{"report_id":"858e60a4-d6df-445d-9550-c89913d9b39d","version":0,"status":"done","tags":[],"date":"2026-10-08T00:12:23Z","url":{"schema":"http","addr":"designerforhad.com/","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":0,"asn":137951,"as":"ASLINE LIMITED","country":"Seychelles","country_code":"SC"},"final":{"url":{"schema":"https","addr":"designerforhad.com/","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"title":"MK（体育科技有限公司）体育官方网站","dom":{"size":25490,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (478)","md5":"409339f383db836999d4a3d96bb79639","sha1":"8fd6924490826722689125b03d51baf4f2412cbe","sha256":"01a96e435ad73e9886aa8a32447d5f88e4a2c3e4c7b57b99c54735bac97256cf","sha512":"77dbdd6df094d7c754f4414867b8bd4b07934824cb69234322a45ee5c7a2c02b69f985c0d3a5f7356093dbd7d8e3866253cf8864e9eab4e51d765a840b6b403a","ssdeep":"384:4dYJqqtm/p8JHTWj0OrsEP+AXvJDoqDJ4ybs41zy2py+sh1wsd:PBVW3QEP+a5owpzFsh1wsd","tlshash":"79b29531a0f4397b12a781f1a729bb0a6ee5e60bd56b4586b3fc47c44f93d83894724c","dom_hash":"domhashdd25199622c84750abd9332f165f7048","first_seen":"2026-10-08T00:12:31.001991Z","last_seen":"2026-10-08T00:12:31.001991Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"designerforhad.com/","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":0,"asn":137951,"as":"ASLINE LIMITED","country":"Seychelles","country_code":"SC"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-12T00:12:23Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"athrvb.cn","ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"domain_registered":"2024-12-03","domain_rank":0,"first_seen":"2026-10-08T00:12:26.241384Z","last_seen":"2026-10-08T00:12:26.241384Z","alert_count":0,"request_count":17,"received_data":1812630,"sent_data":8776,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"designerforhad.com","ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"domain_registered":"2021-06-01","domain_rank":0,"first_seen":"2026-10-08T00:12:26.243184Z","last_seen":"2026-10-08T00:12:26.243184Z","alert_count":60,"request_count":20,"received_data":1715244,"sent_data":10120,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"designerforhad.com/e/dongpo/tz/tz.js","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"7f1b6b008ebca934ca83684547f0f6a0","sha1":"54a877dfe0860df5d3a3d9fbac3615cb208da305","sha256":"aed0bdee18c3e227593966cb17bb3e0166ef2ff68847f5c6536a3c772e01a0a8","sha512":"5da23b299ab09c8749dd7366e90f543b5272c87e9491ea199ea57819caade42556bd68b20f8b75675ccf8d9be618d49f3cd49dac358b4b3b180b0617c4bbbeeb","ssdeep":"","tlshash":"dd210f7f0832a42c9325505f3074d84e78b4807dab258915d0ecfc2a94f4f52486fa8c","size":1204,"data":"","first_seen":"2026-10-08T00:12:31.034973Z","last_seen":"2026-10-08T00:12:31.034973Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/bootstrap/js/bootstrap.bundle.min.js","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"21d4551af5cc4ed4d818bdbdfea8c358","sha1":"df272a07ed30eaf8025b699c45736ba9d284e4d4","sha256":"35f4547d9364111aca4850347356bc5660a994f0d8b694d88f995098a7b547fa","sha512":"4dcd22faf4688265f834deedb8b6d07c1c5af0991f512031485573994df59d5747ca21c494f3f2d9c59f15a7260892b0d15aa8bebcca85d7764d24cc740c69da","ssdeep":"1536:/SwJiEbnTl6R2t49CFliFCIg/yWszSraJd5qUFH9tZwcE+iYZMgZdj:6wfs+SSO5q4tZwcEVYZFj","tlshash":"2383b5593244b8730ade85b68037430bf2265998b14b812cb57cadde2a7dcc67277f78","size":80821,"data":"","first_seen":"2025-06-18T01:20:12.005242Z","last_seen":"2026-10-08T02:46:07.624355Z","times_seen":3050,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/swiper/js/swiper-bundle.min.js","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"21b78ba7133b3d67cf8b09cd6a26d386","sha1":"ea59f37b232db6dee2694078bf21e153a09bacdd","sha256":"6f9df49fe12f77b66daba876cb33b7090b2443f570a2a4b9541cddd705440aa5","sha512":"dc48bb38f168f37930ddc3db0cb78b867fd817cb5907b56cf2c7e58b407f2847a4bab78be5ea2c0deb216052020afb782bc8b4c948a5fe52b77128a27365a392","ssdeep":"1536:TIJQfGP7LP8NEuWGKF+IlzholxU/2Bkt+9SD8jv1nTHlU9ymp8Mj0HEOS5hAsVuZ:0JCN+TXD2BkQZFU9tp8Mj0k95h5cpnv","tlshash":"02d3f8896221b57646e316db93e4c221a3b50544b80ac8f470bd4c9f597ec9813feffa","size":140562,"data":"","first_seen":"2023-06-14T11:52:48Z","last_seen":"2026-10-08T00:12:31.016995Z","times_seen":6137,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/bootstrap/js/home.js","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"16c93ef01acd14ec64c07020d638253e","sha1":"9c7b9d1a61977675c7f128bf2e27093d3cfe37f6","sha256":"f0795e9620ff382d585e15e40f303b394863fc5fa3dbdecd140adcbc4e51ffd2","sha512":"218d41ff60e128ff13105f9d376cfac1b80401527884da7b6179bab1fe8e9aa9e5959873bc5385798c8a5c6fb7aedce8e68b17112833cc16c096e0dc214d35ea","ssdeep":"96:6P7fgtAVMsSMCM1vUrp8KtQJQ1l/2o3RV0uRC6v6qyS+KQkIF:6P7fg+VSVAvUr2KaG1Zd3YuRriqyDKQH","tlshash":"91c1551a62b42433447775bb97af57c477212087b8c6ec393dfcc6080f845aa59f1aea","size":5802,"data":"","first_seen":"2025-10-09T23:37:04.756251Z","last_seen":"2026-10-08T00:12:31.046475Z","times_seen":1521,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"athrvb.cn/static/autolinks.js","fqdn":"athrvb.cn","domain":"athrvb.cn","tld":"cn"},"ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"introduction_type":"scriptElement","is_inline":false,"md5":"498ea2ec3e2f41fd17ba638aa45d29df","sha1":"a5b604df7bcaa26680b01f6cb01d648fe48eb0b2","sha256":"17bd25809e7d06e99faa34e3a10382e4e2792b2312371fd54387fb482b9ee8c5","sha512":"95dde1e5b5f47bf70e53f9b9479646cb5f70a5a3283e9497be3d5c703b0c6fb11071c99f385ad59d72e11e93bb328752ae45bd6c51b230854c73f5019907eff1","ssdeep":"192:+URIemowmeam3wmS4macmRsY7mYePqmn7moBmeXm3ZmSxmacmRsY7mYePqmiKd5l:uvZe6vZeYKjNo/Pwv7","tlshash":"16d199df42d79c420500b6ea343e3628e2ef0427cd5c78c2be6d27b44fd5329a662476","size":6472,"data":"","first_seen":"2026-10-08T00:12:31.031634Z","last_seen":"2026-10-08T00:12:31.031634Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"athrvb.cn/","fqdn":"athrvb.cn","domain":"athrvb.cn","tld":"cn"},"ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"introduction_type":"scriptElement","is_inline":true,"md5":"592c269dd91ae9f9dbaa675657ecc0f6","sha1":"1e8da77bfc57ca2e36470bf89395d8f316526286","sha256":"3a9f6b47050fca7524e5801e573cd8eb86a286035211d506a03b11329f38f5be","sha512":"914b073321f5c2f2d1167a85a3da5c370a1897564b7409ac6b120dc2c5d44d06cd327cc5dea4e3a9e73cd7e67e2636d7b53f520a861191d046aec0f70e2aea85","ssdeep":"","tlshash":"9ad0951f1c551434135908be1176dd4cf06254cc113ee50150cde4015970ed1482e7cc","size":252,"data":"","first_seen":"2026-10-08T00:12:31.054723Z","last_seen":"2026-10-08T00:12:31.054723Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"athrvb.cn/static/xk.png","fqdn":"athrvb.cn","domain":"athrvb.cn","tld":"cn"},"ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://athrvb.cn/","date":"2026-10-08T00:11:51.052Z","timestamp":1791418311052,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sjbgw.athrvb.cn","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 05 Oct 2026 03:00:00 GMT","end":"Sun, 03 Jan 2027 02:59:59 GMT"},"fingerprint":{"sha1":"7D:97:CD:11:AB:7F:5A:38:1C:A4:68:17:51:AE:FE:94:54:CE:0C:BE","sha256":"F4:FA:52:DF:5C:9C:66:E6:98:11:DF:35:1B:5D:09:F9:7D:CE:E6:FD:61:07:E8:F0:92:5B:E1:4B:EA:09:5A:24"}}},"request":{"raw":"GET /static/xk.png HTTP/1.1\r\nHost: athrvb.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://athrvb.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:51 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 09 Sep 2025 10:23:02 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c00006-1d3b\"\r\nset-cookie: server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax\r\nexpires: Sat, 07 Nov 2026 00:11:51 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"server_session_cbbe974f","value":"08eb22ccecd3aaf282ff7246e5ea03b9","quoted":false,"path":"/","max_age":864000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7483,"size_decoded":8079,"mime_type":"image/png","magic":"PNG image data, 167 x 144, 8-bit/color RGBA, non-interlaced","md5":"fea24816374562273ac051b7ad8f327e","sha1":"eb22d4a16f3d0411c4b6a1809f3ef0d3dde574fe","sha256":"7c0b20b9d13726b54f2309b659946e4f84ee540c372cffa05779ce5914125594","sha512":"0e7f4cc510aa796cd77964d2b6049448ef0da4950e8cb050dd3e48e5dd3e77c9a6dff231e808ddfab24b385499e5fb2df7cee10f130d141b1191104a6ea2ec71","ssdeep":"192:vSTyw+STLf9dJa61OCbztmFgtgLEbnq8cRywnB:aTgSHFdM61FbRnaL2MF","tlshash":"85f19ee7092fd38f966b1b0461a545fafb0ed306f1f10b052a2028fb7a68c3b0497158","first_seen":"2025-09-13T02:55:28.417753Z","last_seen":"2026-10-08T00:12:31.006792Z","times_seen":50,"resource_available":false,"data":null}},"time_used":430,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":430,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"athrvb.cn/static/leyu.png","fqdn":"athrvb.cn","domain":"athrvb.cn","tld":"cn"},"ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://athrvb.cn/","date":"2026-10-08T00:11:51.071Z","timestamp":1791418311071,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sjbgw.athrvb.cn","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 05 Oct 2026 03:00:00 GMT","end":"Sun, 03 Jan 2027 02:59:59 GMT"},"fingerprint":{"sha1":"7D:97:CD:11:AB:7F:5A:38:1C:A4:68:17:51:AE:FE:94:54:CE:0C:BE","sha256":"F4:FA:52:DF:5C:9C:66:E6:98:11:DF:35:1B:5D:09:F9:7D:CE:E6:FD:61:07:E8:F0:92:5B:E1:4B:EA:09:5A:24"}}},"request":{"raw":"GET /static/leyu.png HTTP/1.1\r\nHost: athrvb.