GET otc.edgobase.com/assets/swiper.min.js
200 OK 139 kB URL GET otc.edgobase.com/assets/swiper.min.js
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type JavaScript source, ASCII text, with very long lines (65280)
Size 139 kB (139191 bytes)
Hash e5bb26def607ac0e0e114a502ac65e38
2cd244e7a00c598ed9ec4e0d04325f8511667816
770008a560398e6ab513700705e2431fce9e999b8e10c299ad9c4dafd0c9010b
GET /assets/swiper.min.js HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:50 GMT
Content-Type: application/javascript
Content-Length: 139191
Connection: keep-alive
x-amz-id-2: 6fgj4yPpbt2J4X1GbuAPDi7K1mPI7qtElgn6eb9NZ4ssI2tnJ2kylrbZMwmPSu4A0+cmtnUnKdI=
x-amz-request-id: JBSZJ674DWEG5B4Q
Last-Modified: Sun, 22 Jun 2025 06:37:11 GMT
x-amz-version-id: HjNxpWSHjo.NsaH23aTuPt4bLfqRErPS
ETag: "e5bb26def607ac0e0e114a502ac65e38"
Server: PWS/8.3.1.0.8
Via: 1.1 PS-HKG-04oR750:13 (W), 1.1 PSrdsdgemSTO1sw92:14 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 35249
x-ws-request-id: 6879ba0e_PSrdsdgemSTO1sw92_33319-16195
GET otc.edgobase.com/assets/layer.min.js
200 OK 3.7 kB URL GET otc.edgobase.com/assets/layer.min.js
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type JavaScript source, ASCII text, with very long lines (3612)
Hash 6bc4d3b89d5857e55fda783bee37723a
941a341b566e53ff9a791c5964d4d7d60a97614c
46cc85c9f1b1b28db1668bda3befad3b5d1fa1047a1b4b66813f85cc84d252b5
GET /assets/layer.min.js HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:50 GMT
Content-Type: application/javascript
Content-Length: 3721
Connection: keep-alive
x-amz-id-2: foAHTfw+12BYoryRwETQEw60DIcJvScEK/IZorgcta/HjsIkV88bNpgjY4QkMoq5CUmm4mozF68=
x-amz-request-id: V5VRTETHD9QQ3M9V
Last-Modified: Sun, 22 Jun 2025 06:37:07 GMT
x-amz-version-id: te2uqwIgLqxnfpMo_TsbKUx956BTLpKN
ETag: "6bc4d3b89d5857e55fda783bee37723a"
Server: PWS/8.3.1.0.8
Via: 1.1 x140:13 (W), 1.1 PSrdsdgemSTO1sw92:9 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 41286
x-ws-request-id: 6879ba0e_PSrdsdgemSTO1sw92_30385-29160
GET otc.edgobase.com/assets/ls.unveilhooks.min.js
200 OK 1.9 kB URL GET otc.edgobase.com/assets/ls.unveilhooks.min.js
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type JavaScript source, ASCII text, with very long lines (1845)
Hash f6a3dd4ecbf227acbafcff33d68dc71d
7421115ddcd5d436b89a1fd27e0cdce5a01978e6
30b2271be76ee2dd43122d0611f8aa498b9781f4cd03904ca12e12d2e91e9421
GET /assets/ls.unveilhooks.min.js HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:51 GMT
Content-Type: application/javascript
Content-Length: 1872
Connection: keep-alive
x-amz-id-2: y9QAZpa3z1lt4qinvAWx+Um2bfI5FJqY4GjRf5b5r3SFpgwMKYlMhXMqSVcjDhqom4stpmbRVM3tb5g2lDcJTA==
x-amz-request-id: 7BMWSS1FKCQR62AW
Last-Modified: Sun, 22 Jun 2025 06:37:09 GMT
x-amz-version-id: 6P8hLy9uACSMiMarhagw1IF0PxzPxXtg
ETag: "f6a3dd4ecbf227acbafcff33d68dc71d"
Server: PWS/8.3.1.0.8
Via: 1.1 PS-HKG-04oR750:10 (W), 1.1 PSrdsdgemSTO1sw92:6 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 41683
x-ws-request-id: 6879ba0f_PSrdsdgemSTO1sw92_28186-52321
GET vhimg1.ptallenvery.com/00483/assets/css/title57.css?v=2
200 OK 2.4 kB URL GET vhimg1.ptallenvery.com/00483/assets/css/title57.css?v=2
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type ASCII text, with very long lines (344)
Hash 37e31135ddfb2804010ca3fcd746e993
5a89ea12ecd9080b22a6c0f0c9f575dfe3964d62
b9e440368f7cc6766de5ec27f5a80fb4f934344533d5b78c7cde062945b954ed
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/css/title57.css?v=2 HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Jul 2025 03:05:50 GMT
content-type: text/css
server: cloudflare
last-modified: Sat, 17 May 2025 05:31:50 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
vary: accept-encoding
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=1yJUMsGpUeQeNDfBBy5H4UZNkyfbffYuyfUqXe9%2FYkxztIYTMVwtDu3hLEPARi3L8BxAJ1f2fO139pSN5dKwsl6tTOMjGcBKLk4nO5U%2FQtw70OT9"}]}
cache-control: max-age=14400
cf-cache-status: HIT
etag: W/"68281f46-979"
content-encoding: br
cf-ray: 960ec27b8f500b06-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET otc.edgobase.com/assets/mkj.js
200 OK 36 kB URL GET otc.edgobase.com/assets/mkj.js
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type Unicode text, UTF-8 text, with very long lines (586)
Hash ee6fefe20221bce817630726b493334e
4c954c6fe3a116ce2c32f5f6eeeb83a6fc4ffcb1
4ebfa38fb713294b96c9682c90868e205aff4a4ca5425f5abde2c2cebf3ccbb9
GET /assets/mkj.js HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:50 GMT
Content-Type: application/javascript
Content-Length: 35649
Connection: keep-alive
x-amz-id-2: i3k286554NGLR498DuClgYMFrWmpXyYwz2Bs6iyqbliCSJZd8aEkF5hjBg1AAv1bP6pOqjFTK48=
x-amz-request-id: GT24GKTYSPQ850EF
Last-Modified: Sun, 29 Jun 2025 12:43:52 GMT
x-amz-version-id: zTy0NvfWuETlQeY.AXn17TE2Xb0M.fTU
ETag: "e353d864a803b7365637cdb9f98aa669"
Server: PWS/8.3.1.0.8
Via: 1.1 PSxgHKG8ld122:4 (W), 1.1 PSrdsdgemSTO1sw92:9 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 40258
x-ws-request-id: 6879ba0e_PSrdsdgemSTO1sw92_30385-29162
GET vhimg1.ptallenvery.com/00483/assets/images/banner_2.png
200 OK 195 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/banner_2.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type PNG image data, 800 x 100, 8-bit/color RGBA, non-interlaced
Size 195 kB (194825 bytes)
Hash aecfab6da17c64bc055199eddd9421cb
ece00a5accf95f1ccdc3a9b372d253f7b5a1a065
17bdbfdf2672022df5c7b186d2c6fd6ba7cfc79d155c3c1629f6e7f93e0d7448
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/banner_2.png HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Jul 2025 03:05:50 GMT
content-type: image/png
content-length: 194825
server: cloudflare
last-modified: Thu, 20 Feb 2025 15:02:42 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
etag: "67b74412-2f909"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=2omzYITu1skZM0jqd8xRSri37%2FA4XY1Q9Ksp35fRQFspAFnC%2BlEIBOpij9p0GfVC47idHuPC%2FVYwrL9bjIh02GHlonRFb6Mg8WQunaWrIFt4LMCc"}]}
cf-ray: 960ec27bff900b06-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET otc.edgobase.com/assets/lazysizes-umd.min.js
200 OK 7.9 kB URL GET otc.edgobase.com/assets/lazysizes-umd.min.js
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type JavaScript source, ASCII text, with very long lines (7877)
Hash d243cfebf83b454cc4c89c2ead8507a1
e53166bda12480e688103e133bc6fcb2ae0931ba
3e90c6a68785626742aaa00feb6a8f5acaaf9477ded4e441ac56e4b364dd0747
GET /assets/lazysizes-umd.min.js HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:51 GMT
Content-Type: application/javascript
Content-Length: 7904
Connection: keep-alive
x-amz-id-2: Wd8fM50i+EstmqqrimRfirSAvWdNQxjArczq+yfaNPfV5tlTooOh9uIi4Zo2ZD9UA1sLxAxM0JmTbSUThkxDew==
x-amz-request-id: D9F3AAPE7CFE5F6A
Last-Modified: Sun, 22 Jun 2025 06:37:07 GMT
x-amz-version-id: bBKMZSgx827ew04cOxkX.fGEBvf3qa.a
ETag: "d243cfebf83b454cc4c89c2ead8507a1"
Server: PWS/8.3.1.0.8
Via: 1.1 dx141:5 (W), 1.1 PSrdsdgemSTO1sw92:7 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 41092
x-ws-request-id: 6879ba0f_PSrdsdgemSTO1sw92_28821-10763
GET cdn.edgobase.com/assets/img/ios6b533a9.png
200 OK 5.3 kB URL GET cdn.edgobase.com/assets/img/ios6b533a9.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Hash d4e5d263437df88530246e3691844812
49f1d29ce537dc0c3a1485fdcc483153d33c1cc5
3fe7c24791c3dcb0e27fb33b8970960b39e4fb40127f1d21ce642219b1c9dcc1
GET /assets/img/ios6b533a9.png HTTP/1.1
Host: cdn.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:52 GMT
Content-Type: image/png
Content-Length: 5342
Connection: keep-alive
Server: PWS/8.3.1.0.8
Last-Modified: Tue, 25 Jun 2024 14:30:12 GMT
ETag: "667ad474-14de"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Accept-Ranges: bytes
Via: 1.1 PSxgHKG8ld122:2 (W), 1.1 PSrdsdgemSTO1sw92:0 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 155391
x-ws-request-id: 6879ba10_PSrdsdgemSTO1sw92_24080-7119
GET vhimg1.ptallenvery.com/00483/assets/images/title-list56-title-bg-f.png
200 OK 17 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/title-list56-title-bg-f.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type PNG image data, 619 x 131, 8-bit colormap, non-interlaced
Hash 0fd987e4d0d38a260447ce774b29218f
17a48a071cdebcec68f19ce527f383d798f87459
dd2d1f9f322fba087979909472f5a14dae20424c9d2f883fce7c89f009cb1928
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/title-list56-title-bg-f.png HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://vhimg1.ptallenvery.com/00483/assets/css/common.css?7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:53 GMT
content-type: image/png
content-length: 17286
