReJczzaRBd6s3DhCDnQcvyFVWGDnmhKYNa67:hIPVczevUIhCDnQc21C7Na67","tlshash":"dd430276882a8fcd499304944bf9afe164eaf19097b3cf91f24c5fe0423d184d881b6b","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-23T00:35:01.948279Z","times_seen":2225,"resource_available":false,"data":null}},"time_used":3711,"timings":{"blocked":-1,"dns":0,"connect":0,"send":2775,"wait":936,"receive":-1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/ecb/8f8306425ab46d0221b2c56ef50f72e487d5bb0255ee7333091abb7c08c465094a574c3c12d0e1812241fe43c0d5f0ea88d857f698a4fd081b","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:24.609Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /ecb/8f8306425ab46d0221b2c56ef50f72e487d5bb0255ee7333091abb7c08c465094a574c3c12d0e1812241fe43c0d5f0ea88d857f698a4fd081b HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://www.f27g.top\r\nXign: gjwrkZDkM4Ei7Q5JuAcj8BdhlxhErkN2Irr2veaoiUlSukS42GMdphnCC4+iC45Xo14XsVdaAahh+w48SDahtiYv8leRTi/oww71zLfSF1yB2ua9dRACYYCeAGbOG5CZ3SLH6tSSHgiuCTGKVZQ1dTmhwBMITcnX0hwKLLQETjk=\r\ntimestamp: 1779266124594\r\nsign: c7g7s3h7p6g5h5av\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: zM66WbX6JffCzAPYKHD3Gxnmh7JPTEYH\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:25 GMT\r\ncontent-type: application/json\r\nexpires: Wed, 20 May 2026 08:40:24 GMT\r\ncache-control: public, max-age=300, s-maxage=300, must-revalidate, stale-while-revalidate=30\r\nx-xss-protection: 1; mode=block\r\npragma: public\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=63072000; includeSubdomains; preload\r\naccess-control-allow-origin: *\r\nx-custom-check: true, true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266125=GYVCFswnvyg6HUDSML+socExrp5UkAsWNubxuJgkNJQuyrepjSJnquBEXK2tbNomTUMCEmx2bz/Zx81xexnn2501I5gu8oHvfpeTU+hwKZFg1eq7QRbu98y5EL0eF6/cm5BVPfzYlzamy2ubYGl01c2U3Au75r8nzF/ZL2oWQOUGxyrLv0uiwPId12KQ41yf\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44867bebb8ea\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":34431,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"2a756168a1aa5e02fe64f3a459c466fb","sha1":"743a9e9f24bf00feaf843bed7594c8e3a5fd93f1","sha256":"6e3b57568975e3586c0eeeefe21f2dcb236b1e5ad4d2d04883a4806dbad36420","sha512":"a3cf1fc5c5d0faba7c1da33693754bc5d2821d02a8b10db1dbd015a09f3b019599ff755ba05df752623dad4eec6c37bf50c49061d1b6abfda769bce77a7186b6","ssdeep":"1536:OHwnI9eO8Dfg6zvRxC3ZURb8pNV4Q44AAG1O:ewnROuIKRcJURgeQ44jGo","tlshash":"d833d1513641f334a7ba90fdf90352f4b1488ae1eafaf9d1e13515900acb23677af491","first_seen":"2026-05-20T08:35:52.512567Z","last_seen":"2026-05-20T08:35:52.512567Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3028,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3028,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/fonts/DINPro.9ee75b04.ttf","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.686Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /fonts/DINPro.9ee75b04.ttf HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.f27g.top/css/46431.1777369843125.7dc7cfcf.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:21 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 119892\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: \"69f08424-1d454\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\nserver: Nginx\r\nl-safe: 1779266121=XmZHeXpDp8mrTlECzx3CwVMw0lgg9mCwfNPuUgVS1EfLqO+e2UAfcjY+pEl8Ys2zTmimS5jFmMKcg1pYL+aVNhRpmHNFnE1Z/dEneumgWEZWSsyBS1kJwwsIS/0AKw+rl04TAaJBum9Xt1uPSR/HhtPeIBRoHYU8I/PMPS56o7Uo6LaVCKeddmikjch51DEb\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866d04b8c7\r\nx-cache-status: BYPASS\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":119892,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 10 tables, 1st \"OS/2\", 30 names, Macintosh, 2005 Albert-Jan Pool published by FSI FontShop International GmbHDIN Pro RegularRegularAlbert-Ja","md5":"028cefac160ed3b006f47106fbc68d1c","sha1":"efcecac09684435facd7397e4f6163a5069802c2","sha256":"fb841a09a82787982ad1774bdeb45e8e06ff4909161a9ce33fd42f8822c5ddc3","sha512":"3a5a284d0c4da6593b857ba785a4ba7d5f2e2b73d22a2ef25435b9558063d2486228d76a3cd5d3a59b5abe4c0da696a75373111b3569a94a9dea1516cf16091f","ssdeep":"3072:YhtN/CZnt1tbtKtHtFNgz1QZt0tbt2ktwtNstAtqNaEctWpy8TLtsIb66AUeo:YhtNGnt1tbtKtHt7t0tbtxtwtNstAtqV","tlshash":"5ac308c153e8fa4ad83996388511c7434226ff2de65d4f36ffd94d8c688e8e9064e6e0","first_seen":"2023-05-08T18:58:40Z","last_seen":"2026-07-23T01:16:21.480651Z","times_seen":5315,"resource_available":false,"data":null}},"time_used":5150,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2751,"receive":2399,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/kc523-1/noData/cms_moren.png?1777369782162","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.696Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /kc523-1/noData/cms_moren.png?1777369782162 HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: image/png\r\nlast-modified: Sun, 24 Aug 2025 06:03:49 GMT\r\netag: W/\"68aaab45-4d14\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nage: 76243\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866d04b8c9\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19732,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 215 x 214, 8-bit/color RGBA, non-interlaced","md5":"f3c825751a70d4aad8da2ce57f76acf6","sha1":"732da443668abb03a79a70df2d0ea8d801158655","sha256":"c395f4c1941459ef620f6df95fabd39f9ac98e03f6a389886bf224157557ce41","sha512":"a3b3fa2a216c10d331fea4771b916825d0605b94e21ac242d152d7c5e4b984cf3baad7a3fd071dde3432162037514d756cce1a0f699baf3dc98eaf75483c91b0","ssdeep":"384:64pTwcIHFqFpIlD8SqhwFLW/na2PvyQXSOKvOi58KUezsTT5ZOon:67XlROe8WvOAPHQv","tlshash":"a592d0d8abcb6705bb132b43b941a3558e0dfd6a130b9bb131782805ee16151e8d7e3f","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T20:44:13.565376Z","times_seen":2187,"resource_available":false,"data":null}},"time_used":2730,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2730,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/61f64c6fed854e80aa127dcccb952098?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.383Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/61f64c6fed854e80aa127dcccb952098?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:30 GMT\r\ncontent-type: image/png\r\ncontent-length: 29337\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 74099\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"61f64c6fed854e80aa127dcccb952098\"; filename*=utf-8''61f64c6fed854e80aa127dcccb952098\r\ncontent-md5: D/wANCoG1wKzFAdOFuCK3g==\r\ncontent-transfer-encoding: binary\r\netag: \"FslXbnML7fwNq5Gy3AuHxrRJjUUl\"\r\nlast-modified: Wed, 13 May 2026 18:31:49 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: t8j0obb2G\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: ZtcAAABvAxy69bAY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":29337,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"0ffc00342a06d702b314074e16e08ade","sha1":"c9576e730bedfc0dab91b2dc0b87c6b4498d4525","sha256":"1483118410516ced1d15d789cb8073fa0c6e581f539178b6fa164a777bda97ae","sha512":"159545b72a943feefe51080e029a9032e01c553efefda3d45b26c4aa638bc433504b671b846810ac0dc236a0b166a12b5ac251f35ce282b1504c178a9e515371","ssdeep":"768:9Wfbd3pSz+TVTSTAEXrjwKRl0nmneDwEYjuE:9WTzVTSTAEqnme6uE","tlshash":"ead2e017f3482668e4b8857f04cef284e1eb05515410ac477da4ef4f89fa92e9875b3e","first_seen":"2023-06-08T21:23:36Z","last_seen":"2026-07-17T19:10:31.989361Z","times_seen":181,"resource_available":false,"data":null}},"time_used":1774,"timings":{"blocked":474,"dns":0,"connect":0,"send":0,"wait":1026,"receive":274,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/index-399e2569.1777369843125.70d3d47c.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:15.129Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /js/index-399e2569.1777369843125.70d3d47c.js HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-5cf4\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266115=ud1RxWc4o642H/BkKCo6Aou8uBCszXJBX4YrRXnJoMGOZtO23U3mgpmEy8o4nhZut8tjleBzMvjD+6HY6BUfJZm/WqWxYMkqhgon6GBBbYCSo/Q25DkpOG18Kl2L1Fnz20dy/spCuS0SSJwM7pW/ZEK78glK4hpCd9hiziv1JQ87UreukqHKUYa9oGbrN5hn\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e448657e8b88b\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23796,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (23796), with no line terminators","md5":"6b35d598f9222431824849a2ef5b6359","sha1":"c7409a8c4b4e0d925aabc7be2afbb31941494256","sha256":"b82b7f362bca79155342b54e2494f4086e7181eba033c4b667ff885b2bc33439","sha512":"3fff55c5f39ae811ca094e65168d57fdd6ddeafb608e8209b24ed3587dbdcb4580c09ec8361c1db0557843a26bd10552e9a5a14ad827c876ecccef7036d8e689","ssdeep":"384:EZSANHmDGj4aePlBTSQwf+q0ht1wtzgNA2K88ZdZ11YcpK21p5F3oWf0Af/nBtUM:HnDGcPPlRef+BhtutUHKTZXYeT5FYxA9","tlshash":"0eb2b6e53392bdb4c24f9276f23a68ecc43f9151c34fc4f8d264bd947c98644aa92784","first_seen":"2026-04-29T03:41:13.403184Z","last_seen":"2026-06-08T22:37:37.025136Z","times_seen":423,"resource_available":true,"data":null}},"time_used":1640,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1640,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/22872.1777369843125.dbee35b5.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:15.127Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /js/22872.1777369843125.dbee35b5.js HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-269c0\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266115=ud1RxWc4o642H/BkKCo6Aou8uBCszXJBX4YrRXnJoMGOZtO23U3mgpmEy8o4nhZut8tjleBzMvjD+6HY6BUfJZm/WqWxYMkqhgon6GBBbYCSo/Q25DkpOG18Kl2L1Fnz20dy/spCuS0SSJwM7pW/ZEK78glK4hpCd9hiziv1JQ87UreukqHKUYa9oGbrN5hn\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e448657e8b889\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":158144,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"e916996ddfb5f1c6e2f6cbf5a87b5565","sha1":"7b3812a3cf8758cd6ce5a442d899048e27d1790b","sha256":"a50d9c1f28c0948f0d468428aec46c5d300a84fb71ce27e6790ca8e0f40a955a","sha512":"c5fe69584b305477ce1b4bb12d6a9b4ce2c73ddeb07c133f14d7ec7782b743769b4f48824f326be1ea00c53835dda635e0011b055c6af3ad0876a0344d6be794","ssdeep":"3072:PHW7tB4Vgj5tNlxyUYwOW1YegxYffj7TEOiG1Zl+DJVkzEcx1nKs:PHW7tBwgttXxyUYwOW5ffjAG1T+DJVkV","tlshash":"76f30bd4f2c070f6475f85f2a2275065b26f4d92318c98b0e15ba6547f21b48c7abeec","first_seen":"2026-04-29T03:41:13.30041Z","last_seen":"2026-06-08T22:37:37.007921Z","times_seen":423,"resource_available":true,"data":null}},"time_used":1642,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1642,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/0ee574d31010469e8e324a6597c63e5b?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.371Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/0ee574d31010469e8e324a6597c63e5b?