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://athrvb.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:51 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 09 Sep 2025 08:28:33 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68bfe531-562\"\r\nset-cookie: server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax\r\nexpires: Sat, 07 Nov 2026 00:11:51 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"server_session_cbbe974f","value":"08eb22ccecd3aaf282ff7246e5ea03b9","quoted":false,"path":"/","max_age":864000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1378,"size_decoded":2046,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"06bb521a46e0462315ca6e06e3ced7a0","sha1":"d2b7d00c65e63f738c72c16df20b4056a734fd57","sha256":"008be0d35bac1c1c4bc8c2d59d98a85ae53c685d2b649d4406e0615f971224cb","sha512":"2c1727e25eee283360f76154c0275ca9f78e5f734959cf6c2a54511a9f58bda853103fa9b60b2469eea50d00ee45465293fc9791fa48d3867332458a099c26e5","ssdeep":"","tlshash":"a921089b9e9fa8facfd212b3a4b220b5d1f1e9c75c114a640950c84b832d649403ee85","first_seen":"2025-09-13T02:55:28.46765Z","last_seen":"2026-10-08T00:12:31.013381Z","times_seen":72,"resource_available":false,"data":null}},"time_used":412,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":412,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/swiper/css/swiper-bundle.min.css","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:48.800Z","timestamp":1791418308800,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET /skin/swiper/css/swiper-bundle.min.css HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:48 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 08 Mar 2026 11:19:30 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ad5b42-4691\"\r\nexpires: Thu, 08 Oct 2026 12:11:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18065,"size_decoded":5190,"mime_type":"text/css","magic":"ASCII text, with very long lines (17812)","md5":"ea28ae0aaf82709381c57d6a7daa7a05","sha1":"a7c528dc9018aeefed9a52337168decb220e2f61","sha256":"af8545de3876815292506711e1369bff9dfe57ec7e04c45c3e1bdac48a11f3b2","sha512":"9c63402a957e06b7c365a6cf5f53baaba991953e7bfda99d8feeaf177db6a2782a28004b1d82df2dcde362d5556e4891f6da300d63cf13d816144dadb1920f66","ssdeep":"192:1VmUJbiKne0JlXZHZ+Sme+jexS4nxep/a2GZb0Q5nfufKlAYfg5fyeesedOJ9A5Q:1gUbe0JdZHZ+W+SFnZ24tlWfF4XYz","tlshash":"d08245a85340282753274f364b71cbb9dd7444d20f9389ae91c0ee48d7f6db9132f6a9","first_seen":"2023-06-14T11:52:48Z","last_seen":"2026-10-08T00:12:31.015599Z","times_seen":6769,"resource_available":true,"data":null}},"time_used":446,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":446,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/swiper/js/swiper-bundle.min.js","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:48.854Z","timestamp":1791418308854,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET /skin/swiper/js/swiper-bundle.min.js HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:48 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 08 Mar 2026 11:19:30 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ad5b42-22512\"\r\nexpires: Thu, 08 Oct 2026 12:11:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":140562,"size_decoded":39953,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65283)","md5":"21b78ba7133b3d67cf8b09cd6a26d386","sha1":"ea59f37b232db6dee2694078bf21e153a09bacdd","sha256":"6f9df49fe12f77b66daba876cb33b7090b2443f570a2a4b9541cddd705440aa5","sha512":"dc48bb38f168f37930ddc3db0cb78b867fd817cb5907b56cf2c7e58b407f2847a4bab78be5ea2c0deb216052020afb782bc8b4c948a5fe52b77128a27365a392","ssdeep":"1536:TIJQfGP7LP8NEuWGKF+IlzholxU/2Bkt+9SD8jv1nTHlU9ymp8Mj0HEOS5hAsVuZ:0JCN+TXD2BkQZFU9tp8Mj0k95h5cpnv","tlshash":"02d3f8896221b57646e316db93e4c221a3b50544b80ac8f470bd4c9f597ec9813feffa","first_seen":"2023-06-14T11:52:48Z","last_seen":"2026-10-08T00:12:31.016995Z","times_seen":6137,"resource_available":true,"data":null}},"time_used":540,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":540,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/ico/favicon88.ico","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:49.911Z","timestamp":1791418309911,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET /skin/ico/favicon88.ico HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:49 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 16958\r\nlast-modified: Sun, 08 Mar 2026 11:19:30 GMT\r\netag: \"69ad5b42-423e\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16958,"size_decoded":17232,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel","md5":"3189e489154d9c041d05b80151f28978","sha1":"7358b9cea6623a207ba8bf37ac5d860aa2340c61","sha256":"3a0005440e55d6202c53ae326d8abeef2045ee90e9966e2439ec83c9eacccfc8","sha512":"3a9700610b47f8c19555791497c742d198a38c4c23b1683e3fc2ad919ad841e5dc57e5ad7f4b5a2ec7e1d36cd70c8392fe645e641c500a1721ded25ad15bfbc8","ssdeep":"192:rqUooooooooOoooooot56O1bI5HfJEdOt2aOhWfoBq3iU7UVt6c9SVoIFdskwT:GhQeMtlOVzVlKoIrsz","tlshash":"dd72d72b65ee4686c461f9f5c841e2341e008dfe1e2a8506bef3ff073b65c869c45ad2","first_seen":"2026-04-10T12:00:19.876491Z","last_seen":"2026-10-08T00:12:31.018086Z","times_seen":13,"resource_available":false,"data":null}},"time_used":151,"timings":{"blocked":3,"dns":0,"connect":0,"send":0,"wait":148,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"athrvb.cn/static/lj.png","fqdn":"athrvb.cn","domain":"athrvb.cn","tld":"cn"},"ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://athrvb.cn/","date":"2026-10-08T00:11:51.061Z","timestamp":1791418311061,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sjbgw.athrvb.cn","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 05 Oct 2026 03:00:00 GMT","end":"Sun, 03 Jan 2027 02:59:59 GMT"},"fingerprint":{"sha1":"7D:97:CD:11:AB:7F:5A:38:1C:A4:68:17:51:AE:FE:94:54:CE:0C:BE","sha256":"F4:FA:52:DF:5C:9C:66:E6:98:11:DF:35:1B:5D:09:F9:7D:CE:E6:FD:61:07:E8:F0:92:5B:E1:4B:EA:09:5A:24"}}},"request":{"raw":"GET /static/lj.png HTTP/1.1\r\nHost: athrvb.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://athrvb.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:51 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 09 Sep 2025 10:17:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68bffecd-2604\"\r\nset-cookie: server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax\r\nexpires: Sat, 07 Nov 2026 00:11:51 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"server_session_cbbe974f","value":"08eb22ccecd3aaf282ff7246e5ea03b9","quoted":false,"path":"/","max_age":864000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9732,"size_decoded":10401,"mime_type":"image/png","magic":"PNG image data, 164 x 88, 8-bit/color RGBA, non-interlaced","md5":"5013807299660ff681f6f6da001ad104","sha1":"2d31057a6125c141f4dda53c6a632fb4af56e26a","sha256":"e8a5513dec0dede850653ae7f4cc23ae9666f36256a07ac5a09aeed2ab74d2b8","sha512":"e84d7fdc81b2b51d8c25b97f9176d83c724e983b701dc54f291d25c7c4fed1d2bc318ea4f78da1f6df90acaef39695c430ed815d0f5e797d0e09cbe0986b4ff1","ssdeep":"192:eb22WP4NmbAu4n4QzNKbgK7l83HYK2rsHCuoTorqFHs3QpWkk/SAJ8cV:eb2PPZb+zNKb7K4K2Fuyo+FHs3Qd4gcV","tlshash":"a1129f3be8ec69d9180d9813c5f7dc4dbd15bb3419c64a8e09e18259b77ce8424629c8","first_seen":"2025-09-13T02:55:28.421658Z","last_seen":"2026-10-08T00:12:31.019497Z","times_seen":60,"resource_available":false,"data":null}},"time_used":422,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":422,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"athrvb.cn/static/hth.png","fqdn":"athrvb.cn","domain":"athrvb.cn","tld":"cn"},"ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://athrvb.cn/","date":"2026-10-08T00:11:51.075Z","timestamp":1791418311075,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sjbgw.athrvb.cn","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 05 Oct 2026 03:00:00 GMT","end":"Sun, 03 Jan 2027 02:59:59 GMT"},"fingerprint":{"sha1":"7D:97:CD:11:AB:7F:5A:38:1C:A4:68:17:51:AE:FE:94:54:CE:0C:BE","sha256":"F4:FA:52:DF:5C:9C:66:E6:98:11:DF:35:1B:5D:09:F9:7D:CE:E6:FD:61:07:E8:F0:92:5B:E1:4B:EA:09:5A:24"}}},"request":{"raw":"GET /static/hth.png HTTP/1.1\r\nHost: athrvb.