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CCIPfDkXjKj8fXi%2BXRFZRHtlZ6r6SEjK9%2BqnQkasiWpLOtju24ltI57wSur%2FryFte%2B%2BeGcV2rU9ataRRouNqWFmsb09QQ8cRPY%2BRHStSNv4ZQ6wbEPhmJ8dU0G7gcV5VhuVoUZW%2FkL%2Bc"}],"group":"cf-nel","max_age":604800}
last-modified: Mon, 24 Mar 2025 06:53:52 GMT
etag: "67e10180-4386"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec289099156b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=828&min_rtt=0&rtt_var=267&sent=1163&recv=660&lost=0&retrans=0&sent_bytes=1046953&recv_bytes=41482&delivery_rate=22651595&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=2018&inflight_dur=185&x=40"
GET vhimg1.ptallenvery.com/00483/assets/images/logo.png?6
200 OK 33 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/logo.png?6
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type PNG image data, 241 x 94, 8-bit/color RGBA, non-interlaced
Hash 95f179cd001fadfc44109536203dd49f
85081bf1c3d2365dd8cffe8d62e3ddabbdf9a6d1
e8013f9dc3da5fe84f2c27e9761abc0834f4815445d9c3725ee392c5af7984c0
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/logo.png?6 HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Jul 2025 03:05:50 GMT
content-type: image/png
content-length: 33408
server: cloudflare
last-modified: Sun, 23 Mar 2025 07:39:17 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
etag: "67dfbaa5-8280"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Dis6Adv%2FrXYiWQqclQOnadweAsESefT9vChwwPkk2id1JDXZNWeND37fk11jhOJ%2FshXQf%2BCTNAI0pHpFG4SByibuzSeX6vaRE05aLc9W8SluLJGK"}]}
cf-ray: 960ec27b8f510b06-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET vhimg1.ptallenvery.com/00483//assets/images/928144.jpg
200 OK 203 kB URL GET vhimg1.ptallenvery.com/00483//assets/images/928144.jpg
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=3, software=Adobe Photoshop 21.1 (Windows), datetime=2025:04:10 15:12:11], progressive, precision 8, 512x512, components 3
Size 203 kB (202733 bytes)
Hash a814bea3974ef0a263b45f068d5e74c9
b00843384d597a7f1d16137fb1b00f9aba30769a
96fde2ea7eb32db6aaf782e3d7098d69fbca21915af8cded2f9c2272241ce4b6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483//assets/images/928144.jpg HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:52 GMT
content-type: image/jpeg
content-length: 202733
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TV0nLksKDylnF98hpav3aCQMaysMITuWiivjX5%2BN1xzNWRa%2BVqqx1TS9bV5CMaQKccZK6IA%2BPF8plx0DasEE7G5G3Hqbj%2BgMyu%2Fjix5HZ5p5icjOfCO3Jzhb0ee9TPZjmm2x4f8hhk5f"}],"group":"cf-nel","max_age":604800}
last-modified: Mon, 14 Apr 2025 11:48:32 GMT
etag: "67fcf610-317ed"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec286a97a56b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=985&min_rtt=0&rtt_var=1173&sent=403&recv=547&lost=0&retrans=0&sent_bytes=37790&recv_bytes=33057&delivery_rate=1902639&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=1623&inflight_dur=65&x=40"
GET otc.edgobase.com/assets/AnimalsHelper.js
200 OK 11 kB URL GET otc.edgobase.com/assets/AnimalsHelper.js
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
Hash 4f30ad941553eeb0a56007817393397f
9467092486314fd9e0ecc77747df8e544966aa91
369df16e4499aa7c2a58766c70380071218c8223291ccba9946c6db59b59b230
GET /assets/AnimalsHelper.js HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:52 GMT
Content-Type: application/javascript
Content-Length: 11260
Connection: keep-alive
x-amz-id-2: Et16ajZmoy0ADUYMKvJ7YKDQ/8zAUQ0tBhAmoD7w46d0PQPwwtfNfHNYFblAiqdil25xwIE4Fp+zOfj5BrEOza+STl5km7FK
x-amz-request-id: YDYXFBXVC0Y6HZ0N
Last-Modified: Sun, 22 Jun 2025 06:37:03 GMT
x-amz-version-id: ERYDcWaY2OIjaWysl3UtX2EyZOFjMg1G
ETag: "4f30ad941553eeb0a56007817393397f"
Server: PWS/8.3.1.0.8
Via: 1.1 dx141:8 (W), 1.1 PSrdsdgemSTO1sw92:14 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 41094
x-ws-request-id: 6879ba10_PSrdsdgemSTO1sw92_33319-16285
GET otc.edgobase.com/assets/kjimg/f32/kj-bg.jpg
200 OK 46 kB URL GET otc.edgobase.com/assets/kjimg/f32/kj-bg.jpg
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type JPEG image data, baseline, precision 8, 810x403, components 3
Hash b62f4b2b2f16d60f3ecae1726cce2d95
f51d83b04c362afc7d5c63880173a9b615c6716a
38259f0ebdd1dc53d9839b599267d9d0fb86ff943b4c6c19598ece7d766330bc
GET /assets/kjimg/f32/kj-bg.jpg HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://otc.edgobase.com/assets/kj.css?v=1.0.04
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:52 GMT
Content-Type: image/jpeg
Content-Length: 46217
Connection: keep-alive
x-amz-id-2: QEA++BLO8qgaqqpcg9b35jvAW6zFaI2SsFfd6BrbEx5S04exfWZbf1ndJF+CkTisyKAMAUR63do=
x-amz-request-id: 7SDG0WFP22FB06MR
Last-Modified: Tue, 22 Apr 2025 08:16:35 GMT
x-amz-version-id: k8rF60NKwMGp0dk70LPk2Xq3H5c4fQkU
ETag: "b62f4b2b2f16d60f3ecae1726cce2d95"
Server: PWS/8.3.1.0.8
via: 1.1 x140:2 (W), 1.1 PSrdsdgemSTO1sw92:14 (W)
X-Px: ms PSrdsdgemSTO1sw92ARN, ms x140HKG(origin)
x-ws-request-id: 6879ba10_PSrdsdgemSTO1sw92_33319-16286
GET vhimg1.ptallenvery.com/00483/assets/images/txc.jpg
200 OK 237 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/txc.jpg
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 21.1 (Windows), datetime=2025:03:23 18:39:06], progressive, precision 8, 512x512, components 3
Size 237 kB (236735 bytes)
Hash 750f61e74cb63a0b05eb9c4584f58bfb
1dea1252a8f5ec3bdc74369143d6bdb1afdceb3f
a98d7d4f93f68977ad6bcbc15083b243ef9be3e1f1f634db1c2a5af4758359f4
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/txc.jpg HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:53 GMT
content-type: image/jpeg
content-length: 236735
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=euTAGko8CC%2FTnU1BNZEwde%2BdrHCo5KPIBMyeGtYAkYP1SVqDFiLfSuQURo0e2dU%2FIynkmH%2FX2yXflfSlDfHxuTSuvxLr1k9JWhIPJsTUsLOh14B0k%2Bs7M54UfQsXkS5Q02gbRt4z2Uex"}],"group":"cf-nel","max_age":604800}
last-modified: Sun, 23 Mar 2025 10:48:58 GMT
etag: "67dfe71a-39cbf"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec288f98b56b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=771&min_rtt=0&rtt_var=318&sent=1119&recv=656&lost=0&retrans=0&sent_bytes=990953&recv_bytes=41291&delivery_rate=22651595&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=2005&inflight_dur=172&x=40"
GET vhimg1.ptallenvery.com/00483/assets/images/85d0956084268b73c951387af42b27.png?1
200 OK 377 B URL GET vhimg1.ptallenvery.com/00483/assets/images/85d0956084268b73c951387af42b27.png?1
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type PNG image data, 100 x 76, 8-bit/color RGBA, non-interlaced
Hash 6f85d0956084268b73c951387af42b27
e5ded2ca42d33cc0f0efd7d94557d650775c9043
0dc323fc6357c476c8b432091437c0c9941907b18e8af6fbb66d904db4fd0bf3
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/85d0956084268b73c951387af42b27.png?1 HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Jul 2025 03:05:50 GMT
content-type: image/png
content-length: 377
server: cloudflare
last-modified: Thu, 20 Feb 2025 15:02:40 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
etag: "67b74410-179"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=BRRUWYjxln5fI4g71hmPHZGFydBNgvO2fbjgEdgRjO6TIrmvsT9YtvO%2FSuI5bPt6GxR2OHadwLfhZ56X8Yix%2BQRfayzbg3I8KwFYVgWNedmdWszW"}]}
cf-ray: 960ec27b8f540b06-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET otc.edgobase.com/assets/label-com4.js
200 OK 7.5 kB URL GET otc.edgobase.com/assets/label-com4.js
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type JavaScript source, Unicode text, UTF-8 text, with very long lines (2665)
Hash 267e645250e5d51cd3359797bb990bd4
ef7a61ce89a091c151638d32dccd35a923af6f2d
1a6200d1e7be5b6e092219cb703540fc09a9fde43ee677dbbeec39452067bef8
GET /assets/label-com4.js HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:51 GMT
Content-Type: application/javascript
Content-Length: 7546
Connection: keep-alive
x-amz-id-2: BwXXT24p0qgzy/5V/7avNm//O+9dAU6mVuPsfpn2nNGI7rhPWUrezJAFKJ/QucNkOhN+NJ0DMak=
x-amz-request-id: 8NZH503GBFQNRXMG
Last-Modified: Sun, 22 Jun 2025 06:37:07 GMT
x-amz-version-id: pkIAalZKlXvl8uR.Cl1aGvGNCojHcEdv
ETag: "267e645250e5d51cd3359797bb990bd4"
Server: PWS/8.3.1.0.8
Via: 1.1 PS-HKG-046K749:6 (W), 1.1 PSrdsdgemSTO1sw92:3 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 41415
x-ws-request-id: 6879ba0f_PSrdsdgemSTO1sw92_25942-10669
GET res-img1.ptallenvery.com/image/ycw_popup.gif?1
200 OK 119 kB URL GET res-img1.ptallenvery.com/image/ycw_popup.gif?1
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type GIF image data, version 89a, 450 x 550
Size 119 kB (119358 bytes)
Hash 4986eb32c2f0650ff96f351861b5e5b5
7face6715f43974eeb173fdb6687f5aa945caa5b