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:29 GMT\r\ncontent-type: image/png\r\ncontent-length: 181841\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 77699\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"0ee574d31010469e8e324a6597c63e5b\"; filename*=utf-8''0ee574d31010469e8e324a6597c63e5b\r\ncontent-md5: lBS80lQ1cEfD/NYCa/+QxQ==\r\ncontent-transfer-encoding: binary\r\netag: \"Fn_DOpw7FqVvzd5JI9Z3fU7Mp2w0\"\r\nlast-modified: Wed, 13 May 2026 18:31:38 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: y8igvY8pT\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: uLcAAAAvfF9z8rAY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":181841,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 390, 8-bit/color RGBA, non-interlaced","md5":"9414bcd254357047c3fcd6026bff90c5","sha1":"7fc33a9c3b16a56fcdde4923d6777d4ecca76c34","sha256":"284d986baff896d8721e8bdf2ee8879d7fc6b0025571ed8f316d3798f3ccee53","sha512":"61336ba4d9865179d22057b2dec126dbcdd7fbe4c318bef687747642b63b2c247902a73d76523c8d85c9e6ba60ec051d593b3d2cdcfa62359ac900a8a98526d1","ssdeep":"3072:+F2kpVVEbMJiWLsnxt+CYX2T9vHBbtQeGF+VOyOYXph4Gd6NVPB496iYKuMozOO:+XJkAsxtxYMtQeGwQTYXb4/rZ49+KKzx","tlshash":"a604125d9edf2ad753ed7cabe1f0d180e943d017e46136c5538ccae62a633510f05aa4","first_seen":"2025-09-21T04:12:33.901438Z","last_seen":"2026-07-17T12:51:04.982387Z","times_seen":162,"resource_available":false,"data":null}},"time_used":2084,"timings":{"blocked":484,"dns":0,"connect":0,"send":0,"wait":1026,"receive":574,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/8544.1777369843125.875d684f.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:15.125Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /js/8544.1777369843125.875d684f.js HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-3ff6f\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266115=ud1RxWc4o642H/BkKCo6Aou8uBCszXJBX4YrRXnJoMGOZtO23U3mgpmEy8o4nhZut8tjleBzMvjD+6HY6BUfJZm/WqWxYMkqhgon6GBBbYCSo/Q25DkpOG18Kl2L1Fnz20dy/spCuS0SSJwM7pW/ZEK78glK4hpCd9hiziv1JQ87UreukqHKUYa9oGbrN5hn\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e448657e8b888\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":261999,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"136fc52b262ec03558367f9d050dd488","sha1":"42d2e74acd67477c27524bb4b17399c3c8a5044c","sha256":"7c0850eefec0bebf32593d27d1d85e262ddea0700c9179c4a1396556d6ccf3c2","sha512":"c7c19dcaf0d7f95397efb2d6e96bf11b3e750a26bff4e9bf6a1ed4c53e3b16b75dd5a728e2d2b490b0431acc27ff1849088c26999912f191b672a683ee2b8333","ssdeep":"6144:y/rOTURxxB0Jjytg7DiQPkcsz1aL3p2YO+WidjHrrL:qiJjytgPJPT3p2YpHrrL","tlshash":"bb442c44b291f0b8879b42f7922b4056a17f48a1308cacb4f295ed90be7555c927fbfc","first_seen":"2026-04-29T03:41:13.358323Z","last_seen":"2026-06-08T22:37:36.998727Z","times_seen":432,"resource_available":true,"data":null}},"time_used":1644,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1644,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/undefined","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.618Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /undefined HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: text/html\r\ncache-control: public, s-maxage=600, max-age=0\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866c7fb8b5\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"GeeTest","description":"GeeTest is a CAPTCHA and bot management provider, protects websites, mobile apps, and APIs from automated bot-driven attacks, like ATO, credential stuffing, web scalping, etc.","website":"https://www.geetest.com","common_platform_enumeration":"","icon":"GeeTest.svg","categories":["Security"]}],"data":{"size":24409,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5777)","md5":"de12f9ef6903679d754b67293200edd6","sha1":"fd38488a0db4f56c62536cbdb4c5957ca9091148","sha256":"735a322de1f2ded527f569184d7c6c57ddaca2726df1b527386667704e130688","sha512":"6e460e29f99686c44c928a124be7cdc3b1633d6584c9d7e0256c69a1d328ec0cbe7f401d79385a18d16d458606e132567e8f7fa5e4e7ce56a3ffadc6c7b63b95","ssdeep":"384:Eo3ERrxqNBPJ+96junwIX2VwiYwJvSoVXsp+pa/iZcVk97g6nMusplIiz:EpRVqrJ46junwIXiNYiKop/E6wkpcu2T","tlshash":"62b2185a9df349762523303a1fbfb20879b0c0274209ed443e4de7594fd59aa42e3be6","first_seen":"2026-04-29T03:41:13.317002Z","last_seen":"2026-06-08T22:37:36.995773Z","times_seen":428,"resource_available":true,"data":null}},"time_used":2809,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2809,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/img/license.ea57c78d.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.672Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /img/license.ea57c78d.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-7b8\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nage: 76242\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866d04b8c3\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1976,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 161 x 52, 4-bit colormap, non-interlaced","md5":"60a2c7c150b01809fbb7b97932684b5b","sha1":"67fc9647c452a17b519c6a51dc8c38daa23755f9","sha256":"c5ce31558a1f979ae78c7779d2f312b196750375541e9c147b73d6e44d47c276","sha512":"2328442fa1c74e47c6eff4adab55920c7e7738e7ae51bd2b222fb696bbcf8201a14805089a33baa80c28a40db47061048d817c384bd72735b2e0c0116ff63c6f","ssdeep":"","tlshash":"b3412a6266729beced1a8c47592c7df1d8338ca1a200e1c150ed761f1bf8e1060e7a94","first_seen":"2025-08-29T11:05:53.23289Z","last_seen":"2026-07-23T00:35:02.038433Z","times_seen":2324,"resource_available":false,"data":null}},"time_used":2764,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2764,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/140cf1bd248e463e9540b017f14989b5?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.374Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/140cf1bd248e463e9540b017f14989b5?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:29 GMT\r\ncontent-type: image/png\r\ncontent-length: 27726\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 77699\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"140cf1bd248e463e9540b017f14989b5\"; filename*=utf-8''140cf1bd248e463e9540b017f14989b5\r\ncontent-md5: uS19IKsxmofEQxS/d58Rmw==\r\ncontent-transfer-encoding: binary\r\netag: \"FgM8WoddJSJhpAbBJijqIdeXScF8\"\r\nlast-modified: Wed, 13 May 2026 18:31:39 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: rrw75ijCH\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: pu8AAABzYGlz8rAY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27726,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"b92d7d20ab319a87c44314bf779f119b","sha1":"033c5a875d252261a406c12628ea21d79749c17c","sha256":"489cbd723256fb665e160db96761a3095fd9bbe21c29049adb21a64c7cfa8f3f","sha512":"a77f984a96b09acbcd3659ae7569ddbdef794c78d5cdaa392447dce0fa3e7a6e0254349c058f295463088b1fe45fa6fc984496864de283692171648b75649f80","ssdeep":"768:hexKfZi/N1Dcdeabcun13eOffsQCQ/5t8XBhe2fWtjzY+cZ:oKfZs1ScQ13DcA8XXBfU3M","tlshash":"eac2e1396c58ade49794058826a73fd3b4f1e283cdf81f4326763027808d6fd56b4ac0","first_seen":"2023-05-19T01:28:08Z","last_seen":"2026-07-21T13:19:18.620361Z","times_seen":397,"resource_available":false,"data":null}},"time_used":1712,"timings":{"blocked":481,"dns":0,"connect":0,"send":0,"wait":1026,"receive":205,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/31098.1777369843125.4108b3dd.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:25.598Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /js/31098.1777369843125.4108b3dd.js HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:25 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-561e2\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266125=GYVCFswnvyg6HUDSML+socExrp5UkAsWNubxuJgkNJQuyrepjSJnquBEXK2tbNomTUMCEmx2bz/Zx81xexnn2501I5gu8oHvfpeTU+hwKZFg1eq7QRbu98y5EL0eF6/cm5BVPfzYlzamy2ubYGl01c2U3Au75r8nzF/ZL2oWQOUGxyrLv0uiwPId12KQ41yf\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44867fcbb8f1\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":352738,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65338), with no line terminators","md5":"31b93b7d8dfa0ca7f3f8477f00d0366b","sha1":"734c41538b3d1db2c12b2472b43ed1e86c79251d","sha256":"30c9d4b0f76502c14b849d636bb84d74c4e5caae97b1d650febe724d0f5cf2da","sha512":"dc141065235c7f28f7e4caed203c4d4cbf749bf1c651567bad15cd8225fd297099b4330a2b3d5d810e3a07af90a7e013ed13bd03a45d5018b9d8be708da4b872","ssdeep":"1536:d+0YvC9jlTKAUSseG1SY46DCdlBBo3AgXOG9AsqCfCXsvCfCXsLCfCXsyCfCXsfX:AKK5sY4brG7O3SnLJNpL","tlshash":"d174b6f4c248c6fdea04ce0a7e7d6f2d50723783f2ec56c446aaf8865e92857245c4da","first_seen":"2026-04-29T03:41:13.322286Z","last_seen":"2026-06-08T22:37:37.042508Z","times_seen":372,"resource_available":true,"data":null}},"time_used":2038,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":2038,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.esportsdata.cc/202/1/27bec1439fd3ddd68eaa23753804f4e5.png?win007=sell","fqdn":"img.esportsdata.cc","domain":"esportsdata.cc","tld":"cc"},"ip":{"addr":"172.67.70.146","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.339Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esportsdata.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 16 May 2026 05:13:55 GMT","end":"Fri, 14 Aug 2026 06:13:50 GMT"},"fingerprint":{"sha1":"7B:E3:E8:7B:91:D6:3E:9F:F0:F7:3A:7C:C5:7A:54:CE:9B:6E:14:ED","sha256":"68:DB:B9:F9:00:0A:BE:FD:15:45:47:19:18:DD:59:D1:DD:43:B2:42:8E:7C:EB:50:14:F6:0C:3B:FC:5D:CD:67"}}},"request":{"raw":"GET /202/1/27bec1439fd3ddd68eaa23753804f4e5.png?win007=sell HTTP/1.1\r\nHost: img.esportsdata.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:29 GMT\r\ncontent-type: image/png\r\ncontent-length: 5349\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"470a5e0b2673e28f29cadd5f06643a4b\"\r\nlast-modified: Wed, 11 Sep 2024 07:05:37 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin, Accept-Encoding\r\nx-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nx-amz-replication-status: COMPLETED\r\nx-amz-request-id: 18B0A69F75BB6038\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nage: 4116\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ICXjTJS4ZQva3H0QeAcIQCtHn9Z4O%2BSS6%2BjKZeox%2BK4ZUP6%2BMWXT1zdtQjEZsM4YmvH6ZSjLgrN5NrdYlW%2B8%2BmbKvR5pF20BwiLCb9ssWvbzeOhTrtPGV8GKmZB7FYPTnGIqrQ%3D%3D\"}]}\r\ncf-ray: 9fea021ca9031a30-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5349,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"470a5e0b2673e28f29cadd5f06643a4b","sha1":"b02a4f407b5beea38804252582aabfd2708dc63c","sha256":"15bb268f654403c548c49b59268a68630f1ebfd3291eb09fb961c7fcc7e206a5","sha512":"5224825b152b42c9a65750a50aeb5db3c90a2bba2e3f52a05c7d70311ae591c7cefbeae18f3bd55d87769df860ab734e04d9ecf62f664ab904a3a1c9dc593990","ssdeep":"96:8jTsPlsIpNrFFIQMzNlGQVFzmUt1rAQ1L1zWY1xbAis:8olPNrFeQKVFFzrAQx1ykbAis","tlshash":"15b19e604396bc3269fc974d72d1b93d88c6060119a8f9d7c300e1b907ea24568f277f","first_seen":"2025-08-18T06:00:57.637608Z","last_seen":"2026-06-12T19:29:57.271005Z","times_seen":46,"resource_available":false,"data":null}},"time_used":118,"timings":{"blocked":49,"dns":24,"connect":4,"send":0,"wait":9,"receive":1,"ssl":27},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"img.esportsdata.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"img.esportsdata.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/5a166bcf5afe4afe9624b5f7b5eeadcb?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.375Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/5a166bcf5afe4afe9624b5f7b5eeadcb?