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://athrvb.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:51 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 09 Sep 2025 08:28:33 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68bfe531-4e9\"\r\nset-cookie: server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax\r\nexpires: Sat, 07 Nov 2026 00:11:51 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"server_session_cbbe974f","value":"08eb22ccecd3aaf282ff7246e5ea03b9","quoted":false,"path":"/","max_age":864000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1257,"size_decoded":1925,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"213759ff96f657b5ef67d5c1b3b65a38","sha1":"d8074364d11cef8a4d21603671105cad5e29b045","sha256":"e7b58716c5add0d6815b98839eb4bd85637f7872324ab339f9b63bd1dde9de08","sha512":"7add87a2f89032677a75c43d249c7ca7405c2787313def0be6c75bfef73fbfc7196f05e954bbae29869f3a0eef2c2ab6e3e3fbf9b358e338d8d87ba6f41e94b0","ssdeep":"","tlshash":"4121e7c7c516d9cd6040ff4a2c2a8528794da0051573c3b23a8fae2b53f3240b487155","first_seen":"2025-09-13T02:55:28.494135Z","last_seen":"2026-10-08T00:12:31.020044Z","times_seen":71,"resource_available":false,"data":null}},"time_used":409,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":409,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/fontawesome/webfonts/fa-solid-900.woff2","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:49.349Z","timestamp":1791418309349,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET /skin/fontawesome/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/skin/fontawesome/css/all.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:49 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 158220\r\nlast-modified: Sun, 08 Mar 2026 11:19:28 GMT\r\netag: \"69ad5b40-26a0c\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":158220,"size_decoded":158494,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 158220, version 775.1280","md5":"4a6591ab5460ae5cbff1ecbd6e52193a","sha1":"7cd8afd6501962fda35d66f0e4c3b8815ac471d8","sha256":"aa75998623a391e61c6901794ace832e3ecdd288b56d608f21bea0411acc0b8e","sha512":"96c5d3283b71613b595b6b0420333bef5d64451af05c59dde27ec5b3e7cfe6e9549c604cddfbcb79cbc0fd4cd6f2e22a130c9a220b1b7ef933ac9df8c8e695d6","ssdeep":"3072:RauSB5FANIRLpsBaBrJGNG3ECNQztRvHHqkqLrlF:guSqN6ptrJGo3POh9KT9F","tlshash":"0ef312a710c6b95684a3a51b336adeb52c3ed363fcb6cd73be340114689da9c2e4d190","first_seen":"2024-12-19T10:41:23.153533Z","last_seen":"2026-10-08T05:03:57.886433Z","times_seen":37393,"resource_available":false,"data":null}},"time_used":490,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":344,"receive":146,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"athrvb.cn/static/2.css","fqdn":"athrvb.cn","domain":"athrvb.cn","tld":"cn"},"ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://athrvb.cn/","date":"2026-10-08T00:11:51.032Z","timestamp":1791418311032,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sjbgw.athrvb.cn","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 05 Oct 2026 03:00:00 GMT","end":"Sun, 03 Jan 2027 02:59:59 GMT"},"fingerprint":{"sha1":"7D:97:CD:11:AB:7F:5A:38:1C:A4:68:17:51:AE:FE:94:54:CE:0C:BE","sha256":"F4:FA:52:DF:5C:9C:66:E6:98:11:DF:35:1B:5D:09:F9:7D:CE:E6:FD:61:07:E8:F0:92:5B:E1:4B:EA:09:5A:24"}}},"request":{"raw":"GET /static/2.css HTTP/1.1\r\nHost: athrvb.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://athrvb.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:51 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 09 Sep 2025 08:28:32 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68bfe530-fc92\"\r\nset-cookie: server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax\r\nexpires: Thu, 08 Oct 2026 12:11:51 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"server_session_cbbe974f","value":"08eb22ccecd3aaf282ff7246e5ea03b9","quoted":false,"path":"/","max_age":864000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":64658,"size_decoded":11719,"mime_type":"text/css","magic":"ASCII text, with very long lines (2257)","md5":"8c65366b28a5b9e286246fbf57054688","sha1":"92e9cf2e7bcc867c9a2efe28e250bf8574b2a724","sha256":"96d9dd208f1201711e37587a5c014b226cc3a8cb645037ea5ca2e6d96225e461","sha512":"7a367a054a9c13c3b9f47c2bc5d5d68f3aa8de2cb997d0c26f3d6b983787117d1e19aa84596d10971a6b5fe99dfa558adeec6aedad212e6ae619ef8055acf518","ssdeep":"1536:e642g3ZpLnTllN2/O3Lh73xCx6Kv0X0/U/lMN7:e69g3Zp/llN2/v6Kv0X0/U/lMN7","tlshash":"505395310b734864f1ab8d0e6faaa7586b54c083c187cc78bb81b649dfc31b562957de","first_seen":"2025-09-13T02:55:28.509234Z","last_seen":"2026-10-08T00:12:31.021597Z","times_seen":20,"resource_available":true,"data":null}},"time_used":154,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"athrvb.cn/static/sponser01.png","fqdn":"athrvb.cn","domain":"athrvb.cn","tld":"cn"},"ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://athrvb.cn/","date":"2026-10-08T00:11:51.046Z","timestamp":1791418311046,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sjbgw.athrvb.cn","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 05 Oct 2026 03:00:00 GMT","end":"Sun, 03 Jan 2027 02:59:59 GMT"},"fingerprint":{"sha1":"7D:97:CD:11:AB:7F:5A:38:1C:A4:68:17:51:AE:FE:94:54:CE:0C:BE","sha256":"F4:FA:52:DF:5C:9C:66:E6:98:11:DF:35:1B:5D:09:F9:7D:CE:E6:FD:61:07:E8:F0:92:5B:E1:4B:EA:09:5A:24"}}},"request":{"raw":"GET /static/sponser01.png HTTP/1.1\r\nHost: athrvb.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://athrvb.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:51 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 09 Sep 2025 08:28:32 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68bfe530-60ab\"\r\nset-cookie: server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax\r\nexpires: Sat, 07 Nov 2026 00:11:51 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"server_session_cbbe974f","value":"08eb22ccecd3aaf282ff7246e5ea03b9","quoted":false,"path":"/","max_age":864000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24747,"size_decoded":25390,"mime_type":"image/png","magic":"PNG image data, 1136 x 128, 8-bit colormap, non-interlaced","md5":"9bbd14aaa29eb20df37cd9272417e088","sha1":"6c80ad5eb8bd0d4a82d56f3b6406589d4032b61e","sha256":"53d0d47f075a7a35a45bc7aa0b7ed0c1724b0ec933cd983edcd5cb1a047ba6a9","sha512":"a15f5ad856dc362b28242a804666ef3ea632bccb228636a355832ff9f590b56b6fdde704b857d0b456a8088aae6556d07e0116deda0dd43ead4e7086332e9ed4","ssdeep":"768:DlQDxDH+y/M5J92quuDv9z2DlGfBQbrMDSRxBm/v:DCxb45J9ttDl0brqSRx4X","tlshash":"e9b2e1ad8439883946db39676390d8a18855cb44a5cbcf0dbc64df774dc11b35aa288f","first_seen":"2024-02-21T00:22:35Z","last_seen":"2026-10-08T00:12:31.02223Z","times_seen":381,"resource_available":false,"data":null}},"time_used":436,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":436,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"athrvb.cn/static/jy.png","fqdn":"athrvb.cn","domain":"athrvb.cn","tld":"cn"},"ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://athrvb.cn/","date":"2026-10-08T00:11:51.064Z","timestamp":1791418311064,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sjbgw.athrvb.cn","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 05 Oct 2026 03:00:00 GMT","end":"Sun, 03 Jan 2027 02:59:59 GMT"},"fingerprint":{"sha1":"7D:97:CD:11:AB:7F:5A:38:1C:A4:68:17:51:AE:FE:94:54:CE:0C:BE","sha256":"F4:FA:52:DF:5C:9C:66:E6:98:11:DF:35:1B:5D:09:F9:7D:CE:E6:FD:61:07:E8:F0:92:5B:E1:4B:EA:09:5A:24"}}},"request":{"raw":"GET /static/jy.png HTTP/1.1\r\nHost: athrvb.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://athrvb.