f0e936a88079c37fa76ef1bf99ba8914512581744b82fabf73498f72a1bb9dda
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /image/ycw_popup.gif?1 HTTP/1.1
Host: res-img1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:52 GMT
content-type: image/gif
content-length: 119358
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VcTIsBLXQd397hk17cjtxjrlK7TciuhgvUo5R1BqYPluM3TDWkEw%2Fi6z0N9msNVlgOw0uwGyDIMeVkomdw6QVGBz76B4Gedy3oiPUst8OQSJwlzVbIMsSbQFkvM4NUHBL5uBw8xGNUYXusU%3D"}],"group":"cf-nel","max_age":604800}
last-modified: Tue, 15 Jul 2025 07:10:53 GMT
etag: "6875fefd-1d23e"
cache-control: max-age=14400
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cf-cache-status: HIT
cf-ray: 960ec286d98056b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=548&min_rtt=0&rtt_var=80&sent=668&recv=585&lost=0&retrans=0&sent_bytes=392572&recv_bytes=34861&delivery_rate=23498251&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=1654&inflight_dur=94&x=40"
GET wss://ws.edgoapp.com/socket.io/?EIO=4&transport=websocket
101 Switching Protocols 0 B URL GET wss://ws.edgoapp.com/socket.io/?EIO=4&transport=websocket
IP
Requested by https://www.8595v.com/am/
Certificate IssuerAmazon
Subjectedgoapp.com
FingerprintBC:01:88:B2:F1:CA:6E:21:5E:27:00:98:50:BE:08:54:60:45:46:6D
ValiditySat, 14 Dec 2024 00:00:00 GMT - Tue, 13 Jan 2026 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /socket.io/?EIO=4&transport=websocket HTTP/1.1
Host: ws.edgoapp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://www.8595v.com
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: +wBHmMLOBNFd660qyl7N0A==
DNT: 1
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Accept: 0rJVRhlhMVI5PwBOGbWUXEfXKXE=
GET vhimg1.ptallenvery.com/00483/assets/css/style.css?12255
200 OK 44 kB URL GET vhimg1.ptallenvery.com/00483/assets/css/style.css?12255
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type ASCII text, with very long lines (344)
Hash 2860dc4787ffab00f70e33fc4f573651
0b5fab21600cb892944c3995d7bca4fa72301d9e
5170c387e005c69ae21ef2779b5876ec4034e8900c0203d897d94e9a0dec6848
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/css/style.css?12255 HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Jul 2025 03:05:50 GMT
content-type: text/css
server: cloudflare
last-modified: Sat, 17 May 2025 05:31:48 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
vary: accept-encoding
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ucf8BgrgdIl%2FBKpTx40ADZilXQwcw6Gb9vgjA7ckXEmSKXmb5wwNKwSzndYTyaocZbh%2FolWGLqlmD3I1gDTBzhQFGNTl1gBQVj%2BkQHALZ2dnUP7r"}]}
cache-control: max-age=14400
cf-cache-status: HIT
etag: W/"68281f44-ab0b"
content-encoding: br
cf-ray: 960ec27b7f480b06-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET vhimg1.ptallenvery.com/00483/assets/images/logo-(2).png
200 OK 5.3 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/logo-(2).png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type PNG image data, 121 x 63, 8-bit/color RGBA, non-interlaced
Hash d266dcfb3712242f97ad99f7555fe024
38e655a4d189eadb242990cbb65d0a702010ea11
4c6498388a9f784efe878bc8b4c6f926e26f26005d8ee7cc71d4f4f6ecc17968
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/logo-(2).png HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Jul 2025 03:05:50 GMT
content-type: image/png
content-length: 5270
server: cloudflare
last-modified: Thu, 20 Feb 2025 15:02:46 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
etag: "67b74416-1496"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2FaEvoRXs4s%2FGeFEvfyqqiXBT2AKMPtDRPkXriNz7me1shy78ynoBXkuW7CAEq0Wi0l2sqUbQKn%2B8McJN9%2FoTrx8PnJZWUp%2FhbV06XNVV5KzFHWAa"}]}
cf-ray: 960ec27b8f560b06-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET cdn.edgobase.com/image/ycw_logo73888.png
200 OK 45 kB URL GET cdn.edgobase.com/image/ycw_logo73888.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
Hash 63113a5cba0949e286f4473d8e776fc0
7a4e44c932f8812e04a239e524278c534c362d28
7bbf3fb59b3112b83e4a6d71432893c513fe9d142b834aabc55d8acce54dcd80
GET /image/ycw_logo73888.png HTTP/1.1
Host: cdn.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:52 GMT
Content-Type: image/png
Content-Length: 45294
Connection: keep-alive
Server: PWS/8.3.1.0.8
Last-Modified: Tue, 15 Jul 2025 07:10:53 GMT
ETag: "6875fefd-b0ee"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Accept-Ranges: bytes
Via: 1.1 PS-HKG-046K749:13 (W), 1.1 PSrdsdgemSTO1sw92:14 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 224961
x-ws-request-id: 6879ba10_PSrdsdgemSTO1sw92_33319-16319
GET vhimg1.ptallenvery.com/00483/assets/images/logo49%20lhw.png
200 OK 88 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/logo49%20lhw.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Hash 8ffdc28e79999892c030f724190c042d
31e0cd0e4a1892e9ef8e170951ffb912eacd3711
5c47def295207dac35605cdc6b49f2276017abf52a5af02cef8ae9454c748dcf
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/logo49%20lhw.png HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:53 GMT
content-type: image/png
content-length: 87796
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tcqzrK8UuPEH0yVKjUMXPHIU4sahmjrdb%2FTdK%2BGAhFH5lbXIp4iOA0WGrTLdJ68jOgrawKzSONPUKt9k%2FEqR0um%2B%2B1qUdee%2FiGaFM6eQNYU%2BFAVYFYf%2BScU8DT2hClAQcZMoiHquPNS%2B"}],"group":"cf-nel","max_age":604800}
last-modified: Thu, 10 Apr 2025 12:13:43 GMT
etag: "67f7b5f7-156f4"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec288f98d56b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=756&min_rtt=0&rtt_var=392&sent=1069&recv=652&lost=0&retrans=0&sent_bytes=920953&recv_bytes=41109&delivery_rate=22651595&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=1997&inflight_dur=165&x=40"
200 OK 29 kB IP
Certificate IssuerLet's Encrypt
Subjectwww.8595v.com
Fingerprint90:CE:0B:17:2A:06:CF:66:2C:4C:1C:B4:03:90:0D:C9:5F:2E:D5:00
ValidityWed, 21 May 2025 23:26:45 GMT - Tue, 19 Aug 2025 23:26:44 GMT
File type HTML document, Unicode text, UTF-8 text, with very long lines (505)
Hash d084a9baf2a1ca8d2cc2983f49e78663
d8625db20a6122dc1a9d267dbecae2e0406d85c5
9afe68ceebef569b5296804dffda80724b3e263f7c0fc738a0bbd7836fbfb1b4
GET /am/ HTTP/1.1
Host: www.8595v.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Jul 2025 03:05:50 GMT
content-type: text/html
content-length: 29044
last-modified: Fri, 04 Jul 2025 07:20:24 GMT
etag: "686780b8-7174"
cache-control: max-age=900
access-control-allow-origin: *
access-control-allow-methods: GET
server: cloudfront
x-cache-status: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
GET otc.edgobase.com/assets/qqface.js
200 OK 3.7 kB URL GET otc.edgobase.com/assets/qqface.js
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type JavaScript source, Unicode text, UTF-8 text
Hash 97b42fb48ef305944a73d79375534006
378dc4dbabc4c714918a326e75acbc1060d309fe
7d3ea645ab82c37a6788f353eb9afc118295ad07749ff61c0e41669b6fec7edb
GET /assets/qqface.js HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:50 GMT
Content-Type: application/javascript
Content-Length: 3699
Connection: keep-alive
x-amz-id-2: HhUIEnsaZihq/Gdgy51CMyHJcLpYMouRdU5L7Ky6VS1jld1ns4YgfX4jUlhEXTJ1u0p/aQL9DP8=
x-amz-request-id: R22VKYE009Z5V9PS
Last-Modified: Sun, 22 Jun 2025 06:37:09 GMT
x-amz-version-id: _Adfmm8wWvdEfVH6ab14fQklBwTmHcid
ETag: "97b42fb48ef305944a73d79375534006"
Server: PWS/8.3.1.0.8
Via: 1.1 x140:13 (W), 1.1 PSrdsdgemSTO1sw92:7 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 41463
x-ws-request-id: 6879ba0e_PSrdsdgemSTO1sw92_28821-10736
GET otc.edgobase.com/assets/kjimg/f32/kj-mu-icon.png
200 OK 2.4 kB URL GET otc.edgobase.com/assets/kjimg/f32/kj-mu-icon.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type PNG image data, 46 x 28, 8-bit/color RGBA, non-interlaced
Hash 1b90e67836a76c1438a5ebbdb239cd90
a50020c10606cbb41bb56ad20d3f82fb0cc1cfac
759efb0b09c95d8dd5ece437dd549d4027ccb57de50ce003ccbde9c73a4384c2
GET /assets/kjimg/f32/kj-mu-icon.png HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://otc.edgobase.com/assets/kj.css?v=1.0.04
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:52 GMT
Content-Type: image/png
Content-Length: 2381
Connection: keep-alive
x-amz-id-2: kVYyMmifzw/JOctahjGoSK53QeE2ppLWMStJTYXgrkApm67/N2/RfnUI+IaSH94GRtw2Gk1ZPHM=
x-amz-request-id: 7SDH0KFFWSN7KK7T
Last-Modified: Tue, 22 Apr 2025 08:16:35 GMT
x-amz-version-id: ecgIxAoHKsv0Y2qodqbYsy8TNMFoCUR8
ETag: "1b90e67836a76c1438a5ebbdb239cd90"
Server: PWS/8.3.1.0.8
via: 1.1 x140:1 (W), 1.1 PSrdsdgemSTO1sw92:3 (W)
X-Px: ms PSrdsdgemSTO1sw92ARN, ms x140HKG(origin)
x-ws-request-id: 6879ba10_PSrdsdgemSTO1sw92_25942-10713