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:29 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 7372\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 75597\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"5a166bcf5afe4afe9624b5f7b5eeadcb\"; filename*=utf-8''5a166bcf5afe4afe9624b5f7b5eeadcb\r\ncontent-md5: D5+qzvoU4Tb/NNFugwe/2A==\r\ncontent-transfer-encoding: binary\r\netag: \"FmOEizvP6U_T7KWDYzQ6v6JiOImr\"\r\nlast-modified: Wed, 13 May 2026 18:31:44 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: yWxmAWQsO\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 1L8AAAAd6Ndc9LAY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7372,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"0f9faacefa14e136ff34d16e8307bfd8","sha1":"63848b3bcfe94fd3eca58363343abfa2623889ab","sha256":"8b4ec2d512e9af06c22ad78e16d73ee47111d15e6b14b0f2e862ecf371dd3e66","sha512":"217a0933d5329ffe3131c69f72a85d09bfd151a70891455929f15b23e8c8d9e73a4eaf616f7a4b5f8b37a72723bf1af67c2df8337ace2713c0b6b86b06831ad0","ssdeep":"96:UWTtBbfUj+kVnoLiPvHGt5jtflUYRWBdxEE9CqqxJpvUTzFK2lNJiPTu98Q1K:dA9GcvmftfPOxK9vU1bNUTUPK","tlshash":"07e1b0925322f67c6d0fbbb6c8360c4808e5097c3f5ced06692b86192a1516c897e5fa","first_seen":"2023-06-26T22:05:03Z","last_seen":"2026-07-21T13:19:18.445178Z","times_seen":184,"resource_available":false,"data":null}},"time_used":1711,"timings":{"blocked":480,"dns":0,"connect":0,"send":0,"wait":1026,"receive":205,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/home.1777369843125.1e63fe95.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:19.509Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /js/home.1777369843125.1e63fe95.js HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:19 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-2f453\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266119=vIGhvkpeFlPE9AIL6BAPcHr59woHmm1S4cyg4M29F2mnKVEVlQIDQgEe525ibJetrA+iEjvMxITadmXHnWqJ8+/cHivFwJCx/h1AKP1T/4NN8RV+Gq2Vd1bQaOQo0kNGRAtHU1Q3BMs9yw1LxObt4ntrGKefjTHuInEbwMF8Dn0NK2grbqRsJvBTjY7bLazr\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866802b8a5\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":193619,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64126), with no line terminators","md5":"ac7180fee301b4b62de750803a778412","sha1":"b70eb6223cbd147c8dc23df4d073e9dc641927d5","sha256":"25b167f413e31989cc5856e80f67902b0e84efed7087cea17ec1b5b0dcda5b68","sha512":"4fe2d812d406c786a2204a4f4b370217f4cccb1bf61cbea821e648667325ad32057d1aa30504952de28142b1f4fa0c523f55298834cb567631cc2b7cd37355b6","ssdeep":"3072:f+YNGVSIMctwiYJBuopQuFdBlGLuJuhxffj7TEOiGRlp:f+YNGVSIMctwi+PjFwzffjAGHp","tlshash":"b5140880b5f0e275576fd2b7d7371024b2271686d0ccac60e1f66b187e28796b236db8","first_seen":"2026-04-29T03:41:13.306134Z","last_seen":"2026-06-08T22:37:37.025672Z","times_seen":419,"resource_available":true,"data":null}},"time_used":450,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":450,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/ecb/8f8306425eba6e0167bcdb25a31b67ec8f","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:24.600Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /ecb/8f8306425eba6e0167bcdb25a31b67ec8f HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://www.f27g.top\r\nXign: UKqIegouChTQtlh1W0fRVYtbJZP/HjhBd+XSkRKA0VEan2TsM1YG2Pr8jPmbfTqhqzdCvFAOhaJZm1u4vhlhZIf9UYj+7hquaokkQZOmM7T/P9PvVw11xHYonTuZhXv5k0z/C970Nu+RlkjRFcUcVuub+eh1P2hcC2RXjpBJ+hw=\r\ntimestamp: 1779266124594\r\nsign: 3v2e2h1k29686s6u\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: zM66WbX6JffCzAPYKHD3Gxnmh7JPTEYH\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:25 GMT\r\ncontent-type: application/json\r\nexpires: Wed, 20 May 2026 08:38:24 GMT\r\ncache-control: public, max-age=180, s-maxage=180, must-revalidate, stale-while-revalidate=30\r\nx-xss-protection: 1; mode=block\r\npragma: public\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=63072000; includeSubdomains; preload\r\naccess-control-allow-origin: *\r\nx-custom-check: true, true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266125=GYVCFswnvyg6HUDSML+socExrp5UkAsWNubxuJgkNJQuyrepjSJnquBEXK2tbNomTUMCEmx2bz/Zx81xexnn2501I5gu8oHvfpeTU+hwKZFg1eq7QRbu98y5EL0eF6/cm5BVPfzYlzamy2ubYGl01c2U3Au75r8nzF/ZL2oWQOUGxyrLv0uiwPId12KQ41yf\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44867be4b8e8\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3849,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"6317e888b1099b3e3511fc0270b7455a","sha1":"4b62528514636798930ec9b72e33369ebea56b07","sha256":"2d63b4867b4b2d4c02326f6649d94471c9ac35d66b3eda921d9fd224aa6d3308","sha512":"482258b4af2f969cc4b389b001b877d8a596e64b14a63a1372489f9c3d7f795af396fe12d94893920087e2e1218d9df57f54bbcfaebfc9467ad3b69d95f23b03","ssdeep":"96:eOGS7hTEAzTPZRNe4vK2Ha1A5Zfzg4j0RdyQ9LGoUcOQXemJmVT12FqhuYRTYx:VP7SaJe4nHKEzgvR0QokufFpTYx","tlshash":"27c18e92a727af20e1063cf82833d6d11ec27b64ebd11984e8352a952fb465f4b9d302","first_seen":"2026-05-20T07:27:33.71039Z","last_seen":"2026-05-20T08:35:52.538534Z","times_seen":8,"resource_available":false,"data":null}},"time_used":3034,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":3034,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.esportsdata.cc/202/1/2dc43aced237a30eda64c2e4dff1a090.png?win007=sell","fqdn":"img.esportsdata.cc","domain":"esportsdata.cc","tld":"cc"},"ip":{"addr":"172.67.70.146","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.330Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esportsdata.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 16 May 2026 05:13:55 GMT","end":"Fri, 14 Aug 2026 06:13:50 GMT"},"fingerprint":{"sha1":"7B:E3:E8:7B:91:D6:3E:9F:F0:F7:3A:7C:C5:7A:54:CE:9B:6E:14:ED","sha256":"68:DB:B9:F9:00:0A:BE:FD:15:45:47:19:18:DD:59:D1:DD:43:B2:42:8E:7C:EB:50:14:F6:0C:3B:FC:5D:CD:67"}}},"request":{"raw":"GET /202/1/2dc43aced237a30eda64c2e4dff1a090.png?win007=sell HTTP/1.1\r\nHost: img.esportsdata.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:29 GMT\r\ncontent-type: image/png\r\ncontent-length: 4261\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"ffef9dd4fa2de7b93ba8185ac4688244\"\r\nlast-modified: Wed, 11 Sep 2024 06:47:09 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin, Accept-Encoding\r\nx-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nx-amz-replication-status: COMPLETED\r\nx-amz-request-id: 18B1355FBDA44864\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nage: 4116\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iLgjCNvXsLYuwPM34odFAX1FJXdnpVPOoSu3PmwagNZU0q51Vs299JAWj1DuWdQXAqElXT8qxXM8JiyG%2F0YRQfiZnubjWgqoNp2g1y070lGRh86uOLoxjKBwHdEETkNul2srtg%3D%3D\"}]}\r\ncf-ray: 9fea021ca8f01a30-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4261,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"ffef9dd4fa2de7b93ba8185ac4688244","sha1":"cb6b71ea766b22ad0005fb47e7225372f4351d66","sha256":"e1b08953d4cd3e41d4b0bd118dd196c696b5fba6489cab3cb9fd8c9e8eb08587","sha512":"1ca9bd740382c10bb6cb4c6c1de63cee42f278d1c39c504e76236c0206033bca1fdda34e42879a96d57131a7d3c772777fa1b650d3cf0e0d75227b98994bebfe","ssdeep":"96:oDsC2CNc2arnki8DZrctsmB7NruNEUUlgthCExBqSCzjOooQ:yp5NrarnkisZrUPVKEUUlgtoSCz5oQ","tlshash":"ea917db80c6b4695de657f31a1fdd384f0f83a28f6b7d68925a8ac34bdc03462679340","first_seen":"2025-10-10T08:25:33.490951Z","last_seen":"2026-06-17T11:08:58.30569Z","times_seen":49,"resource_available":false,"data":null}},"time_used":129,"timings":{"blocked":56,"dns":30,"connect":1,"send":0,"wait":9,"receive":1,"ssl":29},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"img.esportsdata.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"img.esportsdata.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/kc523-1/sponsor/sponsor_nav_web_3.png?1777369782162","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.644Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_3.png?1777369782162 HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: image/png\r\nlast-modified: Sun, 24 Aug 2025 06:03:49 GMT\r\netag: W/\"68aaab45-1cf4\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nage: 76243\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866c7fb8b9\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7412,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 206 x 332, 8-bit colormap, non-interlaced","md5":"eb94a297c215863d5d2232eaa67f4779","sha1":"d006f382f63ada4e4ef65d124a75eac2e4e72dd0","sha256":"6bd46b617bf27cb28fb798d50b2d6daa2aaed1a278ed50e9aa549b6e4fac48c3","sha512":"dc7759393acb5e7d1a635b4d91d73e84abc41fe6afde99a85a8e4ed6f4f8b1b5819bbcaa80b1c213c00c89df8b81db512a7bff142b24c50565ff1e6289f1a30c","ssdeep":"192:Sfq39wgHGYB1fcUWobKUUR6IHaDmzDxfbTow:uQ9gCEUWoWUe6DeJQw","tlshash":"94e1ad76a7f6d695a6b7908cfece94050fbba2722c6352762b7b8c02170c339525b411","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T20:44:13.599681Z","times_seen":2139,"resource_available":false,"data":null}},"time_used":2786,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2786,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_aa2a4724-288d-4252-82c6-453d0458d8c1.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.172Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_aa2a4724-288d-4252-82c6-453d0458d8c1.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:32 GMT\r\ncontent-type: image/webp\r\ncontent-length: 49050\r\netag: \"bb2aa8a4e812ea372888371e3493b542\"\r\nlast-modified: Wed, 10 Dec 2025 11:52:08 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b%2B%2FkLPhZA4QY76%2BGVMxkCUS9diCOrKbZTFHNf%2BntE5h3Y%2BjOYyl%2F7FjNAyg617xoxC75H6HgDa%2FlQXkTonmUPk4T22XMu0aHhTKlSvkI4R%2Fr6LX%2F%2BHTXfSfMkr8zam2lemBHEH2PAfqd9KJHTb%2FVr0g%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 76252\r\ncf-cache-status: HIT\r\ncf-ray: 9fe2bc90cc221c41-HKG\r\ncache-control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\nserver: Nginx\r\nl-safe: 1779266132=N/QnbzZ2AZFVQCEm7JFlxb/Bt7QEyfiTmWOO5avUYGYcydOyUTUE3M+0/CnQju09ro3iPnqv37qegrHX9VflpfsX9bMR5/oKM4OsbdPf6EbSiiSnruQUqfEsDB+h69ibi1EJhuc7KosgEraRD3RBO/XcIUBLNdjiD+/Y2KNympoAi1Od8cSlPIPJAvj7ymRQ\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0919e44869a0fc9a4\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":49050,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bb2aa8a4e812ea372888371e3493b542","sha1":"4a36a3e778cd1cfaa8cbecc34e70d024963106a5","sha256":"fe97bdaee3660ca686cab03b1ef7af16d387780811e739ac2271082c7d4bb489","sha512":"f5ffb0368751705c8584d3a6bafa79c865cf33c0d4d8e58f06404807864ceefc41d20cd1162c01b17afcbc438a2fb2ed4f92b8f80938387b012bdd10e0ff2302","ssdeep":"768:6UQ6Jz2sCQ6dza0R/4YUaVSjgKLnkBM/jScHyXLEcDs5Op2jbOKz6im:tD5rCRNa0R2aOgKzkKucHybEcLKwl","tlshash":"2323f1d8f25dd108f9c51d3e9ebe898e6cbaeded3ec998c6224cd81c041494678d6623","first_seen":"2026-04-24T23:10:16.759919Z","last_seen":"2026-07-23T00:35:02.053032Z","times_seen":882,"resource_available":false,"data":null}},"time_used":4682,"timings":{"blocked":-1,"dns":0,"connect":0,"send":2837,"wait":938,"receive":907,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/img/CHESS.80cb714e.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.216Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /img/CHESS.80cb714e.