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:51 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 09 Sep 2025 10:23:02 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c00006-38d5\"\r\nset-cookie: server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax\r\nexpires: Sat, 07 Nov 2026 00:11:51 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"server_session_cbbe974f","value":"08eb22ccecd3aaf282ff7246e5ea03b9","quoted":false,"path":"/","max_age":864000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14549,"size_decoded":15065,"mime_type":"image/png","magic":"PNG image data, 197 x 120, 8-bit/color RGBA, non-interlaced","md5":"fd8e743a40bfb99f566baa193d7d166c","sha1":"2471dc7bb0a09101884326cc3343d7b1869889b8","sha256":"262ce70e3539428c46dfc3198f6eb21903ca821e0f73df4b4811a3277a9b4499","sha512":"5006a36f5c8ad63211f6d747cbc0c0369afcff2cf35ec0af0e78b9cf7380bc4fc6b5972016a899db4d395701d05354a8b7ec1cd74b4ded92892ff2a39a595439","ssdeep":"384:43pC+BQolFFy8WifSJ2fOtLrG17xLa4T50Z:8C+2o//t1mtYn2","tlshash":"1262d082192970178d8366cf5a964047ef951f629f28cd46a23370e71b05b4a0ffab23","first_seen":"2025-09-13T02:55:28.489514Z","last_seen":"2026-10-08T00:12:31.022715Z","times_seen":30,"resource_available":false,"data":null}},"time_used":419,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":419,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/cover/designerforhadcom/departments2-88.webp","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:48.876Z","timestamp":1791418308876,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET /skin/cover/designerforhadcom/departments2-88.webp HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 84002\r\nlast-modified: Sun, 31 May 2026 07:34:27 GMT\r\netag: \"6a1be483-14822\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":84002,"size_decoded":84275,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 727x484, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"203d6932fb5eb5cdfc1c18b23375e485","sha1":"8622eec66c07ef12bc2a0fd3c7029bcbdb898964","sha256":"80eae8b32abe9bb398b5a0ce78bd8b537c21a66d9d57c9891259250d897a379e","sha512":"ef1bb15d7fa7857dd741d2cd1081a4c3ee46c4e89b408b5962baa60541b64b5bf5127dd822a5cddb32257ee32a894cea7302444af6a51f81a7ca7f3337efff61","ssdeep":"1536:T0tLc22Rel9SxdxdA/GxrwZc9QRc67KWEK7oFUE/0xEvPdHVQ61a8TcMW:O9SxjdA/m8fSaEK7oFUEMxEnZpg","tlshash":"348312e35f0bbcda156f9d3582f2705638e497b2b2c8316b5f96c058b129b1e9ec8c44","first_seen":"2026-10-08T00:12:31.023368Z","last_seen":"2026-10-08T00:12:31.023368Z","times_seen":1,"resource_available":false,"data":null}},"time_used":826,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":518,"receive":308,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/bootstrap/css/module.css","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:48.797Z","timestamp":1791418308797,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET /skin/bootstrap/css/module.css HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:48 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 08 Mar 2026 11:19:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ad5b40-28112\"\r\nexpires: Thu, 08 Oct 2026 12:11:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":164114,"size_decoded":32362,"mime_type":"text/css","magic":"ASCII text, with very long lines (65518)","md5":"67e45932bedd92dd7bc2a7de1653677e","sha1":"b15f3b2e370d9a7c2c40ea991c8f4a839617702d","sha256":"6e25cdc64273a412026df8a7b3510d9ba7dd6cd75653dd3eb884371b4ace73e8","sha512":"d6130c594f82eefca5109421095dc8c0603b44c4c714bdb8956e64278c9c1625263a531a1ad401fa344f180c2f1cbe95af8246c9e33dc6a28316ab243f448591","ssdeep":"1536:qiVj2AhHm0CfrtrPr7AhhTQbdS6U8H2GXVxICl1gGqotJFFp4L/Xzbv9ALVTFCew:sAhhTQg6U8p45s5Q","tlshash":"c6f397309984202cf11bc5eae5d0abef32649801f663077ef66370a6d6c21ef577674a","first_seen":"2025-10-09T23:37:04.753197Z","last_seen":"2026-10-08T00:12:31.024532Z","times_seen":1489,"resource_available":true,"data":null}},"time_used":449,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":449,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/cover/designerforhadcom/departments1-88.webp","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:48.875Z","timestamp":1791418308875,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET /skin/cover/designerforhadcom/departments1-88.webp HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 125406\r\nlast-modified: Sun, 31 May 2026 07:34:26 GMT\r\netag: \"6a1be482-1e9de\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":125406,"size_decoded":125680,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 740x493, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0c1848d2b9b3c5fdd8332c9e38e401fa","sha1":"b4aa1ba9ac03ada31b5aacd4bce5438debfc5a4c","sha256":"1121559773ebe15868e4fad9117258cd0f5d98a6b1b8325f1b372961f7a03c8f","sha512":"118841743a3774c4e49facd98878cf7b135de35ff5e7b7958094344d494402e327fc8947d8e7c4778c47bf417c537909c67a2ec1d8b1859c61b00f4235ac5f4d","ssdeep":"3072:tlGp/6m9QRCbEzcqOdHibdL9x+xxhYYr+7w1kLKP6nl:tEpBuobLfkL9x+xwAueP6l","tlshash":"25c31271038d62eaf77e9975707d2b6f046056349d46c0eaf0c445fb1083ab28af9e97","first_seen":"2026-10-08T00:12:31.025168Z","last_seen":"2026-10-08T00:12:31.025168Z","times_seen":1,"resource_available":false,"data":null}},"time_used":823,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":520,"receive":303,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"athrvb.cn/static/ayx.png","fqdn":"athrvb.cn","domain":"athrvb.cn","tld":"cn"},"ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://athrvb.cn/","date":"2026-10-08T00:11:51.067Z","timestamp":1791418311067,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sjbgw.athrvb.cn","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 05 Oct 2026 03:00:00 GMT","end":"Sun, 03 Jan 2027 02:59:59 GMT"},"fingerprint":{"sha1":"7D:97:CD:11:AB:7F:5A:38:1C:A4:68:17:51:AE:FE:94:54:CE:0C:BE","sha256":"F4:FA:52:DF:5C:9C:66:E6:98:11:DF:35:1B:5D:09:F9:7D:CE:E6:FD:61:07:E8:F0:92:5B:E1:4B:EA:09:5A:24"}}},"request":{"raw":"GET /static/ayx.png HTTP/1.1\r\nHost: athrvb.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://athrvb.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:51 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 09 Sep 2025 10:17:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68bffecd-236d\"\r\nset-cookie: server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax\r\nexpires: Sat, 07 Nov 2026 00:11:51 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"server_session_cbbe974f","value":"08eb22ccecd3aaf282ff7246e5ea03b9","quoted":false,"path":"/","max_age":864000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9069,"size_decoded":9625,"mime_type":"image/png","magic":"PNG image data, 120 x 84, 8-bit/color RGBA, non-interlaced","md5":"d4aa4c0a9b7f3eb6b9907610f7ce38c3","sha1":"af1c9656f20a40791d8ca07c0409a408cf6c1d44","sha256":"ebb635ec2bc453e2c21a191e1c78c16114d2167f6316446cd784ebbfe96f9bbb","sha512":"dbd40b3e57b1d6184d1baa61bd43d7ef301cec2e83a6dc48d61acb62f6e1b451af6bce501b508a6df868f182d137c299f28b5df1840a15d6a7573fd2b0194ecd","ssdeep":"192:a4NNsOkgiF/soN0KhgrzMIv/HcId6kTv8kiZ0A/uPWjWtjGtsjWyxo2:a4NNNUVngrJv/HcPM8tKq1jmjPL+2","tlshash":"54129e9e5d804f65d28c2ab806ddb9685d23e0673ec4db5cbadfc4511223290ab87877","first_seen":"2024-08-14T21:09:33Z","last_seen":"2026-10-08T00:12:31.026153Z","times_seen":76,"resource_available":false,"data":null}},"time_used":415,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":415,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-08T00:11:47.670Z","timestamp":1791418307670,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:48 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25755,"size_decoded":7221,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"68726178b0cc79479f9517224d8fd585","sha1":"6efa08f15652a8277dc67f0896b9b31e673f154d","sha256":"f96c30cac03e99c94012559acaca85c0b1fabca1f49695acaaae7d80d226aa53","sha512":"85f80d53a7e1a29a7cdca7824cbc1b19cbaa256d3620bc6800ce54b8f599c4944dc01421fc6306e832bef7b1339c35ce72113036ba0b56b27f1500c11702de06","ssdeep":"384:sdYJDV7j0fasEP+AXvJDoqDJ4ybs41zy2py+sHZ1ws9:7xV7o3EP+a5owpzFsHZ1ws9","tlshash":"5eb29631a0f4397b12a381f1a729bb0a6ee5e60bd56b5586b3fc47c44f93e83854724c","first_seen":"2026-10-08T00:12:31.027039Z","last_seen":"2026-10-08T00:12:31.027039Z","times_seen":1,"resource_available":true,"data":null}},"time_used":732,"timings":{"blocked":-1,"dns":61,"connect":147,"send":0,"wait":222,"receive":0,"ssl":302},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/bootstrap/js/bootstrap.bundle.min.js","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:48.850Z","timestamp":1791418308850,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET /skin/bootstrap/js/bootstrap.bundle.min.js HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:48 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 08 Mar 2026 11:19:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ad5b40-13bb5\"\r\nexpires: Thu, 08 Oct 2026 12:11:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":80821,"size_decoded":24420,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65299)","md5":"21d4551af5cc4ed4d818bdbdfea8c358","sha1":"df272a07ed30eaf8025b699c45736ba9d284e4d4","sha256":"35f4547d9364111aca4850347356bc5660a994f0d8b694d88f995098a7b547fa","sha512":"4dcd22faf4688265f834deedb8b6d07c1c5af0991f512031485573994df59d5747ca21c494f3f2d9c59f15a7260892b0d15aa8bebcca85d7764d24cc740c69da","ssdeep":"1536:/SwJiEbnTl6R2t49CFliFCIg/yWszSraJd5qUFH9tZwcE+iYZMgZdj:6wfs+SSO5q4tZwcEVYZFj","tlshash":"2383b5593244b8730ade85b68037430bf2265998b14b812cb57cadde2a7dcc67277f78","first_seen":"2025-06-18T01:20:12.005242Z","last_seen":"2026-10-08T02:46:07.624355Z","times_seen":3050,"resource_available":true,"data":null}},"time_used":543,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":543,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/logo/designerforhadcom/logo.webp","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:48.870Z","timestamp":1791418308870,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET /skin/logo/designerforhadcom/logo.webp HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:48 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3322\r\nlast-modified: Sun, 31 May 2026 07:34:26 GMT\r\netag: \"6a1be482-cfa\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3322,"size_decoded":3592,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 400x140, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"73a101b27b84c539d03660f46a6842f2","sha1":"d928fadd2b708cc14a1d68c3609bcce811196470","sha256":"7eed44cf1aec71b735e0c700d8fc2ba8b3b5f039bbd122f4637a6d2c51627a7a","sha512":"6f9693cc4dc7df666db1dfb2ab1fb6b85154827471cc867505bead6edc2657cf13ca01bee4dc8d37c37520d68bad2b5fc99e1acaa6ea7703d20ddd6cc7a91c34","ssdeep":"","tlshash":"03615c805944e4dbf42baf3275e6a170f1c0478d5db2a6e13240e213703c675f84a216","first_seen":"2026-10-08T00:12:31.028952Z","last_seen":"2026-10-08T00:12:31.028952Z","times_seen":1,"resource_available":false,"data":null}},"time_used":526,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":524,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/cover/designerforhadcom/departments4-88.webp","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:48.880Z","timestamp":1791418308880,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET /skin/cover/designerforhadcom/departments4-88.webp HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 87164\r\nlast-modified: Sun, 31 May 2026 07:34:28 GMT\r\netag: \"6a1be484-1547c\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":87164,"size_decoded":87437,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 606x432, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"13301ba3e6e418500b9bfb7cab8c04cc","sha1":"326ad4ac4cfddc7db85481ce304dae07412b3097","sha256":"9d330562853bc71e9835c4a85586d2aedf4d18fbaa24128f76ccddacdff012dc","sha512":"f5d035f13d24ac2901f7fc3bcf57a35bc2f1fd68ec77553b40a27c6a888290f4b57343e8ee4c4f9e9298a5ebcaea4661eed7d75cd85bb1ccdf1d9130e26a15de","ssdeep":"1536:5M1/1kbc8lPmNpOB96GUk9Rngn8W/VvtoaZ7vN6D/G0aatoqr3QgYx9lh20gbEmk:O1/j8lPh6GUkfn1WdOaZU/G8iqr3Ti9j","tlshash":"5c83122d72621538753bfe22756d2f6676f14562afc6d844fc80007296122e42e7fcbe","first_seen":"2026-10-08T00:12:31.030216Z","last_seen":"2026-10-08T00:12:31.030216Z","times_seen":1,"resource_available":false,"data":null}},"time_used":957,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":515,"receive":442,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"athrvb.cn/static/autolinks.js","fqdn":"athrvb.cn","domain":"athrvb.cn","tld":"cn"},"ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://athrvb.cn/","date":"2026-10-08T00:11:51.035Z","timestamp":1791418311035,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sjbgw.athrvb.cn","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 05 Oct 2026 03:00:00 GMT","end":"Sun, 03 Jan 2027 02:59:59 GMT"},"fingerprint":{"sha1":"7D:97:CD:11:AB:7F:5A:38:1C:A4:68:17:51:AE:FE:94:54:CE:0C:BE","sha256":"F4:FA:52:DF:5C:9C:66:E6:98:11:DF:35:1B:5D:09:F9:7D:CE:E6:FD:61:07:E8:F0:92:5B:E1:4B:EA:09:5A:24"}}},"request":{"raw":"GET /static/autolinks.js HTTP/1.1\r\nHost: athrvb.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://athrvb.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:51 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 08 Oct 2026 00:05:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ac6de5f-1948\"\r\nset-cookie: server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax\r\nexpires: Thu, 08 Oct 2026 12:11:51 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"server_session_cbbe974f","value":"08eb22ccecd3aaf282ff7246e5ea03b9","quoted":false,"path":"/","max_age":864000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6472,"size_decoded":2192,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text","md5":"498ea2ec3e2f41fd17ba638aa45d29df","sha1":"a5b604df7bcaa26680b01f6cb01d648fe48eb0b2","sha256":"17bd25809e7d06e99faa34e3a10382e4e2792b2312371fd54387fb482b9ee8c5","sha512":"95dde1e5b5f47bf70e53f9b9479646cb5f70a5a3283e9497be3d5c703b0c6fb11071c99f385ad59d72e11e93bb328752ae45bd6c51b230854c73f5019907eff1","ssdeep":"192:+URIemowmeam3wmS4macmRsY7mYePqmn7moBmeXm3ZmSxmacmRsY7mYePqmiKd5l:uvZe6vZeYKjNo/Pwv7","tlshash":"16d199df42d79c420500b6ea343e3628e2ef0427cd5c78c2be6d27b44fd5329a662476","first_seen":"2026-10-08T00:12:31.031634Z","last_seen":"2026-10-08T00:12:31.031634Z","times_seen":1,"resource_available":true,"data":null}},"time_used":152,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":152,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"athrvb.cn/static/milan.png","fqdn":"athrvb.cn","domain":"athrvb.cn","tld":"cn"},"ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://athrvb.cn/","date":"2026-10-08T00:11:51.058Z","timestamp":1791418311058,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sjbgw.athrvb.cn","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 05 Oct 2026 03:00:00 GMT","end":"Sun, 03 Jan 2027 02:59:59 GMT"},"fingerprint":{"sha1":"7D:97:CD:11:AB:7F:5A:38:1C:A4:68:17:51:AE:FE:94:54:CE:0C:BE","sha256":"F4:FA:52:DF:5C:9C:66:E6:98:11:DF:35:1B:5D:09:F9:7D:CE:E6:FD:61:07:E8:F0:92:5B:E1:4B:EA:09:5A:24"}}},"request":{"raw":"GET /static/milan.png HTTP/1.1\r\nHost: athrvb.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://athrvb.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:51 GMT\r\ncontent-type: image/png\r\ncontent-length: 964\r\nlast-modified: Tue, 09 Sep 2025 08:28:32 GMT\r\netag: \"68bfe530-3c4\"\r\nset-cookie: server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax\r\nexpires: Sat, 07 Nov 2026 00:11:51 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"server_session_cbbe974f","value":"08eb22ccecd3aaf282ff7246e5ea03b9","quoted":false,"path":"/","max_age":864000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":964,"size_decoded":1598,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"c4c7f79194fd952d8bde023d6b594db2","sha1":"11f616754c6eb6b284fef5f8f88905d20b127db4","sha256":"73cf9cda4f5c2f3859ce38b10daab3d6cd5cf48febe28767464a5ca95043d980","sha512":"7f2016e4f8f852fe86f6035f6fb4e6bff2ddc3055f824cdd04009b27af97ad0eb2251dde38ea6ad92c7bbc9f5a1ef6dab4fe51d653e8fe481874fd8d43c7931e","ssdeep":"","tlshash":"11115417ab66798c665cf537125cd873dd761c7ec1b0104b0709bc97b6be4051ab5309","first_seen":"2025-09-13T02:55:28.479901Z","last_seen":"2026-10-08T00:12:31.032701Z","times_seen":71,"resource_available":false,"data":null}},"time_used":717,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":424,"receive":293,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/e/dongpo/tz/tz.js","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:48.848Z","timestamp":1791418308848,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET /e/dongpo/tz/tz.js HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:48 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 05 Oct 2026 04:28:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ac32758-4b4\"\r\nexpires: Thu, 08 Oct 2026 12:11:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1204,"size_decoded":1008,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"7f1b6b008ebca934ca83684547f0f6a0","sha1":"54a877dfe0860df5d3a3d9fbac3615cb208da305","sha256":"aed0bdee18c3e227593966cb17bb3e0166ef2ff68847f5c6536a3c772e01a0a8","sha512":"5da23b299ab09c8749dd7366e90f543b5272c87e9491ea199ea57819caade42556bd68b20f8b75675ccf8d9be618d49f3cd49dac358b4b3b180b0617c4bbbeeb","ssdeep":"","tlshash":"dd210f7f0832a42c9325505f3074d84e78b4807dab258915d0ecfc2a94f4f52486fa8c","first_seen":"2026-10-08T00:12:31.034973Z","last_seen":"2026-10-08T00:12:31.034973Z","times_seen":1,"resource_available":true,"data":null}},"time_used":399,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":399,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"athrvb.cn/","fqdn":"athrvb.cn","domain":"athrvb.cn","tld":"cn"},"ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:49.814Z","timestamp":1791418309814,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sjbgw.athrvb.cn","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 05 Oct 2026 03:00:00 GMT","end":"Sun, 03 Jan 2027 02:59:59 GMT"},"fingerprint":{"sha1":"7D:97:CD:11:AB:7F:5A:38:1C:A4:68:17:51:AE:FE:94:54:CE:0C:BE","sha256":"F4:FA:52:DF:5C:9C:66:E6:98:11:DF:35:1B:5D:09:F9:7D:CE:E6:FD:61:07:E8:F0:92:5B:E1:4B:EA:09:5A:24"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: athrvb.