GET vhimg1.ptallenvery.com/00483/assets/images/logo4549.png?1
200 OK 13 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/logo4549.png?1
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
Hash 5a7af562f7ee73ed3797bc01de5addda
b2184aec3a23ed860c2e22c733e2a067e09fb267
c48e767b4ca1491c0286930b42b2619faf54a9789b32dfdc97dfd12066d87dba
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/logo4549.png?1 HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:53 GMT
content-type: image/png
content-length: 12911
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6hGy408FmeWq3l9ZuwIhSESDfejZ5dAG3PP8JqZUoJXy%2Bwhq5rf0cG8WMVrpm85uCowfzYyMDoPEqW49l01jStl7RqenfpBP1UsvAckKmitsNOa3AT4m32GW2AQ2zghozV06G%2FLMr1J3"}],"group":"cf-nel","max_age":604800}
last-modified: Sun, 01 Jun 2025 06:17:50 GMT
etag: "683bf08e-326f"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec288f98e56b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=738&min_rtt=0&rtt_var=305&sent=1130&recv=657&lost=0&retrans=0&sent_bytes=1004953&recv_bytes=41337&delivery_rate=22651595&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=2007&inflight_dur=173&x=40"
GET vhimg1.ptallenvery.com/00483/assets/images/button.png
200 OK 8.6 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/button.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type PNG image data, 300 x 50, 8-bit/color RGBA, non-interlaced
Hash ea24d8db634f82981a0bc0ac97afb04a
1fe92e01e56dc0b7cdb3e64c47756761cc377de7
1311687342867b6306020e4a62df78a7af9dfe84806ca1948cc3066209439b5e
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/button.png HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:53 GMT
content-type: image/png
content-length: 8641
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FOOlOHvPMIH6yooLa%2FoBvIoFEkF8EULpdDVluRzDKnkUjseFAsV1oFpy8LXpy8Ofi71Md5lwhRFJCJFKvFBkkav9DJ6q5ih8FpU%2BFQNpE69TQlo3CfxiSa3A7TF%2FBoquYG9d9MLpkScp"}],"group":"cf-nel","max_age":604800}
last-modified: Thu, 20 Feb 2025 15:02:42 GMT
etag: "67b74412-21c1"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec289299456b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1775&min_rtt=0&rtt_var=1861&sent=1259&recv=671&lost=0&retrans=0&sent_bytes=1172953&recv_bytes=42029&delivery_rate=28314861&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=2051&inflight_dur=211&x=40"
GET www.8595v.com/favicon.ico
404 Not Found 153 B URL GET www.8595v.com/favicon.ico
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectwww.8595v.com
Fingerprint90:CE:0B:17:2A:06:CF:66:2C:4C:1C:B4:03:90:0D:C9:5F:2E:D5:00
ValidityWed, 21 May 2025 23:26:45 GMT - Tue, 19 Aug 2025 23:26:44 GMT
File type HTML document, ASCII text, with CRLF line terminators
Hash 00f8a62e85f99f73fa8caf355eaa4593
272da4cc254ce7dd9c97448051ead592d3589c33
8bf1b0813f4fb6b039752427dc2c097d0723304d4e1f92a77270a362fca4e8ee
GET /favicon.ico HTTP/1.1
Host: www.8595v.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/am/
Cookie: Hm_lvt_e02bb95747eae69c5526c497c80b4b9e=1752807952; Hm_lpvt_e02bb95747eae69c5526c497c80b4b9e=1752807952; HMACCOUNT=1E20B87D3C68B8C5
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
date: Fri, 18 Jul 2025 03:05:53 GMT
content-type: text/html
content-length: 153
access-control-allow-methods: GET
server: cloudfront
X-Firefox-Spdy: h2
GET vhimg1.ptallenvery.com/00483/assets/images/808dbdca4cb70d3f9d71be0c97c289.gif
200 OK 5.0 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/808dbdca4cb70d3f9d71be0c97c289.gif
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type GIF image data, version 89a, 128 x 115
Hash 8f808dbdca4cb70d3f9d71be0c97c289
2dd271bc814b24a6b36990314cdb8b3ac5e73f6a
ee5de22475b8162857fcf2177e76c2fe9c928216d0b7d3060d05ee1f911f0a3e
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/808dbdca4cb70d3f9d71be0c97c289.gif HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:52 GMT
content-type: image/gif
content-length: 5018
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T%2FBwg2SfDAs%2B5auliDBYkRp5SbzK%2F%2BsSucOAcIeFHHcFsT9itHpNph0X%2FxqQ3weJFwvrlE35SHsZKLnVSk33fhcDU%2F1W3vnO%2BbD7kaJUtATuGf6BInEHEveBV21sLnVpad%2FFNxpVQGp3"}],"group":"cf-nel","max_age":604800}
last-modified: Thu, 20 Feb 2025 15:02:40 GMT
etag: "67b74410-139a"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec286a97f56b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=552&min_rtt=0&rtt_var=95&sent=662&recv=584&lost=0&retrans=0&sent_bytes=384990&recv_bytes=34809&delivery_rate=23498251&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=1652&inflight_dur=94&x=40"
GET vhimg1.ptallenvery.com/00483/assets/images/hands.gif
200 OK 1.6 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/hands.gif
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type GIF image data, version 89a, 49 x 23
Hash a2d71b82d3cfc1fc2597be882b6a48bc
927ffb2e6502bf74d4e17dc43081c782bb558b5d
1cd58a68382a9c100ea6fe61cbd7e8e4fab4bbf41c8845a7485b8e071ab7d1f2
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/hands.gif HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:52 GMT
content-type: image/gif
content-length: 1630
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WwMZB4N9Gkdpr0yypUiLG52BcWoRAN9fcEznQkm%2Fdnn%2FqDaiMXcA5AkHHVly70gADWGBwkZh37WNMhE4mmkw9mbWWFK%2FsFOVidFifkuzggN4kiPVZuMMeMXrX01UfvreBfhYweFwfXF6"}],"group":"cf-nel","max_age":604800}
last-modified: Thu, 20 Feb 2025 15:02:45 GMT
etag: "67b74415-65e"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec286a97e56b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=752&min_rtt=0&rtt_var=335&sent=469&recv=555&lost=0&retrans=0&sent_bytes=127390&recv_bytes=33424&delivery_rate=271107668&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=1632&inflight_dur=75&x=40"
GET cdn.edgobase.com/assets/img/star.png
200 OK 5.1 kB URL GET cdn.edgobase.com/assets/img/star.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Hash bab994ba2951e1242bd4ffe79e1237d7
89acffa926fb5b89124739f003a63eb194fc45b8
02de150032a6bc397b93a5fc85cca8b7679a9a91be37df0758769f2ab507a668
GET /assets/img/star.png HTTP/1.1
Host: cdn.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:52 GMT
Content-Type: image/png
Content-Length: 5091
Connection: keep-alive
Server: PWS/8.3.1.0.8
Last-Modified: Tue, 25 Jun 2024 14:30:12 GMT
ETag: "667ad474-13e3"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Accept-Ranges: bytes
Via: 1.1 PSxgHKG8ir123:1 (W), 1.1 PSrdsdgemSTO1sw92:14 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 155391
x-ws-request-id: 6879ba10_PSrdsdgemSTO1sw92_33319-16302
GET www.8595v.com/amlinks.js
200 OK 112 B IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectwww.8595v.com
Fingerprint90:CE:0B:17:2A:06:CF:66:2C:4C:1C:B4:03:90:0D:C9:5F:2E:D5:00
ValidityWed, 21 May 2025 23:26:45 GMT - Tue, 19 Aug 2025 23:26:44 GMT
Hash c7a927d8e65133e29664f1ebc7ef1b5d
6c2f58ad65a449448cde238fefcac65325787821
2c15a542b9afd5cc223224212effbe6c205bb477e9c21576201ae37dae534bb4
GET /amlinks.js HTTP/1.1
Host: www.8595v.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/am/
Cookie: Hm_lvt_e02bb95747eae69c5526c497c80b4b9e=1752807952; Hm_lpvt_e02bb95747eae69c5526c497c80b4b9e=1752807952; HMACCOUNT=1E20B87D3C68B8C5
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Jul 2025 03:05:52 GMT
content-type: application/javascript
content-length: 112
last-modified: Sun, 22 Jun 2025 07:14:45 GMT
etag: "6857ad65-70"
cache-control: max-age=900
access-control-allow-origin: *
access-control-allow-methods: GET
server: cloudfront
x-cache-status: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
GET vhimg1.ptallenvery.com/00483/assets/images/frame.png
200 OK 4.9 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/frame.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type PNG image data, 108 x 108, 8-bit/color RGBA, non-interlaced
Hash 548ae5d34d1c2a62ec596f5522ab480d
894dbc5b07f65f9374fcea223dca36426cdd9f1f
0385e5c9222ab035d0b4ed7062201759520634a8477ef0bc60af6c2aa0a61de1
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/frame.png HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://vhimg1.ptallenvery.com/00483/assets/css/style.css?12255
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:52 GMT
content-type: image/png
content-length: 4881
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NEtVRoZGSt4nBp1Ds3ozV8X%2BjqlOp0LG6bERqdX%2BzHMbDlVdOobTny4UcA3W%2FPxg2yS%2BXpIXidaYD%2FR7wEvH%2FDdFsADRMLf8iSq76D3TiyA6%2BXWXi95VzlPbnUWQTNdx2JockuVobZGg"}],"group":"cf-nel","max_age":604800}
last-modified: Thu, 20 Feb 2025 15:02:45 GMT