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-e587\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266132=N/QnbzZ2AZFVQCEm7JFlxb/Bt7QEyfiTmWOO5avUYGYcydOyUTUE3M+0/CnQju09ro3iPnqv37qegrHX9VflpfsX9bMR5/oKM4OsbdPf6EbSiiSnruQUqfEsDB+h69ibi1EJhuc7KosgEraRD3RBO/XcIUBLNdjiD+/Y2KNympoAi1Od8cSlPIPJAvj7ymRQ\r\nage: 76249\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0919e448698e6c99a\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58759,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"727b4dc207a4141335b27fa73f76fb10","sha1":"bb63b02e635f5503d76c4fc3532c2c652a06cac8","sha256":"5d840214ae46c94540df7d0a94963cc398b32c7b868edddb6a4f2a2faf113e42","sha512":"c1512f9d9a191ea10e806fe3a8f812f78dec9832568373b7b5362fafe9aef6783947d248deb2fc8d30ba1c61fd3b94f308298e69c1de32686110fa35f7bd4ed4","ssdeep":"1536:gtPCh483gu6aLw9AJeteTzkprgTWEHbP4BzrJ:344U9Xte3kprgKE7gZJ","tlshash":"0543025a13c1159f422f37b8148758a6d8154f9f38f32ea11a9e2afda58cb0af431c3d","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-23T00:35:01.903138Z","times_seen":2243,"resource_available":false,"data":null}},"time_used":3715,"timings":{"blocked":-1,"dns":0,"connect":0,"send":2778,"wait":937,"receive":-1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/chunk-init-1656f0b4.1777369843125.32336986.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:15.120Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /js/chunk-init-1656f0b4.1777369843125.32336986.js HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-21366\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266115=ud1RxWc4o642H/BkKCo6Aou8uBCszXJBX4YrRXnJoMGOZtO23U3mgpmEy8o4nhZut8tjleBzMvjD+6HY6BUfJZm/WqWxYMkqhgon6GBBbYCSo/Q25DkpOG18Kl2L1Fnz20dy/spCuS0SSJwM7pW/ZEK78glK4hpCd9hiziv1JQ87UreukqHKUYa9oGbrN5hn\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e448656c4b884\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136038,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (44088)","md5":"a1aee3b4fdd378acbf851a367f523d6d","sha1":"9b808ee6cd84b9e3969901470ae1c2d1df800ea0","sha256":"a20ad3a83af7751da30c420d96705aa78f39ddbf610789296ce2b47ec3788179","sha512":"71c83f283537df70e91f49c73fe8554e59830f75caf60f372888692946e7c08ca9f13519f082c45ff310ba269151a9a2955fdf6fbc37b68ca4f1e348303725bf","ssdeep":"1536:2twqIPBoVbzfsO9ZuqpiXXIOU6Qgpp6KkB2EnBDsAxdrkm4SgiqvHynjM5TCifM+:2twqhOIK2nCLdyACifMur06/D","tlshash":"30d3ec54b7d0b4b442cf13e6711b2475e3a61ca22058e8f0e31dee647f35689d26faac","first_seen":"2026-04-29T03:41:13.388607Z","last_seen":"2026-07-10T22:25:54.117178Z","times_seen":442,"resource_available":true,"data":null}},"time_used":1043,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1043,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/img/vs.21f89f73.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.394Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /img/vs.21f89f73.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.f27g.top/css/home.1777369843125.0fc9d8d4.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-51a\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266132=N/QnbzZ2AZFVQCEm7JFlxb/Bt7QEyfiTmWOO5avUYGYcydOyUTUE3M+0/CnQju09ro3iPnqv37qegrHX9VflpfsX9bMR5/oKM4OsbdPf6EbSiiSnruQUqfEsDB+h69ibi1EJhuc7KosgEraRD3RBO/XcIUBLNdjiD+/Y2KNympoAi1Od8cSlPIPJAvj7ymRQ\r\nage: 76246\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0919e448698e6c999\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1306,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 70 x 28, 8-bit colormap, non-interlaced","md5":"41cff06a80e61ee3fcd32f7c29a6493e","sha1":"bb70bb0a3a0fde7a132788777aee629392c756e9","sha256":"3240fcea2e4168dc863b8aea602750e6a1fe11a557c18ac6a381781ef487746b","sha512":"fce7ff9f62b51c4f8994f0a8ec4a56f21570d0cd163471d99b357eb0a9a735c800b389c4a8a611ba441b208cea7eb483140042f5d11ef110b591c1c1898bbb8d","ssdeep":"","tlshash":"e921eaffe15b2c75ccb59bb3bc6c12656809582970866b137125e7588c539217f0c461","first_seen":"2025-08-29T11:05:53.184813Z","last_seen":"2026-07-23T00:35:01.951847Z","times_seen":2246,"resource_available":false,"data":null}},"time_used":3542,"timings":{"blocked":-1,"dns":0,"connect":0,"send":2606,"wait":936,"receive":-1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/img/no_data.02e9590c.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.540Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /img/no_data.02e9590c.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T04:24:25.861741Z","times_seen":17468186,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/img/help.4e3cf897.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.668Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /img/help.4e3cf897.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.f27g.top/css/index-399e2569.1777369843125.a7b0b4f4.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-2852\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nage: 76243\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866d04b8c0\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10322,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"6dd52a6a4d07f2786b1926fac1b4b06a","sha1":"9c9908204401fbe65d33cf7df8881639d6aea37d","sha256":"e02471f47b506ab510d0e0dc4224cffc03c34f950b649ce347ccd71af0bcf0ab","sha512":"fdd52f532e5c2e2c182db20e2053eee0ca8c26cec51ff75e1bc341b01911461ac72fa75887fa3114188ba32aa6341c0974d81d071fc42b605e72f73dfb87ab9c","ssdeep":"192:x0C+pMwjX2XZ456BAJu+1KzdjCfDrRq6wUPlJyh2h4PAmWP5yQSkHxfYX32H5TRm:EjGXZau+1MjCrrRLlqGOnWcQSkRQX3IG","tlshash":"3822c054370836084f737a4362ac4e837a06040ffdf9b7919a6372659a5b94e44cfb66","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-07-23T00:35:01.91879Z","times_seen":2419,"resource_available":false,"data":null}},"time_used":2768,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2768,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/img/service.68be110a.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.669Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /img/service.68be110a.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.f27g.top/css/index-399e2569.1777369843125.a7b0b4f4.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-2991\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nage: 76243\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866d04b8c1\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10641,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"993784a38ddc1156572bfc3308055ead","sha1":"becff431867226bf323b5a6535fa383992f107eb","sha256":"abca3af980888b08c6cbd57366b3ac94344d66ea048484c4f9867e300ee8703a","sha512":"48790c6340f273a58295fc6607306353ab69d5a818569fe36ef1bffc8fff084b23d37b401e10502b830c67a5efedca56c1c9d778d6198e4069018d055f1869f0","ssdeep":"192:NdsarkpjwOOmfStcnaHtzB3l2eKD9RdfXtRqi3ln+ojjjKMGlnyL5H7nx+:nJQpjgOz9Dd0orKMGlnA5Hbs","tlshash":"8822c0c41e1be1b6d2ffa916b28543a04b3421fda1a24c342d828c04ccad56ac91f9e7","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-07-23T00:35:01.94592Z","times_seen":2404,"resource_available":false,"data":null}},"time_used":2766,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2766,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/img/appdown.6e7c9177.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.671Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /img/appdown.6e7c9177.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.f27g.top/css/index-399e2569.1777369843125.a7b0b4f4.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-277f\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nage: 76243\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866d04b8c2\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10111,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"716d097b193628397635cfac41b561fa","sha1":"545d1876219bed15fe850a499a08322de6a26866","sha256":"50276d87fae9c1e30a32c32b4e90dcc2e227cabb4e3bb1d60ecb22fb50c5f2ff","sha512":"47ea5928e921bec4ce4d9c807ee921f6115a6dd27af6fa7325e6d988058d22cf36c03693ebc56665203809cfd6d008cd410380e688e90b36d7eeec18ce6aa92f","ssdeep":"192:cALsiDRih/bWKl4Hq2BHZE6+3paMeCsuTvB6hi6tswYmd:lBEv2Hq2BHS1ZaMJtB+tsud","tlshash":"4622d047a584327b826ec79c8fe98c112470ad1ce6f04d5ac44e711128e8df3503baf2","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-07-23T00:35:02.005526Z","times_seen":2388,"resource_available":false,"data":null}},"time_used":2766,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2766,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/chunk-common.1777369843125.4adb46f5.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:15.122Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /js/chunk-common.1777369843125.4adb46f5.js HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-2717b\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266115=ud1RxWc4o642H/BkKCo6Aou8uBCszXJBX4YrRXnJoMGOZtO23U3mgpmEy8o4nhZut8tjleBzMvjD+6HY6BUfJZm/WqWxYMkqhgon6GBBbYCSo/Q25DkpOG18Kl2L1Fnz20dy/spCuS0SSJwM7pW/ZEK78glK4hpCd9hiziv1JQ87UreukqHKUYa9oGbrN5hn\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e448656c5b885\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":160123,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"fd30be8efc49091ace6b6cba1d19f85e","sha1":"dcb13a103a96a9346297f81fa22518579b7694b7","sha256":"5aeec070f92421551adae5477625ba84ca8f44c1fc9c181efb18e241c0179776","sha512":"42df127ca6094903dba8af9a2166ce68c1386c59b2d7e48071f6c33ffe1c0e81b2a3673efd413142e6699be9719f79f6172c9f5aaea6fd8d45518f8d09aef6df","ssdeep":"1536:bvBBzbgGcdWUa2UTf6oryXHuLmbErF/G7D1dMI59HTsY5kN/voVGAClVbGD3tFkK:bvBBfRTf6yjFetHTsY5s/voVGAcgD3t","tlshash":"0ff3e8c5b3a0f07e9a1ed53779331499b12f758278c87c60f1a1ade67f1a704a436ca8","first_seen":"2026-04-29T03:41:13.32854Z","last_seen":"2026-06-08T22:37:37.031571Z","times_seen":432,"resource_available":true,"data":null}},"time_used":1042,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1042,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/index-a3dad144.1777369843125.66a58dcd.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:15.128Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /js/index-a3dad144.1777369843125.66a58dcd.js HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-56b20\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266115=ud1RxWc4o642H/BkKCo6Aou8uBCszXJBX4YrRXnJoMGOZtO23U3mgpmEy8o4nhZut8tjleBzMvjD+6HY6BUfJZm/WqWxYMkqhgon6GBBbYCSo/Q25DkpOG18Kl2L1Fnz20dy/spCuS0SSJwM7pW/ZEK78glK4hpCd9hiziv1JQ87UreukqHKUYa9oGbrN5hn\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e448657e8b88a\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":355104,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64580), with no line terminators","md5":"8f57c1049706bcd7e166bc3fdcc8865f","sha1":"d081877a9e5c96d16c6cd1828e3e2652a0eb1f35","sha256":"3e21d49e080bb1d46eb7239b39939340e8bbb0171cd9bcc578830f32ea95b272","sha512":"0d3a7ba46554db3947aa624a8decd47a6fe8530445e9b8bae36436e62b904a6afcebf2f66548e590888b78282faa8fe78d039506e33c692dbb109e4dcc74012c","ssdeep":"6144:DybhFOufhkHLHEY/TtesplVyrYlRlDsmq9DG:+zBuHLHEY/TtesplVyAsp96","tlshash":"63742c90f76ce1bd874e55fe7a3290a4902c1b41b0c89e59d29d2944fe6b385feb04bc","first_seen":"2026-05-20T08:35:52.566318Z","last_seen":"2026-06-06T02:56:56.102013Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1641,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1641,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/img/bj1.17ef2db8.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.646Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /img/bj1.17ef2db8.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.f27g.top/css/home.1777369843125.0fc9d8d4.