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:50 GMT\r\ncontent-type: text/html\r\nlast-modified: Tue, 06 Oct 2026 05:34:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ac48872-1e43\"\r\nset-cookie: server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"server_session_cbbe974f","value":"08eb22ccecd3aaf282ff7246e5ea03b9","quoted":false,"path":"/","max_age":864000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7747,"size_decoded":2411,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"2ab8b8d273a414481bd1374bbec432b2","sha1":"1cea4556f60dae181c6948c9e06348784cefd45b","sha256":"45f0df978e4263ed235dc7b90c04bafafcc001a5378010744e7d11db2a686d1b","sha512":"738da1f4952b7d6b65e4338ec975f43a44d24d9e54604161c661b05cf42887575412cec56794808630a17343e508141c0675935cea3f797bb13223fab3709f8d","ssdeep":"96:9RVF4+29uufdqfj18EJdy+BNgGtK+EQ4kbuAGtlI1C:H4+29u2dK8L+BNgGtKlQ4kbuAGtld","tlshash":"5af10e210cf0946b40a798c5993b9a2e3fe1b427e7235d05b3ad9bc09f91ec5cd9b206","first_seen":"2026-10-08T00:12:31.038067Z","last_seen":"2026-10-08T00:12:31.038067Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1074,"timings":{"blocked":-1,"dns":467,"connect":148,"send":0,"wait":155,"receive":0,"ssl":304},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"athrvb.cn/static/2026.png","fqdn":"athrvb.cn","domain":"athrvb.cn","tld":"cn"},"ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://athrvb.cn/","date":"2026-10-08T00:11:51.044Z","timestamp":1791418311044,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sjbgw.athrvb.cn","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 05 Oct 2026 03:00:00 GMT","end":"Sun, 03 Jan 2027 02:59:59 GMT"},"fingerprint":{"sha1":"7D:97:CD:11:AB:7F:5A:38:1C:A4:68:17:51:AE:FE:94:54:CE:0C:BE","sha256":"F4:FA:52:DF:5C:9C:66:E6:98:11:DF:35:1B:5D:09:F9:7D:CE:E6:FD:61:07:E8:F0:92:5B:E1:4B:EA:09:5A:24"}}},"request":{"raw":"GET /static/2026.png HTTP/1.1\r\nHost: athrvb.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://athrvb.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:51 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 09 Sep 2025 10:50:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c00668-a3ff3\"\r\nset-cookie: server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax\r\nexpires: Sat, 07 Nov 2026 00:11:51 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"server_session_cbbe974f","value":"08eb22ccecd3aaf282ff7246e5ea03b9","quoted":false,"path":"/","max_age":864000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":671731,"size_decoded":672596,"mime_type":"image/png","magic":"PNG image data, 1335 x 312, 8-bit/color RGB, non-interlaced","md5":"873e2e3e8efed059d37d89b8b456a830","sha1":"8515b13a15136fcaa113d1a6278ce0ef4ff91995","sha256":"52ea1fc1c27058004b1d9214a0a6081ca256f9632f26a5df34b460a3855a47ae","sha512":"8149e009943322f6494cc3fd9e78e5ffbd93d813928015a0a936a20578250a1a3cc6d68d0b429b6b7d0e6d4e27ae6402022bc46d10f7fd061829cbc728c77508","ssdeep":"12288:eAAtYgbBXj94D9yMq8qTqPisZ+5x/ln6spdOar0GfU+nJRC4X3Zn9BKUrX:eVtdBXWLGTq3k5FRjPzUQ+4XJasX","tlshash":"ece42392e2cc7ea7e12760b548a05afc9171dd4dedf817331af1aa00977e45d4ca8e38","first_seen":"2025-09-13T02:55:28.472695Z","last_seen":"2026-10-08T00:12:31.040142Z","times_seen":19,"resource_available":false,"data":null}},"time_used":288,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":288,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"athrvb.cn/static/yx.png","fqdn":"athrvb.cn","domain":"athrvb.cn","tld":"cn"},"ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://athrvb.cn/","date":"2026-10-08T00:11:51.077Z","timestamp":1791418311077,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sjbgw.athrvb.cn","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 05 Oct 2026 03:00:00 GMT","end":"Sun, 03 Jan 2027 02:59:59 GMT"},"fingerprint":{"sha1":"7D:97:CD:11:AB:7F:5A:38:1C:A4:68:17:51:AE:FE:94:54:CE:0C:BE","sha256":"F4:FA:52:DF:5C:9C:66:E6:98:11:DF:35:1B:5D:09:F9:7D:CE:E6:FD:61:07:E8:F0:92:5B:E1:4B:EA:09:5A:24"}}},"request":{"raw":"GET /static/yx.png HTTP/1.1\r\nHost: athrvb.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://athrvb.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:51 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 09 Sep 2025 08:28:33 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68bfe531-b926\"\r\nset-cookie: server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax\r\nexpires: Sat, 07 Nov 2026 00:11:51 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"server_session_cbbe974f","value":"08eb22ccecd3aaf282ff7246e5ea03b9","quoted":false,"path":"/","max_age":864000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47398,"size_decoded":47528,"mime_type":"image/png","magic":"PNG image data, 749 x 114, 8-bit/color RGBA, non-interlaced","md5":"746bf7ba00f0dbfc45462c41886fe822","sha1":"7eb64c954a663bd514dc6108f32463025027529e","sha256":"4ba7bb77b87211ec63fc8c85f073c260e8a1dbfff3983231303895e25d7a446e","sha512":"207a3bbf5abfd857f37a3f70452fc2cd4e04f4c1b140e3da0e1a430d44ce145c605d150410bcdf7e710c4d99772a03a37a9896dbf9e5a1796665737bf1d1ebba","ssdeep":"768:0d/u5yzN2PckSCidrKNcgj24cMvZZcGeTRW+6RENlx4kSELF3G5/aJQMm0FCpl:N5YgP3SprKNoy7cGeY0y82VMX+","tlshash":"4c2301519509b0d854cf7bb37784e8046502dcf0d344a2ddd6ebf609aea2f97e8e8781","first_seen":"2025-08-22T18:12:38.66113Z","last_seen":"2026-10-08T00:12:31.041813Z","times_seen":29,"resource_available":false,"data":null}},"time_used":407,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":407,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/bootstrap/css/bootstrap.min.css","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:48.795Z","timestamp":1791418308795,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET /skin/bootstrap/css/bootstrap.min.css HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:48 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 08 Mar 2026 11:19:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ad5b40-38a52\"\r\nexpires: Thu, 08 Oct 2026 12:11:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":232018,"size_decoded":32163,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65342)","md5":"50c95aae1a6c1e089c11681d1e1906f8","sha1":"a65e4fd8db9bd0440de2d6d73c9e7cd00fce4a8d","sha256":"cd1826581e4f2b80af4f1e05897b316c7698441063cffaefbbdeec382ee4cd72","sha512":"7f0edff9370c8d36fb6e96cb25994ff20d98e17702c85656f2ecbc1ec459b07fd2c1b330d2994a1c51ebf7d0cdde5d3856c60dc2fce27145ffeaababbc8c5bc7","ssdeep":"1536:v9xnXGi9GfJkfvq5wlP7cQZDR9uvV982sYRElV6V6pz600I41r:HnXp9GfrV98II6V6pz600I41r","tlshash":"d03482d6f590317d9ca7c1499681fefd896fa985cb120aa6f003776807cabd30962dcc","first_seen":"2025-06-19T07:12:41.126365Z","last_seen":"2026-10-08T00:12:31.042542Z","times_seen":3064,"resource_available":true,"data":null}},"time_used":303,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":303,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"athrvb.cn/static/77.png","fqdn":"athrvb.cn","domain":"athrvb.cn","tld":"cn"},"ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://athrvb.cn/","date":"2026-10-08T00:11:51.048Z","timestamp":1791418311048,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sjbgw.athrvb.cn","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 05 Oct 2026 03:00:00 GMT","end":"Sun, 03 Jan 2027 02:59:59 GMT"},"fingerprint":{"sha1":"7D:97:CD:11:AB:7F:5A:38:1C:A4:68:17:51:AE:FE:94:54:CE:0C:BE","sha256":"F4:FA:52:DF:5C:9C:66:E6:98:11:DF:35:1B:5D:09:F9:7D:CE:E6:FD:61:07:E8:F0:92:5B:E1:4B:EA:09:5A:24"}}},"request":{"raw":"GET /static/77.png HTTP/1.1\r\nHost: athrvb.