etag: "67b74415-1311"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec286e98456b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1029&min_rtt=0&rtt_var=794&sent=886&recv=616&lost=0&retrans=0&sent_bytes=695790&recv_bytes=36677&delivery_rate=31620696&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=1691&inflight_dur=132&x=40"
GET vhimg1.ptallenvery.com/00483/assets/images/daohang.png
200 OK 37 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/daohang.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type PNG image data, 360 x 200, 8-bit/color RGB, non-interlaced
Hash 88004043ae6441d6dabcf9de7d7f9849
9ce35a4cf816e4e2b09d8b80b0e2c61a1df43acf
6ff9be1a282fa6f2d13b462c76a311a474f44ab9bfab8ac62939643ba509d637
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/daohang.png HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:53 GMT
content-type: image/png
content-length: 36569
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wPVrlqN2YhUdQDR7KZbrMQd1gRz2mW4U7KU2q3CSjYMCTHp2NEMFx8tBm0zDyVnpieEhGlqdTTwNM72aEcrrNQz86boojQx5RkdTkV3R1VlEPatdpRfU2tms7ZYUokObbRrbMvvblUIh"}],"group":"cf-nel","max_age":604800}
last-modified: Sat, 01 Mar 2025 07:56:15 GMT
etag: "67c2bd9f-8ed9"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec288e98a56b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=738&min_rtt=0&rtt_var=305&sent=1130&recv=657&lost=0&retrans=0&sent_bytes=1004953&recv_bytes=41337&delivery_rate=22651595&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=2007&inflight_dur=173&x=40"
GET otc.edgobase.com/assets/kjimg/f32/ball-blue.png
200 OK 11 kB URL GET otc.edgobase.com/assets/kjimg/f32/ball-blue.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type PNG image data, 59 x 59, 8-bit/color RGBA, non-interlaced
Hash 437c3f56755ae7b5c85c6de8de4a70ce
c676646af0f288d45b20b094d55104f93d4c47fd
bb532d7c8ec014a3c359986889e0247a181d8c97bf7424ec8a32fb82d92725d9
GET /assets/kjimg/f32/ball-blue.png HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://otc.edgobase.com/assets/kj.css?v=1.0.04
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:54 GMT
Content-Type: image/png
Content-Length: 10901
Connection: keep-alive
x-amz-id-2: /YeKiqhjHNISwjeS3g0jzbuWbbPsb/2SYhuk+SWG6iq5VRVHVXaCv3lExt4RGWWoxBROXpf6TI825dyJaOhoIQ==
x-amz-request-id: REXWMQRKR90RN6V0
Last-Modified: Tue, 22 Apr 2025 08:16:35 GMT
x-amz-version-id: FT0Mq1fQWI9RSv5W.xtf5tv_v0GNrlCt
ETag: "437c3f56755ae7b5c85c6de8de4a70ce"
Server: PWS/8.3.1.0.8
via: 1.1 dx141:12 (W), 1.1 PSrdsdgemSTO1sw92:3 (W)
X-Px: ms PSrdsdgemSTO1sw92ARN, ms dx141HKG(origin)
x-ws-request-id: 6879ba11_PSrdsdgemSTO1sw92_25942-10792
GET vhimg1.ptallenvery.com/00483/assets/images/lb.png
200 OK 2.4 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/lb.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type PNG image data, 54 x 45, 8-bit/color RGBA, non-interlaced
Hash 67f23547d04042a50e3507d3e5912eeb
2f840fbf0822aa11f6949a47de65d4572cc7f879
6cb3a89f6b95fc034e958405f1dc93d7eb2aadbd0fa06fe1657d1922720126f8
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/lb.png HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Jul 2025 03:05:50 GMT
content-type: image/png
content-length: 2351
server: cloudflare
last-modified: Thu, 20 Feb 2025 15:02:45 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
etag: "67b74415-92f"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Bhj1Pd2moS7f7jJ%2FOttmvlP%2F4BKvXOxVfDLLbe%2FTEsvKXPTY5Ot6DiYzaQQ9a5yh0%2FjZ9CzfPsB4lkMPQ8BEOx4GvMYNMdU78FjtsnZ6%2F6iLrdZX"}]}
cf-ray: 960ec27bff920b06-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET otc.edgobase.com/assets/comment_v2.js
200 OK 40 kB URL GET otc.edgobase.com/assets/comment_v2.js
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type HTML document, Unicode text, UTF-8 text, with very long lines (3085)
Hash edae5cd5e16a21beba6524c6b949b86b
38eed0cf1626b6d6a295d1501915604660603d5a
7ab7dc9babc34dd30d34f518476ecb3a5cc3ad0e0f18838a06783df2fe42ef7f
GET /assets/comment_v2.js HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:50 GMT
Content-Type: application/javascript
Content-Length: 39531
Connection: keep-alive
x-amz-id-2: TKLXrf0CUqQjM3KdDhsZ+s0u5A0FgGv41F67Pnelr8ybb1LdPtbZahsA+nPgtHD+5+2oHRzbm7w=
x-amz-request-id: 7S203K2E6X0XZTPM
Last-Modified: Thu, 10 Jul 2025 11:57:47 GMT
x-amz-version-id: cgzPr9tOX6BZCHqo6M1Tgh.GoyDY.iNo
ETag: "edae5cd5e16a21beba6524c6b949b86b"
Server: PWS/8.3.1.0.8
Via: 1.1 PS-HKG-04oR750:7 (W), 1.1 PSrdsdgemSTO1sw92:9 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 41286
x-ws-request-id: 6879ba0e_PSrdsdgemSTO1sw92_30385-29165
GET hm.baidu.com/hm.gif?hca=1E20B87D3C68B8C5&cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=235744288&si=e02bb95747eae69c5526c497c80b4b9e&v=1.3.2&lv=1&sn=8842&r=0&ww=1280&u=https%3A%2F%2Fwww.8595v.com%2Fam%2F&tt=%E6%BE%B3%E9%97%A8%E8%9B%87%E8%BF%90
200 OK 43 B URL GET hm.baidu.com/hm.gif?hca=1E20B87D3C68B8C5&cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=235744288&si=e02bb95747eae69c5526c497c80b4b9e&v=1.3.2&lv=1&sn=8842&r=0&ww=1280&u=https%3A%2F%2Fwww.8595v.com%2Fam%2F&tt=%E6%BE%B3%E9%97%A8%E8%9B%87%E8%BF%90
IP
ASN #9808 China Mobile Communications Group Co., Ltd.
Requested by https://www.8595v.com/am/
Certificate IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint21:BF:66:0D:67:BE:7A:7F:49:48:05:30:F4:7F:09:F2:30:36:CA:63
ValidityWed, 09 Jul 2025 07:01:02 GMT - Mon, 10 Aug 2026 07:01:01 GMT
File type GIF image data, version 89a, 1 x 1
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /hm.gif?hca=1E20B87D3C68B8C5&cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=235744288&si=e02bb95747eae69c5526c497c80b4b9e&v=1.3.2&lv=1&sn=8842&r=0&ww=1280&u=https%3A%2F%2Fwww.8595v.com%2Fam%2F&tt=%E6%BE%B3%E9%97%A8%E8%9B%87%E8%BF%90 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Fri, 18 Jul 2025 03:05:52 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=FBDD0075B35414E0; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
GET vhimg1.ptallenvery.com/00483/assets/images/theme-tab11-body.jpg
200 OK 368 B URL GET vhimg1.ptallenvery.com/00483/assets/images/theme-tab11-body.jpg
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type JPEG image data, baseline, precision 8, 8x56, components 3
Hash 2286d45e74fb37cd5de899cbe0500b77
e338e02062376c5179209d56f98fec339f32ee62
598f3a5411493d4d7ed401da61e1b54e3a428a37e3b456ffc164683e631752b7
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/theme-tab11-body.jpg HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://vhimg1.ptallenvery.com/00483/assets/css/style.css?12255
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:52 GMT
content-type: image/jpeg
content-length: 368
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=07p58mxhjxlY78u%2B0rqzJW3nankM%2Bn0Cn5Jg%2F3VD0trKU%2BFMcmpp6DIkxbulKDUFs3HtlB%2FXW2Z%2FK4pBl4XSeGcyz%2FtEcKrT%2FM%2BJQPHijBPzjoXqkLAeU8pAoZfHWv8DAL%2BCuxfYTBwa"}],"group":"cf-nel","max_age":604800}
last-modified: Thu, 20 Feb 2025 15:02:53 GMT
etag: "67b7441d-170"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec286d98356b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=575&min_rtt=0&rtt_var=87&sent=786&recv=602&lost=0&retrans=0&sent_bytes=555790&recv_bytes=35816&delivery_rate=29372888&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=1673&inflight_dur=114&x=40"
GET cdn.edgobase.com/image/ycw_touzhu.gif
200 OK 55 kB URL GET cdn.edgobase.com/image/ycw_touzhu.gif
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type GIF image data, version 89a, 200 x 300
Hash 7fe5da1699daafc8ae14f95f8dcda20a
f61552cac609eab3451261f19912c40620b77ee2
71c764a5e0afe4aac20048eb27b195b80156089ff39110fe19774f41f24b9bc9
GET /image/ycw_touzhu.gif HTTP/1.1
Host: cdn.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:52 GMT
Content-Type: image/gif
Content-Length: 55050
Connection: keep-alive
Server: PWS/8.3.1.0.8
Last-Modified: Tue, 15 Jul 2025 12:19:47 GMT
ETag: "68764763-d70a"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Accept-Ranges: bytes
Via: 1.1 PS-HKG-04oR750:5 (W), 1.1 PSrdsdgemSTO1sw92:11 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 224959
x-ws-request-id: 6879ba10_PSrdsdgemSTO1sw92_31589-53149
GET cdn.edgobase.com/image/ycw_img.gif
200 OK 83 kB URL GET cdn.edgobase.com/image/ycw_img.gif
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type GIF image data, version 89a, 800 x 250
Hash 746f06c9f1b4a686a09c09df6b9589b9
648963f72ed3ef1d1633ca1d00357bee7614f852
d860bd56d70e689e982c317ade03fc64c9ee98a9edc14ef253edd0a647fd7d74
GET /image/ycw_img.gif HTTP/1.1
Host: cdn.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:52 GMT
Content-Type: image/gif
Content-Length: 83376