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-e5eb\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nage: 76243\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866c7fb8ba\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58859,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 1299, 1-bit colormap, non-interlaced","md5":"59f1176bd542d042d8ddecbe4ab2cbdf","sha1":"7251e6f8bc0bf8bf3e62e892b34540f8259dcf9d","sha256":"b3bc2f14721d5f84900af66179eb6ad69a9c8d5a89eae36f877cf09fc9872603","sha512":"c4e7f1491686b72482ba26e34fd94496fc71bec2a35ba1d7cf67391e1f47f859465ad9f0c7d286bd35f9a26132fd80012a2cd2f8133cf1c6013db4f4d27a85d7","ssdeep":"1536:jlJ0Z4kwI3cG0YXIPf/OWcFOtk2bnIlfyMcw68vTbD8:gxbsGvYXd8OtTbIsgTbD8","tlshash":"004302d3b5e9f610dd38c157a3d1c9da504483be3e938d0bebbe402629fd56840a6f16","first_seen":"2023-08-17T12:39:32Z","last_seen":"2026-07-23T00:35:01.898844Z","times_seen":2480,"resource_available":false,"data":null}},"time_used":2783,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2783,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/33c164f1fd734c468e2251fc135d0657?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.323Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/33c164f1fd734c468e2251fc135d0657?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:30 GMT\r\ncontent-type: image/png\r\ncontent-length: 17921\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 5699\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"33c164f1fd734c468e2251fc135d0657\"; filename*=utf-8''33c164f1fd734c468e2251fc135d0657\r\ncontent-md5: ppYsIgjQjcRx2WNt5OO1VQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FjxftxAShED0moof_itk3xJPuo9N\"\r\nlast-modified: Wed, 13 May 2026 18:31:26 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: LAPnPrzl9\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: udQAAACG_G7vM7EY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17921,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"a6962c2208d08dc471d9636de4e3b555","sha1":"3c5fb710128440f49a8a1ffe2b64df124fba8f4d","sha256":"dc1d0eb9e3bde230211a124508b22e16bd0e82c85dc70d33fd85733a489971a3","sha512":"435b8f9772f9ed396521c36956b0e429303679180fb4c67115e5a4a3db27c7c67231c4420a43c4749d91358a9efa10996e5cbb14e570c10f556f0cae2b1eb560","ssdeep":"384:HRASWfX4CSCdEIIavO76rLdA29DaeOuwemEtvHDlJTwC7hx:HRcX3ldEZa27a5A29ueO5ema59wix","tlshash":"0782d082f2275ea806c0b33e1949da7b64fb2a87d0f03c5c471b5a757aa7027143bb55","first_seen":"2023-08-17T12:39:30Z","last_seen":"2026-06-14T07:28:18.798428Z","times_seen":16,"resource_available":false,"data":null}},"time_used":2487,"timings":{"blocked":562,"dns":13,"connect":252,"send":0,"wait":1033,"receive":327,"ssl":297},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/001092a073e4485aa999b50767f6ddc5?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.387Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/001092a073e4485aa999b50767f6ddc5?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:30 GMT\r\ncontent-type: image/png\r\ncontent-length: 109945\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 74097\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"001092a073e4485aa999b50767f6ddc5\"; filename*=utf-8''001092a073e4485aa999b50767f6ddc5\r\ncontent-md5: 3pojbX804rc0FU9B19Ka8Q==\r\ncontent-transfer-encoding: binary\r\netag: \"FsGLS88r0pmNhPuZE9obr8gpKRcd\"\r\nlast-modified: Wed, 13 May 2026 18:31:49 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: lPemXoanw\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: TNUAAADnWVO69bAY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":109945,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 440 x 440, 8-bit/color RGBA, non-interlaced","md5":"de9a236d7f34e2b734154f41d7d29af1","sha1":"c18b4bcf2bd2998d84fb9913da1bafc82929171d","sha256":"eb4d651d44edff0fa8a8f44400d1175decd3df01dcfb282c58c0d13de9418730","sha512":"99ac98bd22e0f012ff3dc380b3783507f20f15c4066f44b1de421f170304e17848a43401af75753bd975ec82ccbd8d721da5f8abd7e4621081715659d1b5e130","ssdeep":"1536:lrHfiKVdM7EVWJ8hVTQrUK6hGb9kXDLsHB1ugWQDoYnaQC2b6x92mJNN/jid2kt:lrqKVdM7EI+h58b9QiDVoU9CAy2mtS","tlshash":"dfb301414d2fa068237a5e971ab73b061e0ef791506b079d21d1fc879ab4cb9d20eb8d","first_seen":"2025-04-01T11:41:17.861107Z","last_seen":"2026-07-21T13:29:27.78321Z","times_seen":124,"resource_available":false,"data":null}},"time_used":2227,"timings":{"blocked":471,"dns":0,"connect":0,"send":0,"wait":1025,"receive":731,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/configPage.js?v=4/28/2026,%2017:55:48","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:15.102Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /configPage.js?v=4/28/2026,%2017:55:48 HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:15 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 949\r\nlast-modified: Tue, 28 Apr 2026 09:55:57 GMT\r\netag: \"69f0842d-3b5\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\nserver: Nginx\r\nl-safe: 1779266115=ud1RxWc4o642H/BkKCo6Aou8uBCszXJBX4YrRXnJoMGOZtO23U3mgpmEy8o4nhZut8tjleBzMvjD+6HY6BUfJZm/WqWxYMkqhgon6GBBbYCSo/Q25DkpOG18Kl2L1Fnz20dy/spCuS0SSJwM7pW/ZEK78glK4hpCd9hiziv1JQ87UreukqHKUYa9oGbrN5hn\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e448656bab87c\r\nx-cache-status: BYPASS\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":949,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (917), with no line terminators","md5":"e6aa74bb352ef198ba3e1c9a4b01b014","sha1":"2ea8bd6b5045475a36432f7665a129728e822d9e","sha256":"73828e873c0b6e847b37d78941ca436247471dfc90a12f743964f869f75abd5c","sha512":"2faaf24fdf1e4da637af8e9f82d1778bf061b00752dfca0c8f73432ba236a7b69410a7ad2a73727bc83e6cd631fd6555c3cc0d9d3a5d8a7f81818dd66566011f","ssdeep":"","tlshash":"be117aaf57444dffcf1d7e00a08b0a5ea8bc61d261889d4da8e9cf29e1c99002378978","first_seen":"2025-09-04T00:49:32.949926Z","last_seen":"2026-07-23T00:35:02.005073Z","times_seen":2675,"resource_available":true,"data":null}},"time_used":434,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":434,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/assets/logo/favicon.ico","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:19.833Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /assets/logo/favicon.ico HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 585615\r\nlast-modified: Fri, 27 Mar 2026 09:31:20 GMT\r\netag: \"69c64e68-8ef8f\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866947b8a7\r\nx-cache-status: BYPASS\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":585615,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced","md5":"abd1eb812e495d993fb310ca906ea605","sha1":"77a61cd2ad4a89c22f4a979571d3c259870732f5","sha256":"ccd41d39ff7fbed7a9200f685d9b0198736d1a2f737e9d32f83ddaeef39a4180","sha512":"e8221a9acda08a0a0bc5410cd14bc72d30e6fa66cc6e7a4bc07b53f5c94b5ec670f19571246ab2f55ec2924f679543780e9f55e0ecf8a169ce3b91e38da07d25","ssdeep":"12288:zObp4IC0/qFNYge/0z5g2c+UTxVi1+4g+/F5:ibpa2qFNNe8zy+si1+4V/F5","tlshash":"e8c4230df5a39834d5dc996741db54e0c790e4183db25e323ba3448ea3d05b8ea267f7","first_seen":"2026-03-20T12:57:26.707036Z","last_seen":"2026-07-23T00:35:01.949286Z","times_seen":1305,"resource_available":false,"data":null}},"time_used":11289,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":730,"receive":10559,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/api/tenant/domain/list","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:24.618Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /api/tenant/domain/list HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nx-request-source: https://www.f27g.top\r\nXign: K8vK7OTvxCm/pXXAp9+yUlGx6OJcf8JK2ehWIxlkMjt12ILug7uIF0CMxIFjKKii75PbUaqNUZBrDdhyaeFjwllNVZQ30bO7+v/2Pre4hTnZJX2S9hZstr9XzQbGqh8iiYuQpwAax8XkX9GYKGOVYTmq8qHmgBcEAGpUk6G9G9k=\r\ntimestamp: 1779266124593\r\nsign: q7h5i655n6kr3b73\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: zM66WbX6JffCzAPYKHD3Gxnmh7JPTEYH\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:25 GMT\r\ncontent-type: application/json\r\nexpires: Wed, 20 May 2026 08:45:25 GMT\r\ncache-control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nx-xss-protection: 1; mode=block\r\npragma: public\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266125=GYVCFswnvyg6HUDSML+socExrp5UkAsWNubxuJgkNJQuyrepjSJnquBEXK2tbNomTUMCEmx2bz/Zx81xexnn2501I5gu8oHvfpeTU+hwKZFg1eq7QRbu98y5EL0eF6/cm5BVPfzYlzamy2ubYGl01c2U3Au75r8nzF/ZL2oWQOUGxyrLv0uiwPId12KQ41yf\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44867bfcb8ee\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1108,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"5d9e96bd132a2c24281ae50f2b09efe4","sha1":"503ea18100d0f1573baa195933355a1372e93841","sha256":"7f205b18b5deaae96622989dbc8ad73999a9616e96ef26d909f19525deadb328","sha512":"ab5a589dc81944d2fe05d656777e9e490d42a2fd68c7e577387cfdd47c9b0c5276ca2f91a3868407c373e500d00bb5360a5ae035c7c0cb1addf47f20755a268b","ssdeep":"","tlshash":"fb11c6101c6f12c8d6e8d29263503345388d8b76056db91b69d6b74fae0583a32120a4","first_seen":"2025-08-29T11:05:53.144028Z","last_seen":"2026-07-23T00:35:02.024784Z","times_seen":2464,"resource_available":false,"data":null}},"time_used":3019,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3019,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/09fa8eedf1614af09285e4536f4ee758?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.358Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/09fa8eedf1614af09285e4536f4ee758?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:29 GMT\r\ncontent-type: image/png\r\ncontent-length: 31562\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 3688\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"09fa8eedf1614af09285e4536f4ee758\"; filename*=utf-8''09fa8eedf1614af09285e4536f4ee758\r\ncontent-md5: aKMhnK7eLDOlBnEcKeveow==\r\ncontent-transfer-encoding: binary\r\netag: \"FkFgC0HmAhQKYld7ggTdjo6sug7Y\"\r\nlast-modified: Wed, 13 May 2026 18:31:29 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: MGH0m6BZE\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: lnkAAABMdnrDNbEY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31562,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 225 x 225, 8-bit/color RGBA, non-interlaced","md5":"68a3219caede2c33a506711c29ebdea3","sha1":"41600b41e602140a62577b8204dd8e8eacba0ed8","sha256":"facea0489a5fd268f1558995cc14a46bfdada375220f1ddc4b8c0104f105193c","sha512":"91410691c20f26bd04891833c78f06e30cf93308acc4f2d528c8c8312f71fa6d036a3f31c9ce680e260d6633e797b5f63baba0cb56106e4150d1b35dfe2784c0","ssdeep":"768:wAnr+ViBcRiDqgfWsfscROzHZjW815FyZmzcvSd4T48lL:wAyVTMWgt06OzHc8LFrcvSqTlL","tlshash":"e4e2f1778ee1e1cfd475724d50a2197e2bb2321e348794f485404e6f643885a63accef","first_seen":"2025-10-05T12:59:35.249017Z","last_seen":"2026-05-20T08:35:52.588653Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1678,"timings":{"blocked":497,"dns":0,"connect":0,"send":0,"wait":1026,"receive":155,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/css/46431.1777369843125.7dc7cfcf.css","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:15.111Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /css/46431.1777369843125.7dc7cfcf.css HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:15 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-552d2\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266115=ud1RxWc4o642H/BkKCo6Aou8uBCszXJBX4YrRXnJoMGOZtO23U3mgpmEy8o4nhZut8tjleBzMvjD+6HY6BUfJZm/WqWxYMkqhgon6GBBbYCSo/Q25DkpOG18Kl2L1Fnz20dy/spCuS0SSJwM7pW/ZEK78glK4hpCd9hiziv1JQ87UreukqHKUYa9oGbrN5hn\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e448656beb87f\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":348882,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"e9d628daba48b940e276f091325ad9d3","sha1":"fdad8ce2a89ba61e92793906f2c486dba4ab6830","sha256":"8335d1e28f036809b567aa56d38506372340045a62595b1d896dd659faf5ec5f","sha512":"ca21fb5041ed2e5dfc57f5080b7cfc4bfad2aa4f9e7556680d57ac7d82669ff16ee746998b3d016994ae96c770b8a582ef129b01f52e5dace961e2625cc15ac9","ssdeep":"6144:z4+4r0H8Tu4+4r5cRlGuEQUQ929sYbnpTP40:z4+4ZTu4+4La0","tlshash":"0774fa6caf1030ae15a7cb27b660f5199c36a443f9bfde9af3e53d580789a510623c13","first_seen":"2026-03-06T18:01:11.525986Z","last_seen":"2026-06-28T00:33:52.677506Z","times_seen":575,"resource_available":false,"data":null}},"time_used":1048,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1048,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/theme.config.96698fb2.