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://athrvb.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:51 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 09 Sep 2025 08:28:32 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68bfe530-de4e4\"\r\nset-cookie: server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax\r\nexpires: Sat, 07 Nov 2026 00:11:51 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"server_session_cbbe974f","value":"08eb22ccecd3aaf282ff7246e5ea03b9","quoted":false,"path":"/","max_age":864000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":910564,"size_decoded":911353,"mime_type":"image/png","magic":"PNG image data, 746 x 723, 8-bit/color RGBA, non-interlaced","md5":"5cf11096f92056f145ba109c75cd7db5","sha1":"9d7b9e219889fc40a35d6b3ab24b7cbbfbed4b7e","sha256":"2e2c60979ebe1845a6b7dbc38204f2cbe6005a22aaf5735fa07b3828652da58c","sha512":"a1e702d330e01567f93f7afbb7b7ebf2bc9dca5c329bc927f4008546814c00422baeeb475b0ef2c862b3394b42c9f2a47bcbbb862e188f9838cc7997ef2ab267","ssdeep":"24576:vUXQhb3UtzU82YhIqxQBEfkARWz//Zni2q0yl:7hw1vFhIpOfkAczRwl","tlshash":"0f1533406dcd96fa8f0a0b9580fbe936e312b2c944e4237469fadc9f79cdd09053563a","first_seen":"2024-06-15T11:37:50Z","last_seen":"2026-10-08T00:12:31.04314Z","times_seen":43,"resource_available":false,"data":null}},"time_used":433,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":433,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"athrvb.cn/static/ky.png","fqdn":"athrvb.cn","domain":"athrvb.cn","tld":"cn"},"ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://athrvb.cn/","date":"2026-10-08T00:11:51.055Z","timestamp":1791418311055,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sjbgw.athrvb.cn","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 05 Oct 2026 03:00:00 GMT","end":"Sun, 03 Jan 2027 02:59:59 GMT"},"fingerprint":{"sha1":"7D:97:CD:11:AB:7F:5A:38:1C:A4:68:17:51:AE:FE:94:54:CE:0C:BE","sha256":"F4:FA:52:DF:5C:9C:66:E6:98:11:DF:35:1B:5D:09:F9:7D:CE:E6:FD:61:07:E8:F0:92:5B:E1:4B:EA:09:5A:24"}}},"request":{"raw":"GET /static/ky.png HTTP/1.1\r\nHost: athrvb.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://athrvb.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:51 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 09 Sep 2025 10:17:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68bffecd-59bc\"\r\nset-cookie: server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax\r\nexpires: Sat, 07 Nov 2026 00:11:51 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"server_session_cbbe974f","value":"08eb22ccecd3aaf282ff7246e5ea03b9","quoted":false,"path":"/","max_age":864000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22972,"size_decoded":23595,"mime_type":"image/png","magic":"PNG image data, 268 x 200, 8-bit/color RGBA, non-interlaced","md5":"46715461fb6e6120ac46ccca46fd8873","sha1":"f0907130e65b656d9aef4fdac9674013ec2c1059","sha256":"1af1ec44ee119a11058d930e1b852740714194ee6e026e5aa4e9e2154f7b3a99","sha512":"1e71046d10ab98a81896925ff6b76a56a0742ef49cf15a09be4b0f8d39438e314a43b657a4cff0b958fe114c70b27ac482233352e4f9ee9348345dcf07c127ac","ssdeep":"384:iDX1M/8XGTARKZR3wh57mgjZiOGyJEpBSaIc4oX5tiQ77ggLR:iDXyxTggRo7mgZitdpBAgHXggF","tlshash":"17a2e10597fdd34a21aa5c49682cf3f6f32282de8e194cb83914b4ab5c3c2c85db875c","first_seen":"2024-08-14T21:09:33Z","last_seen":"2026-10-08T00:12:31.04377Z","times_seen":218,"resource_available":false,"data":null}},"time_used":427,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":427,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"athrvb.cn/alternat_links.json","fqdn":"athrvb.cn","domain":"athrvb.cn","tld":"cn"},"ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://athrvb.cn/","date":"2026-10-08T00:11:51.213Z","timestamp":1791418311213,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sjbgw.athrvb.cn","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 05 Oct 2026 03:00:00 GMT","end":"Sun, 03 Jan 2027 02:59:59 GMT"},"fingerprint":{"sha1":"7D:97:CD:11:AB:7F:5A:38:1C:A4:68:17:51:AE:FE:94:54:CE:0C:BE","sha256":"F4:FA:52:DF:5C:9C:66:E6:98:11:DF:35:1B:5D:09:F9:7D:CE:E6:FD:61:07:E8:F0:92:5B:E1:4B:EA:09:5A:24"}}},"request":{"raw":"GET /alternat_links.json HTTP/1.1\r\nHost: athrvb.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://athrvb.cn/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:51 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nset-cookie: server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"server_session_cbbe974f","value":"08eb22ccecd3aaf282ff7246e5ea03b9","quoted":false,"path":"/","max_age":864000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax"}],"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":405,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-10-08T04:41:06.622807Z","times_seen":566215,"resource_available":true,"data":null}},"time_used":417,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":417,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/fontawesome/css/all.min.css","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:48.845Z","timestamp":1791418308845,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET /skin/fontawesome/css/all.min.css HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:48 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 08 Mar 2026 11:19:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ad5b40-1907e\"\r\nexpires: Thu, 08 Oct 2026 12:11:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":102526,"size_decoded":23140,"mime_type":"text/css","magic":"ASCII text, with very long lines (52276)","md5":"c43cd173eeeba2f72aa6b431d06b8c07","sha1":"427a692f7f39eabb3d5b8510aee2743025daf813","sha256":"c880eb3d25c765d399840aa204fec22b3230310991089f14781f09a35ed80b8a","sha512":"02f6f6422b83104bc1e1b64961d7edda63635528417ed2dd3c6f0527457b8ab4cb43c528d2a70fc61e0f96aec6e6d1a6d2b53ed523e1568b6d78ba41111c1393","ssdeep":"1536:vwMCMPMCMjMCM4MCMwMCM3sVMX709gbPMfjSFOTyPG9ZpgmLCq:P709gMGFiyPG9ZimLCq","tlshash":"4fa3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2024-01-04T18:36:36Z","last_seen":"2026-10-08T03:16:50.552088Z","times_seen":15924,"resource_available":true,"data":null}},"time_used":402,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":402,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/bootstrap/js/home.js","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:48.857Z","timestamp":1791418308857,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET /skin/bootstrap/js/home.js HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:48 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 08 Mar 2026 11:19:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ad5b40-16aa\"\r\nexpires: Thu, 08 Oct 2026 12:11:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5802,"size_decoded":2098,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"16c93ef01acd14ec64c07020d638253e","sha1":"9c7b9d1a61977675c7f128bf2e27093d3cfe37f6","sha256":"f0795e9620ff382d585e15e40f303b394863fc5fa3dbdecd140adcbc4e51ffd2","sha512":"218d41ff60e128ff13105f9d376cfac1b80401527884da7b6179bab1fe8e9aa9e5959873bc5385798c8a5c6fb7aedce8e68b17112833cc16c096e0dc214d35ea","ssdeep":"96:6P7fgtAVMsSMCM1vUrp8KtQJQ1l/2o3RV0uRC6v6qyS+KQkIF:6P7fg+VSVAvUr2KaG1Zd3YuRriqyDKQH","tlshash":"91c1551a62b42433447775bb97af57c477212087b8c6ec393dfcc6080f845aa59f1aea","first_seen":"2025-10-09T23:37:04.756251Z","last_seen":"2026-10-08T00:12:31.046475Z","times_seen":1521,"resource_available":true,"data":null}},"time_used":537,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":537,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/e/dongpo/tz/tj.js","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:48.860Z","timestamp":1791418308860,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET /e/dongpo/tz/tj.js HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:48 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 271\r\nlast-modified: Sun, 31 May 2026 08:37:23 GMT\r\netag: \"6a1bf343-10f\"\r\nexpires: Thu, 08 Oct 2026 12:11:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":271,"size_decoded":622,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"9d994420ce13f29e5321380680553d76","sha1":"1ad3437f402f297b7f38c8d812a8518827abbea7","sha256":"ac5232b3e8056a45b7e7552b94e48d055147ece135410118c75089346a412dc0","sha512":"06e12ad796d5bfa26b38745fb9c3dcdaba9f5bace282d0499fe40a08c7957070964f84174a94a9c614584df058449e9f9211d90044f77f7699620644bde725fc","ssdeep":"","tlshash":"dbd02b4b2d695c381365046d517ee94cb1a3544ca03dd50084dce8105560fd10c2db85","first_seen":"2026-05-22T22:04:31.545602Z","last_seen":"2026-10-08T00:12:31.04708Z","times_seen":2,"resource_available":true,"data":null}},"time_used":536,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":534,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/cover/designerforhadcom/app-88.webp","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:48.884Z","timestamp":1791418308884,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET /skin/cover/designerforhadcom/app-88.webp HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 86070\r\nlast-modified: Sun, 31 May 2026 07:34:30 GMT\r\netag: \"6a1be486-15036\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":86070,"size_decoded":86343,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 583x388, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0e7c3a804aee7f404f85ed70345aa827","sha1":"2781f71ef46824323429e996d86ec280d03e087d","sha256":"4567687b6d57dd3556040b8a43aa3a164d1b0359aeb3c267090bfd052f9e6639","sha512":"0cd672751fe96052e51d0d5b284af6b13525f0842af2e2f423bb90534dbdef9a7f95161e77ff177f4a7cfc551031a4de395af962b494d6cd8a7497a2c9aac00d","ssdeep":"1536:amlfhFJ+OItcZCQrnq+hPPkXC/xOG+mbcnnN7nmZtW/hqTfisfQlWD:xfrJ+3cZrqET/xOhnN7mZqhUqsfQm","tlshash":"8883126c573dd08ff14000d837a5a3d0423cfd61657a9902aad1b0dedfbb24da647baa","first_seen":"2026-10-08T00:12:31.04824Z","last_seen":"2026-10-08T00:12:31.04824Z","times_seen":1,"resource_available":false,"data":null}},"time_used":954,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":510,"receive":444,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"athrvb.cn/static/1.css","fqdn":"athrvb.cn","domain":"athrvb.cn","tld":"cn"},"ip":{"addr":"168.76.247.26","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://athrvb.cn/","date":"2026-10-08T00:11:51.028Z","timestamp":1791418311028,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sjbgw.athrvb.cn","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 05 Oct 2026 03:00:00 GMT","end":"Sun, 03 Jan 2027 02:59:59 GMT"},"fingerprint":{"sha1":"7D:97:CD:11:AB:7F:5A:38:1C:A4:68:17:51:AE:FE:94:54:CE:0C:BE","sha256":"F4:FA:52:DF:5C:9C:66:E6:98:11:DF:35:1B:5D:09:F9:7D:CE:E6:FD:61:07:E8:F0:92:5B:E1:4B:EA:09:5A:24"}}},"request":{"raw":"GET /static/1.css HTTP/1.1\r\nHost: athrvb.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://athrvb.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:51 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 09 Sep 2025 08:28:32 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68bfe530-52b\"\r\nset-cookie: server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax\r\nexpires: Thu, 08 Oct 2026 12:11:51 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"server_session_cbbe974f","value":"08eb22ccecd3aaf282ff7246e5ea03b9","quoted":false,"path":"/","max_age":864000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"server_session_cbbe974f=08eb22ccecd3aaf282ff7246e5ea03b9; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1323,"size_decoded":1201,"mime_type":"text/css","magic":"assembler source, ASCII text","md5":"e8f7fd446508dce627d8b94c2dabf682","sha1":"e588018ff35d6b2a8a135f10c254adb5e5efe7a4","sha256":"4b33e96f93ac359218b05f73eebad38538edf0f6161ac1fbff569c0a5a019a10","sha512":"6fa415b8900c4751b1aebc122935a56de13fe0238dbd46cebd0663d390002c29062fc34766b03ddd2a5b8be019598acce7f5165007c49d0301d964c8318271cf","ssdeep":"","tlshash":"0e21bb5599632d48405f99242befe728e61440639b0eccb43f526a60cf8773a42823ce","first_seen":"2024-04-18T14:58:37Z","last_seen":"2026-10-08T00:12:31.049391Z","times_seen":144,"resource_available":true,"data":null}},"time_used":149,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":149,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/cover/designerforhadcom/about-88.webp","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:48.872Z","timestamp":1791418308872,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET /skin/cover/designerforhadcom/about-88.webp HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 97994\r\nlast-modified: Sun, 31 May 2026 07:34:26 GMT\r\netag: \"6a1be482-17eca\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":97994,"size_decoded":98267,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 814x541, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5e0058c64bd8d777d7d9d2dcf9f695eb","sha1":"2057dea92d5f0ea9608a63e0f1a643610ed37842","sha256":"72e33cd3f28b6fa025f66b583b945c86ba39af69f36e4c2d1ab847aa17262f76","sha512":"6c44a74dd8348eb1fba10a984f956000d2f9e47515939a49d5bbae1e10a98ee0d7cf5abdc243b3a4ab57c00a1c611deba072d9d69a059f516cd8ca47a7f2f4c6","ssdeep":"1536:vT+cVR4VZEBaxtwHh//jz+oNwye/wcja/a5x2pbvz4aCsZht+woT1xkXfVJ4Zo+5:vT+1YBaxtwHhDTwy5/K4z4xslZ21xkXs","tlshash":"93a31242497fb29893f07408c5d365736a50a387d20ebed66f8bb4710f26a6bfc31a15","first_seen":"2026-10-08T00:12:31.050559Z","last_seen":"2026-10-08T00:12:31.050559Z","times_seen":1,"resource_available":false,"data":null}},"time_used":825,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":522,"receive":303,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/cover/designerforhadcom/departments3-88.webp","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:48.878Z","timestamp":1791418308878,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET /skin/cover/designerforhadcom/departments3-88.webp HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 159840\r\nlast-modified: Sun, 31 May 2026 07:34:28 GMT\r\netag: \"6a1be484-27060\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":159840,"size_decoded":160114,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 818x545, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"012448768797e3ea123b91a8ce722de1","sha1":"dae2e52011ca774a2a7a556d9dfd26a38eb7286f","sha256":"52044b7692f7e682fba842647926550ec7c29ebd80b286196de635999a2737a8","sha512":"e589c7bd176113819652e4b0c9dca4a778fdb96a9120bbc7c3487c5c49ff082fa7f68474358156d4ca20ccc311ae7caa1fb0c6c6f47489b1abf1d007f8c65af1","ssdeep":"3072:MgR6dtBaxfUf6FVqZ0xNFFxe3sUhr4N8Heja3Z2UlVW5rr12bJA2SXYnxDWJoWwQ:MtdtcBXVqOnF3e3VrBwa3YUjgr12nxCl","tlshash":"88f3127be08b01a564f792a3d8e8b971979ea828d19c998711710c6cbd8f1a533f0c77","first_seen":"2026-10-08T00:12:31.05213Z","last_seen":"2026-10-08T00:12:31.05213Z","times_seen":1,"resource_available":false,"data":null}},"time_used":962,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":517,"receive":445,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"designerforhad.com/skin/cover/designerforhadcom/departments5-88.webp","fqdn":"designerforhad.com","domain":"designerforhad.com","tld":"com"},"ip":{"addr":"154.218.174.54","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://designerforhad.com/","date":"2026-10-08T00:11:48.882Z","timestamp":1791418308882,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxjly.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 10:01:09 GMT","end":"Fri, 27 Nov 2026 10:01:08 GMT"},"fingerprint":{"sha1":"0E:75:0F:CE:4A:90:87:4D:E9:D1:F6:01:C0:A2:CA:11:7E:61:3C:E9","sha256":"69:A6:1E:A9:44:87:06:B7:5A:A2:DF:DF:BD:36:7A:8C:E8:E6:9A:2D:C9:B8:D8:51:DD:BF:7E:9B:0F:74:91:80"}}},"request":{"raw":"GET /skin/cover/designerforhadcom/departments5-88.webp HTTP/1.1\r\nHost: designerforhad.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://designerforhad.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 08 Oct 2026 00:11:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 119016\r\nlast-modified: Sun, 31 May 2026 07:34:30 GMT\r\netag: \"6a1be486-1d0e8\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":119016,"size_decoded":119290,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 834x641, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f92baaa06b75f93e32f973a06c060613","sha1":"a45a593806f8beec019b95c70a5e38862ca54c06","sha256":"e19a866c41709c2c50316d342bfccc6dbe9f2e2fc653410223b3f24d142286b1","sha512":"5f4f940988482b4e6abce1ae955a984c068a2dcc9cc2607e23430deb342ff349e62c709e515894d0f8976aa43364e08a087afc1aef48ee788d432c80c537dd4b","ssdeep":"3072:o2ScwLFseSe+zNiVD2A2SLOTfeb58Ci71t0uE:NwLyr6VqAiTAqLtPE","tlshash":"7ec3021bf5c1508defa489ed9aa9a263f9404acc29affcc99530c60538463bcb5fc654","first_seen":"2026-10-08T00:12:31.053374Z","last_seen":"2026-10-08T00:12:31.053374Z","times_seen":1,"resource_available":false,"data":null}},"time_used":957,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":513,"receive":444,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"designerforhad.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}