Connection: keep-alive
Server: PWS/8.3.1.0.8
Last-Modified: Tue, 15 Jul 2025 07:10:53 GMT
ETag: "6875fefd-145b0"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Accept-Ranges: bytes
Via: 1.1 PS-HKG-04oR750:8 (W), 1.1 PSrdsdgemSTO1sw92:14 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 224959
x-ws-request-id: 6879ba10_PSrdsdgemSTO1sw92_33319-16303
GET vhimg1.ptallenvery.com/00483/assets/images/7799kj.jpg
200 OK 265 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/7799kj.jpg
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 21.1 (Windows), datetime=2025:03:23 18:42:42], progressive, precision 8, 512x512, components 3
Size 265 kB (265374 bytes)
Hash 953b795d4f7998a7226d1110dbf3b72e
1244f32e1a8ab0e2748b9ac09c0237ba83016056
2fad3579e96f4360109f3e6a70993aea196bee58e8ba575805d89e23d895e5c6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/7799kj.jpg HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:53 GMT
content-type: image/jpeg
content-length: 265374
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zJTu6BCug8UIVtliSUBvHwOJ97p1sL%2FHfPpkK9%2FABxDb4f%2FFi6XCZR3J35qZptah5lu2xkl7UJQs7YGvVjdMWquet5K7TLOXD8JF6CW5caC0Via3h23aQPHuKQ3fsy700oa2%2BvtTBcSv"}],"group":"cf-nel","max_age":604800}
last-modified: Sun, 23 Mar 2025 10:48:58 GMT
etag: "67dfe71a-40c9e"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec288f98c56b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1976&min_rtt=0&rtt_var=2040&sent=1342&recv=679&lost=0&retrans=0&sent_bytes=1284953&recv_bytes=42406&delivery_rate=28314861&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=2068&inflight_dur=234&x=40"
GET vhimg1.ptallenvery.com/00483/assets/images/menu_football_off.png
200 OK 2.3 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/menu_football_off.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Hash e7de35f82faac607477fa8b8a703cf65
962f15395ece1c718b8bec96def1a5f9abfa3c00
5c06cede6e9b83f1af93ae32f3b21c1763f8aa44e86f374e18432644696988b5
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/menu_football_off.png HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Jul 2025 03:05:50 GMT
content-type: image/png
content-length: 2257
server: cloudflare
last-modified: Thu, 20 Feb 2025 15:02:47 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
etag: "67b74417-8d1"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=6TrseKNIPi6ymwZDO90yuL8xMfspBrj2wM4MQHoeEWfpgXqnRN53F7ZVv2S3KBOZKpoAoUrLhldyieVNW%2FV%2B1aFxsSuA%2FBq9SAJWDpnW33k6NpWc"}]}
cf-ray: 960ec27b8f580b06-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET otc.edgobase.com/hk/popMore.js?_v=71813
200 OK 6.6 kB URL GET otc.edgobase.com/hk/popMore.js?_v=71813
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Hash 02e1c769b2c3939aa90846da9b9e2818
addb9ac3d892ed4c886a9386776583aa83301253
eb1a735c09db3482940799a4d7740b69327cffde92697634a0970365f018b3a2
GET /hk/popMore.js?_v=71813 HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:51 GMT
Content-Type: application/javascript
Content-Length: 6621
Connection: keep-alive
x-amz-id-2: Gu8sapPTcK/Uuqimna3evgrVTvpaCetzm74OtBXpAW+2yH+P4TlQLTcG1DgGaBEEzWTMNLgps2hV7DS9joiXrFRuImeJpQaQ
x-amz-request-id: H6RP8RT1YH2BH03P
Last-Modified: Thu, 17 Jul 2025 14:11:56 GMT
x-amz-version-id: ZDPLfX9LVcVklAyja9_afgpgx26vglbu
ETag: "02e1c769b2c3939aa90846da9b9e2818"
Server: PWS/8.3.1.0.8
Via: 1.1 x140:8 (W), 1.1 PSrdsdgemSTO1sw92:14 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 31707
x-ws-request-id: 6879ba0f_PSrdsdgemSTO1sw92_33319-16255
GET vhimg1.ptallenvery.com/00483/assets/images/bcf3cddbef5e58214cc65542bc708a.gif
200 OK 5.3 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/bcf3cddbef5e58214cc65542bc708a.gif
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type GIF image data, version 89a, 128 x 115
Hash 17bcf3cddbef5e58214cc65542bc708a
35fb3148370f4b4e26fc3b37a9f88449469c05a0
a9ce898473f3aeddff9693578725aa7ad24a1704d3b8f12568828dcae2f88ee0
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/bcf3cddbef5e58214cc65542bc708a.gif HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:52 GMT
content-type: image/gif
content-length: 5311
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BiKCkiO%2FFhEZFArkeavXOzkvo0Kvv7tGT4wD%2F0TIOKwuu2NT43HgZVYG%2FDf4%2BXaBgEYu%2BAkuPztzWJN%2FjzziZVEKeTF5yuZ8W7dkERHeIPfRwsMRPmj3wG%2BA3Ufv3LhLCa4Hj1ATHoi2"}],"group":"cf-nel","max_age":604800}
last-modified: Thu, 20 Feb 2025 15:02:42 GMT
etag: "67b74412-14bf"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec286a97c56b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=598&min_rtt=0&rtt_var=233&sent=600&recv=575&lost=0&retrans=0&sent_bytes=309390&recv_bytes=34357&delivery_rate=18798532&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=1646&inflight_dur=88&x=40"
GET cdn.edgobase.com/assets/img/web.png
200 OK 2.9 kB URL GET cdn.edgobase.com/assets/img/web.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Hash f24530cfde75d268978d442b83695623
f515cb809a7af42b0ac2632d24433f159920b17f
59563fd050c2c64916c411e9ffd48319f02ae4ca5e4024a649cc7e51d1062bc5
GET /assets/img/web.png HTTP/1.1
Host: cdn.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:52 GMT
Content-Type: image/png
Content-Length: 2931
Connection: keep-alive
Server: PWS/8.3.1.0.8
Last-Modified: Tue, 25 Jun 2024 14:30:12 GMT
ETag: "667ad474-b73"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Accept-Ranges: bytes
Via: 1.1 PSxgHKG8ld122:2 (W), 1.1 PSrdsdgemSTO1sw92:12 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 158148
x-ws-request-id: 6879ba10_PSrdsdgemSTO1sw92_32128-32472
GET vhimg1.ptallenvery.com/00483/assets/images/live-icon.png
200 OK 4.1 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/live-icon.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type PNG image data, 38 x 39, 8-bit/color RGBA, non-interlaced
Hash d30ca3d79893d3eeef93eccafe9ba263
76080949368619748dc73bef1845a19424179618
02ae27aa725a782819f2e93d0faedbfaf27d886fffec9d4245c44258237fe546
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/live-icon.png HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://vhimg1.ptallenvery.com/00483/assets/css/style.css?12255
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:52 GMT
content-type: image/png
content-length: 4088
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P5vdIr0Xs%2BiL62K4nF4Srf2zUXpufm5c4cJsU9cXEkPIIyVs0zVO72KbJeElFJ7V%2Bqpi3aPP%2BJq%2BrGCgwMiclUlDhfJc9ywOKOO9WbQTjejCpitxNrRhjIh96J%2BxNGgBDBLvZhCy2IL9"}],"group":"cf-nel","max_age":604800}
last-modified: Thu, 20 Feb 2025 15:02:46 GMT
etag: "67b74416-ff8"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec286e98656b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=575&min_rtt=0&rtt_var=87&sent=786&recv=602&lost=0&retrans=0&sent_bytes=555790&recv_bytes=35816&delivery_rate=29372888&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=1675&inflight_dur=114&x=40"
GET cdn.edgobase.com/image/ycw_redbag.gif
200 OK 50 kB URL GET cdn.edgobase.com/image/ycw_redbag.gif
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type GIF image data, version 89a, 200 x 200
Hash af643b925bd00fb640f2225e1c57fe42
718f276dd86dffee209f08b31bfc6e2ed1117d51
60bcad221732abdc2fe7ab4ec9dd6e94a9d4259826c7d34dfd991a6873a269c7
GET /image/ycw_redbag.gif HTTP/1.1
Host: cdn.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:52 GMT
Content-Type: image/gif
Content-Length: 49633
Connection: keep-alive
Server: PWS/8.3.1.0.8
Last-Modified: Tue, 15 Jul 2025 12:20:30 GMT
ETag: "6876478e-c1e1"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Accept-Ranges: bytes
Via: 1.1 PS-HKG-04JlJ51:8 (W), 1.1 PSrdsdgemSTO1sw92:15 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 224959
x-ws-request-id: 6879ba10_PSrdsdgemSTO1sw92_34200-21563
GET vhimg1.ptallenvery.com/00483/assets/images/b97edcddec3477199b1687c013d6a1.gif
200 OK 6.8 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/b97edcddec3477199b1687c013d6a1.gif
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type GIF image data, version 89a, 128 x 115
Hash ffb97edcddec3477199b1687c013d6a1
625462bbe2b1098127ef416404cd096299be8653
35843e1cdb6a7b51d2dfc7a07e1cb9fdbb67ae42085ef2377b93ce6a665e9939
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/b97edcddec3477199b1687c013d6a1.gif HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:52 GMT
content-type: image/gif
content-length: 6788
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1S3UYILQybzs8oYo7B2AoRQtinj4u7XqgZ%2BEJRrXwJDXYHugcKAd3RWePCUfmU5m0iRlz98Uf%2BUw23gk9WFV1I5lmEArV35KXwRVaoSlbqnspv28c7UGzqPzFAsmMdU0VavhKFOEKjXr"}],"group":"cf-nel","max_age":604800}