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:15.113Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /theme.config.96698fb2.js HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-1a625\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266115=ud1RxWc4o642H/BkKCo6Aou8uBCszXJBX4YrRXnJoMGOZtO23U3mgpmEy8o4nhZut8tjleBzMvjD+6HY6BUfJZm/WqWxYMkqhgon6GBBbYCSo/Q25DkpOG18Kl2L1Fnz20dy/spCuS0SSJwM7pW/ZEK78glK4hpCd9hiziv1JQ87UreukqHKUYa9oGbrN5hn\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e448656bfb881\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":108069,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (38260)","md5":"6a9a87f3e8804b6c2e87c2ef64cb06ac","sha1":"b57b77abc2f2694ee5b5404a08100b3bdbae1dbb","sha256":"1597153bb2084ffdd78db4687cd9efcd0d7d54f7f460c9b717988ff3dc4f640c","sha512":"5d9bbb05a39e07f2ccf8ac572dcc12d0ae5af13998abb2a6167619b1774272761b562cbbd40b287c404261553e88a7c872e1cfd2943678f59422161d10cee15a","ssdeep":"1536:D2JREobpmtlIRM4Sb2mcTa2mnzyJog9CcHWhM:qYtlGu1Jnz45Hl","tlshash":"23b3bb7ae20c963a6177acbfb46de111c12e9c0cab1d5fdef03d60a25710669c831de9","first_seen":"2026-04-29T03:41:13.38605Z","last_seen":"2026-06-08T22:37:37.050222Z","times_seen":434,"resource_available":true,"data":null}},"time_used":733,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":733,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/css/home.1777369843125.0fc9d8d4.css","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:19.502Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /css/home.1777369843125.0fc9d8d4.css HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:19 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-15b21\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266119=vIGhvkpeFlPE9AIL6BAPcHr59woHmm1S4cyg4M29F2mnKVEVlQIDQgEe525ibJetrA+iEjvMxITadmXHnWqJ8+/cHivFwJCx/h1AKP1T/4NN8RV+Gq2Vd1bQaOQo0kNGRAtHU1Q3BMs9yw1LxObt4ntrGKefjTHuInEbwMF8Dn0NK2grbqRsJvBTjY7bLazr\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e448667fcb8a4\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":88865,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65528), with no line terminators","md5":"30a5adbe27b21532b2c8f56952780659","sha1":"9145117e5aa3fdd7706b8ee646ad8dcd10fc3c7f","sha256":"37c13454d16818666b7f9cad2fd957546bc4bc5c0ce00a68be778c7ec411dcae","sha512":"823393636732a30be2a0daaedc93f43ec0bacd9cd5f85b238ffeb268af34215887fedef00480f471fadbd2aadd728d697778fee703fc9ae855d7b10d370af38f","ssdeep":"1536:fwRzOcRM7jufawS2d3a8WiLKbzGhbG9gpXdNCN9khb+8J/:fBtuSJwLUK09gEN9khb+y/","tlshash":"99933a76a610253db437ca72aaf06bd8b524c846d7634a3df2527e25cbc71f212363a4","first_seen":"2026-04-29T03:41:13.383588Z","last_seen":"2026-06-08T22:37:37.045969Z","times_seen":419,"resource_available":false,"data":null}},"time_used":442,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":442,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/35142.1777369843125.e8dc7ade.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.316Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /js/35142.1777369843125.e8dc7ade.js HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-5350b\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866b48b8a8\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":341259,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (35829), with NEL line terminators","md5":"aaac2cdc597fe92a2b0787478da09048","sha1":"e656d16bd87e6b2f016e48e73822828ae24aefce","sha256":"ec686e17d1ff8f1da0d9443fc27de752884bd462e4422d5b88f168a13f25d3e0","sha512":"ee7dd3dd5918ca3a9b90a0bf66d5a5a04618328ffc68409d581fe6b13ec553efae55683a88743f9214b35975fc5937cd1246d4abf783bc350c6cfd6c82141e5e","ssdeep":"6144:xfhhkpltgm2i1CB84lBAb0wv1e7Ancbt83i2UfIL5LoSltLFe/fwwutUcAct37/k:xfhhkplum2i1Ci4lBAb0wv1aAncbt83s","tlshash":"ec743c84b690b17483af86fb72169194d25e0e9460ccace4f27e6e40bf11746f87b5ec","first_seen":"2026-05-20T08:35:52.593297Z","last_seen":"2026-05-20T08:35:52.593297Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3106,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/api/sport/match/list?sportId=1\u0026client=web","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:24.616Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nx-request-source: https://www.f27g.top\r\nXign: H2eKUx4Ykll2y2XRSXjeIlgh19BWzqlDwlDCgQ05uyb1gc7x6TjUQyhUmfYBwzcfWKDm6XR0rOe6J4cCGBTOEHYlUhbGLKKJShygZE/2PLzzGflCluqXL3AmiRvkAxmoODNPU7vEcY4Nh+BndF1xEg7ZT4Cy2+Ow12GMXIiu9VA=\r\ntimestamp: 1779266124592\r\nsign: gu7k2n212p714p1a\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: RyEpQ7wZnDexzrpM68NCtCh7THG4kPhs\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:25 GMT\r\ncontent-type: application/json\r\ncache-control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\nserver: Nginx\r\nl-safe: 1779266125=GYVCFswnvyg6HUDSML+socExrp5UkAsWNubxuJgkNJQuyrepjSJnquBEXK2tbNomTUMCEmx2bz/Zx81xexnn2501I5gu8oHvfpeTU+hwKZFg1eq7QRbu98y5EL0eF6/cm5BVPfzYlzamy2ubYGl01c2U3Au75r8nzF/ZL2oWQOUGxyrLv0uiwPId12KQ41yf\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44867bf5b8ec\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6217,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"c0d4c3ec2f2cc06855fbfb009b837978","sha1":"928e2cf32a6b39f529595e8489184596588f7ec0","sha256":"93a3b89c125ec6b32f1266a6142cb480670d915fd33575b9b85a13faa74c002b","sha512":"bafe28a59220aa5e2144b1d359642452f6250f72732c176038b6f089183d276a5f7ddc239b953193d1412f1af0c290d10da82bf305d8757a882c97ab86fdd8d1","ssdeep":"192:ecZWIobJyllNkXd/qo+RxAx/BwRxcN33SwFTQ+jtYtd+5VYCipsKsjpeOGhGz3B:ekoclNkRqDPc/BwP83dT8tLCzKfOpz3B","tlshash":"33d1cb9782ed589a1f9c61d15e0d3a0d887eb91b0adee5c5ee0ecf1d20b43f79244c21","first_seen":"2026-05-20T08:31:07.038291Z","last_seen":"2026-05-20T08:35:52.595527Z","times_seen":3,"resource_available":false,"data":null}},"time_used":3020,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3020,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/ecb/8f8306425cb6740e78b2802ff5047afa96a8ae096bee393c421cac4924db741c4a080b3f3ed2f2822673f3118bd3bae081df46a59bfce8","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:24.661Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /ecb/8f8306425cb6740e78b2802ff5047afa96a8ae096bee393c421cac4924db741c4a080b3f3ed2f2822673f3118bd3bae081df46a59bfce8 HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://www.f27g.top\r\nXign: yZF9y+9zDTBvdqrzPabRLQKVmOqpgA0xhdpFbhsOaBCk0f9pH7XLcY6bkWKSODszRLma3bu5Em2vlUyvTVlGHRB8mFdrRGtlOlPI000sHBoE2zLK7Wxf8reZ8VI3qYy2kQbR7sZ6ZLYm3kUuqCZQ46BOzTJ9v0z5WNiWHM9lVoE=\r\ntimestamp: 1779266124657\r\nsign: l316e4j1o40l2e6f\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: zM66WbX6JffCzAPYKHD3Gxnmh7JPTEYH\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:25 GMT\r\ncontent-type: application/json\r\nexpires: Wed, 20 May 2026 08:45:24 GMT\r\ncache-control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nx-xss-protection: 1; mode=block\r\npragma: public\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=63072000; includeSubdomains; preload\r\naccess-control-allow-origin: *\r\nx-custom-check: true, true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266125=GYVCFswnvyg6HUDSML+socExrp5UkAsWNubxuJgkNJQuyrepjSJnquBEXK2tbNomTUMCEmx2bz/Zx81xexnn2501I5gu8oHvfpeTU+hwKZFg1eq7QRbu98y5EL0eF6/cm5BVPfzYlzamy2ubYGl01c2U3Au75r8nzF/ZL2oWQOUGxyrLv0uiwPId12KQ41yf\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44867c29b8ef\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15255,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"391d7d0f32c77bd7996f8c48dfab12ad","sha1":"457ca5f2d79a920a11b2970c725ad5baa451124a","sha256":"853b6112c9fe3159d5e3e6734e92e136425645db7a4edcb82df1fc1a3306d024","sha512":"9e619786ad4b4c84ff5ebad18220567130b1af4824fac50b2370d5fb1d565ff0d1962aff2f0a2fd5a5c92ee6c40da55e18d2f1e979526a6987a6833fd9c56800","ssdeep":"384:YZc8WNZAEmcQ5s+68O3R0P9lKkMLH5XSSVoWf+8qp7y28l4v+VO/1lG5zJibKDml:YZc8UAEq5DUGP9lQz5iSr2dWDO/bG1Ja","tlshash":"c8a2cf8a2a10f3e4c6b3d0e7711649d46705c6a2e6ef7d41f109cd7712e8506bacde53","first_seen":"2026-05-20T08:35:52.598436Z","last_seen":"2026-05-20T08:35:52.598436Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2973,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":2973,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/45540.1777369843125.8e1e0acf.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:15.123Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /js/45540.1777369843125.8e1e0acf.js HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:49 GMT\r\netag: W/\"69f08425-37ff6\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266115=ud1RxWc4o642H/BkKCo6Aou8uBCszXJBX4YrRXnJoMGOZtO23U3mgpmEy8o4nhZut8tjleBzMvjD+6HY6BUfJZm/WqWxYMkqhgon6GBBbYCSo/Q25DkpOG18Kl2L1Fnz20dy/spCuS0SSJwM7pW/ZEK78glK4hpCd9hiziv1JQ87UreukqHKUYa9oGbrN5hn\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e448657e8b886\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":229366,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"a0e497c34e367322be5d24c3b27d661c","sha1":"05738c9aad3a5d894b6d49780014a52200ef950d","sha256":"073a44ee1f965bd3739f07604455eb8940250c073f060303550cdd02ba87109b","sha512":"ea91edbfdf72b73e3fddb4a652393cfd4c1be31242b51f7caa28ee35cf3f66eb42bafff62ffacc3a2b89cdee253e84e2d8ec5e5c5bbc9832053bd5c00df77b3e","ssdeep":"6144:JYD4wFsYiSGfKnCKPP6Xm9sm3MCln1OSgpozfEe5a:JYD4wFsYiSAKNH3TY5","tlshash":"6024e894f294f1be075fc1f1d23b501af35b5e6120cc9ca0d296e6942e20b49da77eac","first_seen":"2026-04-29T03:41:13.329661Z","last_seen":"2026-07-10T22:25:54.148858Z","times_seen":440,"resource_available":true,"data":null}},"time_used":1645,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1645,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-20T08:35:13.083Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:14 GMT\r\ncontent-type: text/html\r\ncache-control: public, s-maxage=600, max-age=0\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266114=oToM35xAf/ebzlbnQQo2VbOKakpNe330B6rWq7m8BJ1BXTorwQxdf40MrDoX+BqVr01iSvdyRujoNBN8LZKOyzvSPzxsZIBgOWfzI+/7ZZWSp08OlNhMzzydqb7HvKgo2PIO4V0x2q0x7Y08i2mG6rB+w7C4KTppXT2CbRDxChTI3BZza7wHNLBd+Eq7u1M8\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44865400b87b\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"GeeTest","description":"GeeTest is a CAPTCHA and bot management provider, protects websites, mobile apps, and APIs from automated bot-driven attacks, like ATO, credential stuffing, web scalping, etc.","website":"https://www.geetest.com","common_platform_enumeration":"","icon":"GeeTest.svg","categories":["Security"]}],"data":{"size":24409,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5777)","md5":"de12f9ef6903679d754b67293200edd6","sha1":"fd38488a0db4f56c62536cbdb4c5957ca9091148","sha256":"735a322de1f2ded527f569184d7c6c57ddaca2726df1b527386667704e130688","sha512":"6e460e29f99686c44c928a124be7cdc3b1633d6584c9d7e0256c69a1d328ec0cbe7f401d79385a18d16d458606e132567e8f7fa5e4e7ce56a3ffadc6c7b63b95","ssdeep":"384:Eo3ERrxqNBPJ+96junwIX2VwiYwJvSoVXsp+pa/iZcVk97g6nMusplIiz:EpRVqrJ46junwIXiNYiKop/E6wkpcu2T","tlshash":"62b2185a9df349762523303a1fbfb20879b0c0274209ed443e4de7594fd59aa42e3be6","first_seen":"2026-04-29T03:41:13.317002Z","last_seen":"2026-06-08T22:37:36.995773Z","times_seen":428,"resource_available":true,"data":null}},"time_used":3049,"timings":{"blocked":1305,"dns":393,"connect":302,"send":0,"wait":435,"receive":0,"ssl":611},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/7653.1777369843125.5eafcc69.