last-modified: Thu, 20 Feb 2025 15:02:41 GMT
etag: "67b74411-1a84"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec286a97d56b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=564&min_rtt=0&rtt_var=242&sent=612&recv=576&lost=0&retrans=0&sent_bytes=323390&recv_bytes=34405&delivery_rate=18798532&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=1647&inflight_dur=89&x=40"
GET vhimg1.ptallenvery.com/00483/assets/css/title55.css?v=2
200 OK 2.2 kB URL GET vhimg1.ptallenvery.com/00483/assets/css/title55.css?v=2
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
Hash 551c2fed9292af1b8f36e52b1d7c6f5a
f550bfb45ddf830ecfaaccd63bbdabbc12605f7f
8d1b2b0807c9f93ca41b3267e2bb7942cdc00f2fb81ba827122f3b5b92871edb
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/css/title55.css?v=2 HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Jul 2025 03:05:50 GMT
content-type: text/css
content-encoding: br
last-modified: Sat, 17 May 2025 05:31:49 GMT
etag: W/"68281f45-8b5"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
cache-control: max-age=14400
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kb3IDRYty%2BgmkLUdlBFmoYMUkwaHcfV5yx%2B6%2Bz1ktGVMbSZsyeYGVnvDMMji1SZ3J3zZ3WhvANUVj0NnOp0N8675SS7if7QWLM8jzS7Fhpc7UesBLVlwZ4NNUQVKjUThlPnGkqvfTKwT"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 960ec27b7f4d0b06-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=920&min_rtt=460&rtt_var=653&sent=22&recv=26&lost=0&retrans=0&sent_bytes=11825&recv_bytes=2409&delivery_rate=12250423&cwnd=254&unsent_bytes=0&cid=c90ada9b3e8305c1&ts=262&x=0"
X-Firefox-Spdy: h2
GET vhimg1.ptallenvery.com/00483/assets/images/da.gif?4
200 OK 164 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/da.gif?4
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type GIF image data, version 89a, 800 x 300
Size 164 kB (164350 bytes)
Hash 78b37a8b021444367ad33bdcf643c2a9
193d92ac4e9f9fe731f6cb946602cb51b82ff2ae
9126d6482c5c74cfd76e4321839a2638eb43dccab4e6ff3f35ec6acdded664d3
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/da.gif?4 HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Jul 2025 03:05:50 GMT
content-type: image/gif
content-length: 164350
server: cloudflare
last-modified: Tue, 25 Mar 2025 12:41:12 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
etag: "67e2a468-281fe"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=KGJHnjJV7Ztss6TwG%2B467Qs9BhlQFdAGLFwohb1p2dEzRLumoHk3IYZ8AyJiZ5%2F%2Ff%2FBxCeJlQ9Y8E3yIMFfp5cA5y%2BYrYgAubzhqAwfE9yOHN6gF"}]}
cf-ray: 960ec27b8f550b06-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET vhimg1.ptallenvery.com/00483/assets/images/menu_horse_on1.png
200 OK 6.9 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/menu_horse_on1.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type PNG image data, 196 x 102, 8-bit/color RGBA, non-interlaced
Hash cd6304495dd12d61432e62b1865fa274
88973106ed7ea52862fc16451ae2bf4a0c7df951
43240f5d09f563b5f5f69d7d893858b0ec9ccde5d4e815e2231fc11a6c4a9bf6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/menu_horse_on1.png HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Jul 2025 03:05:50 GMT
content-type: image/png
content-length: 6894
server: cloudflare
last-modified: Thu, 20 Feb 2025 15:02:48 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
etag: "67b74418-1aee"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=aQX8RUeHDXccS%2FTeEzu4gThVmIKhyQvsr7F5RQKJs18jZspF0XeCHryF3flTxwEdc8kIpQXaKMoAOYT6uhq%2Bm3bzmAzGvsV2Ea%2FLwdi2GBYO7yCx"}]}
cf-ray: 960ec27b8f590b06-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET otc.edgobase.com/assets/header.js?v=11
200 OK 15 kB URL GET otc.edgobase.com/assets/header.js?v=11
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type JavaScript source, Unicode text, UTF-8 text, with very long lines (3324)
Hash 65a20e568f728becd43b83ef4ac3eae9
d5dd7a0ee15c3c0dac1565478f3cf56d272245b6
eee7460fe8d321040dcbfcff776180a8948c4f9d26da350d5dce3ba3c32efbda
GET /assets/header.js?v=11 HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:50 GMT
Content-Type: application/javascript
Content-Length: 15211
Connection: keep-alive
x-amz-id-2: YWBfQRLrovQEZOIJ0V0rfnPI9iS+bfgyLMhEwYu/ENAHjJusDxuuR3Gg2SehCel+9GGBcrOgiuL6kpUyWRlIrtKyD8TqAyyq
x-amz-request-id: MK18S0K2PMDT8ZQY
Last-Modified: Tue, 15 Jul 2025 07:35:29 GMT
x-amz-version-id: RGTiADtyRYrx3IIODgHzRZ078WUiD6vA
ETag: "65a20e568f728becd43b83ef4ac3eae9"
Server: PWS/8.3.1.0.8
Via: 1.1 PS-HKG-04JlJ51:14 (W), 1.1 PSrdsdgemSTO1sw92:7 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 41286
x-ws-request-id: 6879ba0e_PSrdsdgemSTO1sw92_28821-10738
GET vhimg1.ptallenvery.com/00483/assets/js/carousel.js?3
200 OK 7.2 kB URL GET vhimg1.ptallenvery.com/00483/assets/js/carousel.js?3
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
Hash 28006f3c10b0da201d34ff8f1c6c8880
c164b64846627a72511840bf520c8255408f2245
e31bedb610f72ae092f2580509f23907a3b66c74c7b97c3cfd9915a5301174ee
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/js/carousel.js?3 HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Jul 2025 03:05:51 GMT
content-type: application/javascript
server: cloudflare
last-modified: Sun, 22 Jun 2025 06:22:12 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
vary: accept-encoding
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=pAtRU1UWbJi%2B2XluHiB0oFxyP7K%2F9QOoMujSDLpLIE6bySNR6LkfAv6yRVaFby3%2FSmIME6K7MLjtJRzABhKgSDeT2R6vBtk4R3l%2FN%2B26iUGyq%2BH4"}]}
cache-control: max-age=14400
cf-cache-status: HIT
etag: W/"6857a114-1c39"
content-encoding: br
cf-ray: 960ec27c0f960b06-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET otc.edgobase.com/need/layer.css?2.0
200 OK 5.6 kB URL GET otc.edgobase.com/need/layer.css?2.0
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type ASCII text, with very long lines (5588), with no line terminators
Hash a93156dad9bf82c5e873a6145c7c1ca3
6415859f551e151df98801922627d5447ae730d4
149a7dd383a03776f99fe242eb18f4699826d752892cdd6a3d3981d971855a21
GET /need/layer.css?2.0 HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:52 GMT
Content-Type: text/css
Content-Length: 5588
Connection: keep-alive
x-amz-id-2: 4vX1s/ewigX7hSvaW3gVuxgOxdm5phna38l9NABvp1wxra0ZEGWbetvPOnKakES1xYMzg/iHd5k=
x-amz-request-id: 2QTRBX6M54DQ26R0
Last-Modified: Fri, 28 Feb 2025 12:52:17 GMT
x-amz-version-id: null
ETag: "a93156dad9bf82c5e873a6145c7c1ca3"
Server: PWS/8.3.1.0.8
Via: 1.1 PS-HKG-046K749:2 (W), 1.1 PSrdsdgemSTO1sw92:14 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 40052
x-ws-request-id: 6879ba10_PSrdsdgemSTO1sw92_33319-16277
GET vhimg1.ptallenvery.com/00483/assets/images/theme-tab11-l.jpg
200 OK 1.4 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/theme-tab11-l.jpg
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type JPEG image data, baseline, precision 8, 38x56, components 3
Hash bf7c921774da63ffc676c2c85b7ab8ef
9c86f7f9c1de9d95cf3ced9dc1c4332180332734
ee4312acd5c2240fc69b9b97d7e6d2d5840f124d5fbb20671d6398b6bc11faed
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/theme-tab11-l.jpg HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://vhimg1.ptallenvery.com/00483/assets/css/style.css?12255
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:52 GMT
content-type: image/jpeg
content-length: 1431
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jlZLNUuhszAQJJ%2FnO4e%2F04fVIYf%2FrVv%2BX4rnAK9pI6KtIVDAis4xbfYRSbrlUSlOTpUY9P%2F%2B37Igsw2OzPZi5tHwqwPpGQ71Q%2FBHc%2FNP45vMjQk6cky%2BLIKaIM4Jp8gRGcnl8Otp0yOr"}],"group":"cf-nel","max_age":604800}
last-modified: Thu, 20 Feb 2025 15:02:53 GMT
etag: "67b7441d-597"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec286d98156b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=575&min_rtt=0&rtt_var=87&sent=786&recv=602&lost=0&retrans=0&sent_bytes=555790&recv_bytes=35816&delivery_rate=29372888&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=1673&inflight_dur=114&x=40"
GET vhimg1.ptallenvery.com/00483/assets/images/thantai.gif
200 OK 6.3 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/thantai.gif
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type GIF image data, version 89a, 90 x 90
Hash cdf54defb30359dcc7f885ca6f054116
b7a327914bfc52afd1b0b07b19d04c51b51651c9
a17e687730d9288717469dae9ad1b440d78768d6fcd9e11b191a6d848870c61e
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/thantai.gif HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:53 GMT
content-type: image/gif
content-length: 6335
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b6YOX61CDD8pIT00fiffTa7aqWnvinVcOCgly11%2FFs3tDT%2B%2Bk69NyemDgoEl4M9eImjsgFxEOiuMfi95KdHWgsr%2F4hiJ6lwd%2FEyrly%2B0h8CbH5xVPgG7EPGov4lqmkZNt64Ju5MUR15y"}],"group":"cf-nel","max_age":604800}