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.322Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /js/7653.1777369843125.5eafcc69.js HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-5dd\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866b4db8aa\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1501,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1501), with no line terminators","md5":"4849391ecd3ae7038c8eca5da5af6cd4","sha1":"6316de5585ce9c3c90e92da7f445df0f1eb06f39","sha256":"7ace68dcf17129b57d79ff5a5ce030178b60d463fa0b0d1027ff5a62981ae2ef","sha512":"04bf30f23c9fc4ee7df1d106f541932dec50cf5794d313087378b16ed5430d29f75a5891abf4e84657525774f2ee231ac62d9e7640000390ee29a08bf23fbae4","ssdeep":"","tlshash":"47310e98b6a171b243af5af98f3f168bf16794c064edb094d096e2e07cb420c4937d29","first_seen":"2026-03-20T12:57:26.686565Z","last_seen":"2026-06-08T22:37:37.040561Z","times_seen":517,"resource_available":true,"data":null}},"time_used":3104,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3104,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/img/SPORT.aab253e7.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.213Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /img/SPORT.aab253e7.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-d854\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266132=N/QnbzZ2AZFVQCEm7JFlxb/Bt7QEyfiTmWOO5avUYGYcydOyUTUE3M+0/CnQju09ro3iPnqv37qegrHX9VflpfsX9bMR5/oKM4OsbdPf6EbSiiSnruQUqfEsDB+h69ibi1EJhuc7KosgEraRD3RBO/XcIUBLNdjiD+/Y2KNympoAi1Od8cSlPIPJAvj7ymRQ\r\nage: 76249\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0919e448698e6c996\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55380,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"3990a0dcf110f100c97ab413079e969e","sha1":"8087b72a149b71f4f5fc43b0f8bc07b89b621583","sha256":"6ddc189e7780b1313933d4903be9fbf6644b6a590e9aba83a6e4e50fdafb170e","sha512":"6b092584d42ec1423ecb94383907f29571e93308944813286d6e74b10f6eccb27536924220780f9a080dc259a095718a33f0757fc0adb04d737c83a6fa1647e5","ssdeep":"768:aEivx5zbZ4L0zze87wWbuKu4YIsZdCPX4ueh17yEs7NsGJSLsBQ1MDAaYHKJTbYC:aEi3eL0za8xbw4UmXI1VfJIRDYqz6W","tlshash":"bc43022944944c242384f1a6ac778dbc6dffa348a5f38f639a842bec7dcd84d95f4811","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-23T00:35:01.902691Z","times_seen":2266,"resource_available":false,"data":null}},"time_used":3716,"timings":{"blocked":-1,"dns":0,"connect":0,"send":2780,"wait":936,"receive":-1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/20f7aae0a29f495ba32235c4d87bf735?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.378Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/20f7aae0a29f495ba32235c4d87bf735?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:30 GMT\r\ncontent-type: image/png\r\ncontent-length: 139120\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 74099\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"20f7aae0a29f495ba32235c4d87bf735\"; filename*=utf-8''20f7aae0a29f495ba32235c4d87bf735\r\ncontent-md5: HHUXqej//89vmgybfDzaiw==\r\ncontent-transfer-encoding: binary\r\netag: \"Fi2uw_xMkuXtBuT5eFPHoQa90LED\"\r\nlast-modified: Wed, 13 May 2026 18:31:48 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: s05x2Ffbn\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: NREAAAAfsPu59bAY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":139120,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 419 x 413, 8-bit/color RGBA, non-interlaced","md5":"1c7517a9e8ffffcf6f9a0c9b7c3cda8b","sha1":"2daec3fc4c92e5ed06e4f97853c7a106bdd0b103","sha256":"0b0ac9ff405f2ed92fa1b71d0cbb694a766d62ae747544374879d253d71f87a2","sha512":"4c68c947c6cf665bd7a16adfd6a913902b8bd761a378fcac86631911fb6b0169c8e94ee2ae79eecd1ce14431ce569ae8f47a50e7642d9abcbab6854429db1c3f","ssdeep":"3072:1E3HjU+YMa4IHhDumhy9WndUZ928PEPQppf/VHW+:1aDU+Yjums9YUZ88sPQrlt","tlshash":"b9d3127d9da3cc58bb4ad20171c7ed3484843f22f55a687e583d11dea87aee4138263e","first_seen":"2025-09-21T04:12:33.994427Z","last_seen":"2026-07-21T13:19:18.474104Z","times_seen":134,"resource_available":false,"data":null}},"time_used":2197,"timings":{"blocked":478,"dns":0,"connect":0,"send":0,"wait":1027,"receive":692,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/21954.1777369843125.57c97863.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:19.459Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /js/21954.1777369843125.57c97863.js HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:19 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: W/\"69f08424-a3f0\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266119=vIGhvkpeFlPE9AIL6BAPcHr59woHmm1S4cyg4M29F2mnKVEVlQIDQgEe525ibJetrA+iEjvMxITadmXHnWqJ8+/cHivFwJCx/h1AKP1T/4NN8RV+Gq2Vd1bQaOQo0kNGRAtHU1Q3BMs9yw1LxObt4ntrGKefjTHuInEbwMF8Dn0NK2grbqRsJvBTjY7bLazr\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e448667d2b8a3\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41968,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (41968), with no line terminators","md5":"0e41dd7729067b884faab37fcd9af417","sha1":"11acbef297a8f924deae47393678fb42c36ece7e","sha256":"9535e9e039663a829c5e5ffb31879f836c96c5e1f58306318b45a64f4a6687ea","sha512":"228b5a935e11e121070f4a6710af8ed39e21fe53a228c99bb4befc116c54f37693f2c9e5b08d202dd5b8375b84c4fbf63918cf013f6af5d4f71464f93524d3c3","ssdeep":"768:QPhaSfmzKrMdvf0eMQ/96loumY1PI1yBK9LudEz+yUy51y9y0yk6Dio+ILqpTeY:/81R6Ipyk6o","tlshash":"a7132088fac2b06dd3eb7330857f505ae66a1dc0668c5438e260d6917e7198dc1fb5f8","first_seen":"2026-03-18T07:07:19.558046Z","last_seen":"2026-07-16T20:28:12.868078Z","times_seen":453,"resource_available":true,"data":null}},"time_used":464,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":464,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/f59500ef4dc042f7ac4b1f635d0f842c?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.362Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/f59500ef4dc042f7ac4b1f635d0f842c?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:29 GMT\r\ncontent-type: image/png\r\ncontent-length: 31112\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 2784\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"f59500ef4dc042f7ac4b1f635d0f842c\"; filename*=utf-8''f59500ef4dc042f7ac4b1f635d0f842c\r\ncontent-md5: hVMM/yNhbfo72DVvXzJGFA==\r\ncontent-transfer-encoding: binary\r\netag: \"Fi3fqw_9rcxrhubipris26PPXIP5\"\r\nlast-modified: Wed, 13 May 2026 18:31:30 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: rWKjm1KPL\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 4KYAAAAprfaVNrEY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31112,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"85530cff23616dfa3bd8356f5f324614","sha1":"2ddfab0ffdadcc6b86e6e2a6b8acdba3cf5c83f9","sha256":"b2159ea2275e532fd4983ee6e67fc6791c090f8ccb929fe6c90de96c5fc8003a","sha512":"9467a5926434295caf538ec58794af808f99d3a299aada2b95b1742309a21d6fb82dbc6696884b8071d211423d015af60c5a7fb3ec52a86af70667cb7519fcc2","ssdeep":"768:HSKlqZipcoQi4Y2ucHjH3JfQEAg94RFhT/e:H7iipvR2ucjH3Jt25G","tlshash":"ffd2e1f804581c5e95f6698a42a1c384dbd2499cffa40fd8b705d7fbeb9121b1d81720","first_seen":"2026-05-20T07:57:56.89635Z","last_seen":"2026-05-20T08:35:52.611409Z","times_seen":5,"resource_available":false,"data":null}},"time_used":1618,"timings":{"blocked":493,"dns":0,"connect":0,"send":0,"wait":1026,"receive":99,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/api/sport/match/player/match","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.494Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /api/sport/match/player/match HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nx-request-source: https://www.f27g.top\r\nXign: bPrNSCriCeZdwempfI8C5xswWlvB0dTjaxX5ACM3KB7CbDV+SFRC6kUr5riINPfCY17itpRyLL7Zh8nKbh6AYVmjBnIqpgd41YxqDwQK8i5EvOcG1aDinKzpVKViFTK6lNU6ADtYXkL97sFuV9Z7v0gKus2jgpznj6SkH5w89Pw=\r\ntimestamp: 1779266129359\r\nsign: 631i306n1j12kj37\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: zM66WbX6JffCzAPYKHD3Gxnmh7JPTEYH\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:32 GMT\r\ncontent-type: application/json\r\ncache-control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\nserver: Nginx\r\nl-safe: 1779266132=N/QnbzZ2AZFVQCEm7JFlxb/Bt7QEyfiTmWOO5avUYGYcydOyUTUE3M+0/CnQju09ro3iPnqv37qegrHX9VflpfsX9bMR5/oKM4OsbdPf6EbSiiSnruQUqfEsDB+h69ibi1EJhuc7KosgEraRD3RBO/XcIUBLNdjiD+/Y2KNympoAi1Od8cSlPIPJAvj7ymRQ\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0919e44869a0fc9b1\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"ad1b5cbc37e087c212a41eca07a863ae","sha1":"f990fb40077ca4c90bbde8ffb87c73e1c06fd931","sha256":"0fca88eefe8bb5f59242b88e2b8b179148a088b4cde3499e1c56fef8c84c309a","sha512":"fe056eef22791a958cc37f63c1cc4b3f35bd990c34d1d321f34504b7b99769b571fe46cf18ede31f7ca0e564baf63aaca9d4f3601395bd7a3ce424e50a2aaf87","ssdeep":"","tlshash":"56a002473a282ea49bc31066b50e7a5500a421749a55f469cc8e623dc755453b546531","first_seen":"2024-05-26T00:49:06Z","last_seen":"2026-07-23T00:35:01.92321Z","times_seen":2500,"resource_available":false,"data":null}},"time_used":4468,"timings":{"blocked":-1,"dns":0,"connect":0,"send":2873,"wait":952,"receive":-1,"ssl":643},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/js/13575.1777369843125.cda1d494.js","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:15.124Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /js/13575.1777369843125.cda1d494.js HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 28 Apr 2026 09:55:49 GMT\r\netag: W/\"69f08425-2f97a\"\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266115=ud1RxWc4o642H/BkKCo6Aou8uBCszXJBX4YrRXnJoMGOZtO23U3mgpmEy8o4nhZut8tjleBzMvjD+6HY6BUfJZm/WqWxYMkqhgon6GBBbYCSo/Q25DkpOG18Kl2L1Fnz20dy/spCuS0SSJwM7pW/ZEK78glK4hpCd9hiziv1JQ87UreukqHKUYa9oGbrN5hn\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e448657e8b887\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":194938,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"eda98cc14e8c025a359a009951750a20","sha1":"b54dc08d49209bb6953641b57cead1ec1e92d823","sha256":"636dbf0f9dbb30ed3d15582a38bbc4c1857fd1affbe8be077182666b906e7f3e","sha512":"fc6837e6c1ebb1b97998b81be6fab0614b1d30dd0494527bb2fdcaa139d3d26a16798468a172b13ad982cb3ac0651e22ed1d8af5ff62fc501babf9c04c104659","ssdeep":"1536:X17BBHFeKRKp+3ELSPtj6x2DgJoG7PIDmj9VA+s69JAFdE6WIzl+Ik1+eXMa7a4H:hjHoKRKphCnDgJoec+IDWIzls+7Xr0X7","tlshash":"4a141a84764170b8c396a165322f601ae22f789650dd9c24f3789aa47f7470df26fabc","first_seen":"2026-04-29T03:41:13.356911Z","last_seen":"2026-06-08T22:37:37.015763Z","times_seen":433,"resource_available":true,"data":null}},"time_used":1644,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1644,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/assets/logo/favicon.ico","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:19.830Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /assets/logo/favicon.ico HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 585615\r\nlast-modified: Fri, 27 Mar 2026 09:31:20 GMT\r\netag: \"69c64e68-8ef8f\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866945b8a6\r\nx-cache-status: BYPASS\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":585615,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced","md5":"abd1eb812e495d993fb310ca906ea605","sha1":"77a61cd2ad4a89c22f4a979571d3c259870732f5","sha256":"ccd41d39ff7fbed7a9200f685d9b0198736d1a2f737e9d32f83ddaeef39a4180","sha512":"e8221a9acda08a0a0bc5410cd14bc72d30e6fa66cc6e7a4bc07b53f5c94b5ec670f19571246ab2f55ec2924f679543780e9f55e0ecf8a169ce3b91e38da07d25","ssdeep":"12288:zObp4IC0/qFNYge/0z5g2c+UTxVi1+4g+/F5:ibpa2qFNNe8zy+si1+4V/F5","tlshash":"e8c4230df5a39834d5dc996741db54e0c790e4183db25e323ba3448ea3d05b8ea267f7","first_seen":"2026-03-20T12:57:26.707036Z","last_seen":"2026-07-23T00:35:01.949286Z","times_seen":1305,"resource_available":false,"data":null}},"time_used":10052,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":698,"receive":9354,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:24.665Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://www.f27g.top\r\nXign: F+BQKZTP/2Ei0RnsbeoKNEzRVmla+SfLnmumdexHKjJOxSj5k3ZYvfhDntH0Mjk+VeoSoS9E1w/LRGmLzQsZvZdSICyh/MNhUukir6qJiQ+C8xJdPz/6nrZXRPbqszf6lrgNjLXL8/Ny/jZrnVzjW6FwPspYrKM3yodvZo1Kw48=\r\ntimestamp: 1779266124657\r\nsign: b5g1muog4v1o253q\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: zM66WbX6JffCzAPYKHD3Gxnmh7JPTEYH\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:25 GMT\r\ncontent-type: application/json\r\nexpires: Wed, 20 May 2026 08:45:24 GMT\r\ncache-control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nx-xss-protection: 1; mode=block\r\npragma: public\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=63072000; includeSubdomains; preload\r\naccess-control-allow-origin: *\r\nx-custom-check: true, true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266125=GYVCFswnvyg6HUDSML+socExrp5UkAsWNubxuJgkNJQuyrepjSJnquBEXK2tbNomTUMCEmx2bz/Zx81xexnn2501I5gu8oHvfpeTU+hwKZFg1eq7QRbu98y5EL0eF6/cm5BVPfzYlzamy2ubYGl01c2U3Au75r8nzF/ZL2oWQOUGxyrLv0uiwPId12KQ41yf\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44867c29b8f0\r\nx-cache-status: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6719,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"cb5b7032eac4f4887152ccb0a81d2937","sha1":"ea907347404add073fbf1671dc3e9cf2d2714aed","sha256":"05f27a036843c136315ec51618a9ca9677211751c22a73baef348765f2c7b6cd","sha512":"aaa8899361091b98661f8b82f1613bdad85f564714a2df9c7f9bdca9dee5bad7535811f54127296b5e0202d4030860fe9dda5cf1915e4582a21432ad7375d4dd","ssdeep":"192:V+LsJDB1n42xEGEqWgfLdZITj0X8yJI7t/8lRMtDwfRdfRz:YIJrn40ugfL20Nup/8A54RBt","tlshash":"7322aec47f09f358ab70e6f007b018915384947ccbda5c64db308a9317db93a5aedae9","first_seen":"2026-05-20T08:35:52.511175Z","last_seen":"2026-05-20T08:35:52.511175Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2970,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2970,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/56c7013d33354578a9c35bc9cb9faeb8?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.350Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/56c7013d33354578a9c35bc9cb9faeb8?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 08:35:30 GMT\r\ncontent-type: image/png\r\ncontent-length: 26329\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 3567\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"56c7013d33354578a9c35bc9cb9faeb8\"; filename*=utf-8''56c7013d33354578a9c35bc9cb9faeb8\r\ncontent-md5: kWaJXdcmBdWRY2zF1lIutQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FljAV9kTgUZGcSfiDoUqbRbWkZAM\"\r\nlast-modified: Sat, 14 Mar 2026 20:51:22 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: Y4O0QSHIK\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: DLwAAADvdNnfNbEY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26329,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 145, 8-bit/color RGBA, non-interlaced","md5":"9166895dd72605d591636cc5d6522eb5","sha1":"58c057d9138146467127e20e852a6d16d691900c","sha256":"5b130081f34d97e2f25cf8aa9ee0d27f704c6fc74a68d1a98118550c0bc1f58f","sha512":"a8fd1101cb83a9a33e440214685189aba8887af12deaa0124909f36b561588bd30f53bd2fdda7e091672de4db6d6e2e695f1daf0a80cb8b87b2f095cd0fc2d9d","ssdeep":"768:huIohxnOLpYtzognseZLrIPKpMMJgWrM+PcQMVwZ:sPhxICbg+gsM0cn8","tlshash":"aec2e14fc7f2d3545a8183368a3605ad4389b5bc5f4ca9476333a92219e4a8df482ff9","first_seen":"2025-11-01T07:55:42.387837Z","last_seen":"2026-05-30T11:37:53.072159Z","times_seen":10,"resource_available":false,"data":null}},"time_used":1865,"timings":{"blocked":-1,"dns":0,"connect":254,"send":0,"wait":1001,"receive":320,"ssl":268},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/kc523-1/sponsor/sponsor_nav_web_1.png?1777369782162","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.634Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_1.png?1777369782162 HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: image/png\r\nlast-modified: Sun, 24 Aug 2025 06:03:49 GMT\r\netag: W/\"68aaab45-1e8d\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\ncontent-encoding: gzip\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nage: 76243\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866c7fb8b7\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7821,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 206 x 332, 8-bit colormap, non-interlaced","md5":"0eb441aa3c30cc3c92da984283938f90","sha1":"74a769808afa9b87ea483a82d47958bf05ab9b87","sha256":"146f45de163728bb850c9a8e6c1693dd4c82caf7b6e1f58728395003b84f286c","sha512":"d1c9c8824c4f42f71db8ce2b62955647aa55bb590305765cd931000d0fc6023f7d57cd3daf6992094365ca6ecb42f02f93d606d79f6643a2f89d52f71200461e","ssdeep":"192:AnUYZGCj89cpWsWKE+hAqF7k4Pk7KJw7OjF57HUNuvs7alaUd:AFEijWKE+hHF7kt7857HU/eRd","tlshash":"20f19f3eececd52cd1a745f68caf47a6142c5031ee9d7929b82fdc728649a409d403c5","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T20:44:13.553076Z","times_seen":2148,"resource_available":false,"data":null}},"time_used":2788,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2788,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/img/left.34013cd8.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:20.661Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /img/left.34013cd8.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.f27g.top/css/home.1777369843125.0fc9d8d4.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:20 GMT\r\ncontent-type: image/png\r\ncontent-length: 237\r\nlast-modified: Tue, 28 Apr 2026 09:55:48 GMT\r\netag: \"69f08424-ed\"\r\ncache-control: public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\nserver: Nginx\r\nl-safe: 1779266120=AG6qBJQUMN00eKsIqvVTxAiiL3/gbiAyBxYMVL4WieHd1u7uOUk1+FlmB9krjqhaFIjQ7ZUXSiCwTQQnR81cs6IXuUwc9ZKwo6Oe/aXdc0vH5MiuBLM3y5OXnnrWoBI5Wk3c6a+NE9mzTDY3tQ1yDH8H1n/3hTW/ylh0RQfUZ1rclGrbxCCjvs+qgEfaPitZ\r\nage: 76242\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0319e44866c84b8bc\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":237,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 14 x 44, 8-bit colormap, non-interlaced","md5":"5ecca260da6fc5e2843405c20ac69817","sha1":"3918cfad7493b6860ded9e259ba90bc6a853f1b1","sha256":"078a4aac39c49a33cbabf23cda7579fa7b76e875e6b6d24d16cfcbf9f8b250df","sha512":"b76a870a79a87a450e5d30a218d75093b57415c563e64a8ffd6839a31b36379dbc08398698b9c1368ecda671d65045d5cfebe3363b98d746d89dcaad15bcd8ce","ssdeep":"","tlshash":"6dd0a99be2076faed1c70bb3732e0ca18a8124e892944b088042c622ca663a1dd82042","first_seen":"2025-08-29T11:05:53.221032Z","last_seen":"2026-07-23T00:35:01.985724Z","times_seen":2441,"resource_available":false,"data":null}},"time_used":11022,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2770,"receive":8252,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.f27g.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size704x442_73525908-fb7b-43df-ab6b-ee9a1274a74c.png","fqdn":"www.f27g.top","domain":"f27g.top","tld":"top"},"ip":{"addr":"154.39.104.128","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.f27g.top/","date":"2026-05-20T08:35:29.204Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"f27g.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 May 2026 07:26:16 GMT","end":"Thu, 13 Aug 2026 07:26:15 GMT"},"fingerprint":{"sha1":"FF:61:D8:0C:30:3A:69:44:08:42:C5:72:3B:10:09:DE:63:DC:78:BF","sha256":"66:E6:54:44:FC:72:AC:B5:12:DA:7B:C3:16:1C:14:BB:6C:CF:0B:30:A1:A5:3F:55:A6:B6:B7:6F:AD:71:EA:6C"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size704x442_73525908-fb7b-43df-ab6b-ee9a1274a74c.png HTTP/1.1\r\nHost: www.f27g.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.f27g.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 20 May 2026 08:35:32 GMT\r\ncontent-type: image/webp\r\ncontent-length: 26068\r\netag: \"da33ad9a009a89e0bc0c508e6f690949\"\r\nlast-modified: Sun, 09 Nov 2025 14:20:32 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=p74RddUsOnNoLhf3xJJPl5i0k8kIAciatgCxpwcaTBThUbKLdrcj76XmEHTUQlPKCpscjohmgOcIHnZ4h7nxq6t2IYlVGsJSYVqQuMJIXJb6i%2BebNIaEYN7I1XQ0MiFEyiVX74jVGYFZeztAKpKXg%2BQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 76251\r\ncf-cache-status: HIT\r\ncf-ray: 9fe2bc98991d06b9-HKG\r\ncache-control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\naccess-control-allow-origin: *\r\nx-custom-check: true\r\nserver: Nginx\r\nl-safe: 1779266132=N/QnbzZ2AZFVQCEm7JFlxb/Bt7QEyfiTmWOO5avUYGYcydOyUTUE3M+0/CnQju09ro3iPnqv37qegrHX9VflpfsX9bMR5/oKM4OsbdPf6EbSiiSnruQUqfEsDB+h69ibi1EJhuc7KosgEraRD3RBO/XcIUBLNdjiD+/Y2KNympoAi1Od8cSlPIPJAvj7ymRQ\r\nl-via: l1=4iaGgjza0Vwox8nX\r\nl-version: 1778833488\r\nl-request-id: 5a0919e44869a0fc99e\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26068,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"da33ad9a009a89e0bc0c508e6f690949","sha1":"52521f6667f933538fd61fac097ba79db283c0cf","sha256":"12889485842cb12ca8c77f0a9c71ac3098cf3c9898b3cdc299145280170962d6","sha512":"a254ca97846b0d3216994f8db6adfee226b9b2c6120a33c1ec1f0a635f658f99e6b2c2407dffcbe79d5dc65aca0869aff746d751347eaf9780083b0e25103fe0","ssdeep":"384:+w9CBmVKxqlIavZBdogyHrWz/1ope325wQBJKn5QahMi7HjOMdOdjawQJoYh:+yYmV5Vv7WZLWhop42525Q0M+HujawQ","tlshash":"e9c2e1c2bd2de50a9b37c27e24a6c30f01c497808faa2c677736129d4d365abb56900e","first_seen":"2026-04-24T23:10:16.863494Z","last_seen":"2026-07-23T00:35:01.915562Z","times_seen":965,"resource_available":false,"data":null}},"time_used":4632,"timings":{"blocked":-1,"dns":0,"connect":0,"send":2796,"wait":937,"receive":899,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"www.f27g.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"www.f27g.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}}]}