last-modified: Thu, 20 Feb 2025 15:02:52 GMT
etag: "67b7441c-18bf"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec289299356b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=787&min_rtt=0&rtt_var=216&sent=1217&recv=667&lost=0&retrans=0&sent_bytes=1116953&recv_bytes=41835&delivery_rate=28314861&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=2032&inflight_dur=194&x=40"
GET otc.edgobase.com/assets/kjimg/f32/ball-red.png
200 OK 11 kB URL GET otc.edgobase.com/assets/kjimg/f32/ball-red.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type PNG image data, 59 x 59, 8-bit/color RGBA, non-interlaced
Hash 0b0dd418bd9a70f68e8bd7eb662f69e5
1d1aa4bce707cf916c70b11f9b08b1538c471ab3
7f5c59babb4eecfe2cb10539f45b100dc9d8e3f386c376a57412f9a4c9c587c6
GET /assets/kjimg/f32/ball-red.png HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://otc.edgobase.com/assets/kj.css?v=1.0.04
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:54 GMT
Content-Type: image/png
Content-Length: 10890
Connection: keep-alive
x-amz-id-2: 6d2lBo73YGuF3ONOhkPWEqjwUkEOHwJg4///6a7PvF/qHC89PYouA8fiBU2Oy8rf+y/OOVoTBYNfphkGq3w6kqLvknWZVKQd
x-amz-request-id: REXV3RBK0N8SGDKT
Last-Modified: Tue, 22 Apr 2025 08:16:35 GMT
x-amz-version-id: NgoEBROqp13.xzxzulyUGbqvsyALHs6g
ETag: "0b0dd418bd9a70f68e8bd7eb662f69e5"
Server: PWS/8.3.1.0.8
via: 1.1 dx141:1 (W), 1.1 PSrdsdgemSTO1sw92:0 (W)
X-Px: ms PSrdsdgemSTO1sw92ARN, ms dx141HKG(origin)
x-ws-request-id: 6879ba11_PSrdsdgemSTO1sw92_24080-7221
GET otc.edgobase.com/assets/base_code.js?v=71830
200 OK 15 kB URL GET otc.edgobase.com/assets/base_code.js?v=71830
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type HTML document, Unicode text, UTF-8 text, with very long lines (312)
Hash 0e38ea9570a35984ff39ecd948a96449
1993f531b76ddf88d22f9de52a44abbbc3b2722c
b62e6b8eab78aae081e0f09a7b16851be13a6cbe2ac59ff2783332cc4e4a624a
GET /assets/base_code.js?v=71830 HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:51 GMT
Content-Type: application/javascript
Content-Length: 15103
Connection: keep-alive
x-amz-id-2: wsOVDSRD/P3CBtcN9ay2Wk9X3UKQCD+SM+n2QJFC5QSJD4+8Dg+FYvp70s/Tb4idzMXG//z4824=
x-amz-request-id: XBVT5JA0WBNFRBS9
Last-Modified: Wed, 16 Jul 2025 07:18:02 GMT
x-amz-version-id: g2pe.JFdQCBTEulf5B5S00zF0vgjB8Hr
ETag: "ca1ec83fe65ce63025dafba797bc03ad"
Server: PWS/8.3.1.0.8
via: 1.1 x140:2 (W), 1.1 PSrdsdgemSTO1sw92:14 (W)
X-Px: ms PSrdsdgemSTO1sw92ARN, ms x140HKG(origin)
x-ws-request-id: 6879ba0f_PSrdsdgemSTO1sw92_33319-16237
GET vhimg1.ptallenvery.com/00483//assets/images/172544.jpg
200 OK 282 kB URL GET vhimg1.ptallenvery.com/00483//assets/images/172544.jpg
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=3, software=Adobe Photoshop 21.1 (Windows), datetime=2025:04:10 13:40:30], progressive, precision 8, 512x512, components 3
Size 282 kB (281615 bytes)
Hash 0eccd9b2e0f4994c77844c43efaf28c8
563db5b5eead96a0286b347aaa4d120043752e2b
7659caad4d3d0a7a774ed8cac0416947c137b1352e12185b20ef5b2964b4b4fe
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483//assets/images/172544.jpg HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:52 GMT
content-type: image/jpeg
content-length: 281615
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0NGjyMOFoVOPkuEH9b06QMHITPIQFDXsyxOeCHNLJi4Ox29GyHgCW5owmeX0IM%2B7VEOGbXAkrhppU0OXO30IVZ3qysVaVlrQ%2FHirp9%2Bub5KbCTV%2BSGzwl0Nc0zbqo8N1PE4t40wrkXea"}],"group":"cf-nel","max_age":604800}
last-modified: Mon, 14 Apr 2025 11:48:30 GMT
etag: "67fcf60e-44c0f"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec286897956b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=701&min_rtt=0&rtt_var=808&sent=428&recv=551&lost=0&retrans=0&sent_bytes=71390&recv_bytes=33236&delivery_rate=271107668&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=1629&inflight_dur=71&x=40"
GET otc.edgobase.com/assets/kjimg/f32/kj-mu-bg.png
200 OK 1.4 kB URL GET otc.edgobase.com/assets/kjimg/f32/kj-mu-bg.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type PNG image data, 196 x 18, 8-bit/color RGBA, non-interlaced
Hash d23e2c9e5071710c27c7cf27d404b194
e0ccd6ed309e17a8a1a877c52f92a1528cd341e7
722694fa78c9e05e454e69d53cd1ca9f88fe67fe385ee8f8906ce6970a0f6785
GET /assets/kjimg/f32/kj-mu-bg.png HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://otc.edgobase.com/assets/kj.css?v=1.0.04
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:52 GMT
Content-Type: image/png
Content-Length: 1417
Connection: keep-alive
x-amz-id-2: bhz/FJugLwPdGsdBlf900hu8uDU3uGO1fDIBeTDeoeTe6DZ02tGJzlmdinlWY5Y0ZRuPak1/uQzWHRDAACAOaR58sffj/J6/
x-amz-request-id: 7SDZNFFE4ZBBMPBM
Last-Modified: Tue, 22 Apr 2025 08:16:35 GMT
x-amz-version-id: Oj09yoRZUazp9aITh3l20uuvTfOg9AOM
ETag: "d23e2c9e5071710c27c7cf27d404b194"
Server: PWS/8.3.1.0.8
via: 1.1 dx141:1 (W), 1.1 PSrdsdgemSTO1sw92:0 (W)
X-Px: ms PSrdsdgemSTO1sw92ARN, ms dx141HKG(origin)
x-ws-request-id: 6879ba10_PSrdsdgemSTO1sw92_24080-7107
GET otc.edgobase.com/assets/kj.css?v=1.0.04
200 OK 58 kB URL GET otc.edgobase.com/assets/kj.css?v=1.0.04
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type Unicode text, UTF-8 text, with very long lines (3193)
Hash 164101c24fe0222b51059710fb845178
f1e468966278b6235d39d52d7f3d7bb2d7e7cac8
3412070c3a4166a08ed7b074f6d0817b47e81c85c95d7f95e3ad8f8158356b31
GET /assets/kj.css?v=1.0.04 HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:51 GMT
Content-Type: text/css
Content-Length: 57513
Connection: keep-alive
x-amz-id-2: Y7/4x0nS4bxU89xscEpvpvSp4BnfpzOMH5upN+PPSHh4WhQNP617x5U0O/RQObEW0yOtRl8LytMjKDg36+wt8Tafp3uPNeqG
x-amz-request-id: XBVWX7HHGATEN7ZC
Last-Modified: Sun, 22 Jun 2025 11:32:47 GMT
x-amz-version-id: ZqBzrXNeFosnxTyIfRHVXpqkrcqcF11a
ETag: "6767d8e774bf1fd9653e9565fcf36b1f"
Server: PWS/8.3.1.0.8
via: 1.1 PSrdsdgemSTO1sw92:0 (W)
X-Px: ms PSrdsdgemSTO1sw92ARN(origin)
x-ws-request-id: 6879ba0e_PSrdsdgemSTO1sw92_24080-7016
GET otc.edgobase.com/sock/4.7.5/socket.io.min.js
200 OK 50 kB URL GET otc.edgobase.com/sock/4.7.5/socket.io.min.js
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type JavaScript source, ASCII text, with very long lines (49854)
Hash 5f46dd97f716f56f0e649433fe456519
5096d2e8540dbe8ab29b98dda70b6c3c52f49697
d32640d8e45c0b3fd1643a47276e0b3c769432f1b7ef7178c7b47346651730e7
GET /sock/4.7.5/socket.io.min.js HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:51 GMT
Content-Type: application/javascript
Content-Length: 49952
Connection: keep-alive
x-amz-id-2: AOkATlJ6Aur3p4NkKN/oHM8cSTGUU3HE9vTp4H1c2Q35GJ2fa7cDMEoda+lBIplwSIgs8bXyiHU=
x-amz-request-id: YCV73YETGB13F5F7
Last-Modified: Fri, 28 Feb 2025 12:52:29 GMT
x-amz-version-id: null
ETag: "5f46dd97f716f56f0e649433fe456519"
Server: PWS/8.3.1.0.8
Via: 1.1 dianxun143:11 (W), 1.1 PSrdsdgemSTO1sw92:9 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 41453
x-ws-request-id: 6879ba0f_PSrdsdgemSTO1sw92_30385-29194
GET otc2.bjhav.cn/assets/no.js?v71830
200 OK 83 B URL GET otc2.bjhav.cn/assets/no.js?v71830
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectbjhav.cn
FingerprintD6:72:38:42:CF:50:AA:BC:16:B2:C4:6D:AA:50:2E:5E:74:85:2B:5A
ValidityFri, 13 Jun 2025 10:36:57 GMT - Thu, 11 Sep 2025 11:35:28 GMT
Hash bd3a50e55756a21b13f4fab56d17af5a
97374dfd743e5f6625016387969aa0af3aebe30e
05db9f21d9042331a40dc754305d652692b4bd633fdfd75598bc4759b0bc65cc
GET /assets/no.js?v71830 HTTP/1.1
Host: otc2.bjhav.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Jul 2025 03:05:52 GMT
content-type: application/javascript
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
vary: Accept-Encoding
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
cache-control: no-cache
content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=VI9GBpKrOygYL4BrAFihU4ADXT468LD%2Bdv1CVt3WZ5Z9WA7Z5TCqmpWlbrqkBAJ60YcSbpcN3nKvPNTM5kfWf1jJP2smR779GJtR"}]}
cf-ray: 960ec2825be2b505-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET vhimg1.ptallenvery.com/00483/assets/images/top_title.png
200 OK 20 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/top_title.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type PNG image data, 339 x 105, 8-bit/color RGBA, non-interlaced
Hash 5aef18a646c9f6ae3fde28bf8651f2fe
a3b1590fa75ff8fec26eac925222a28120890eeb
601cacdda70ed44196f82d33171e726e38c816efda297930149955f7d9c515a6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/top_title.png HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:52 GMT
content-type: image/png
content-length: 20359
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kXf5G5dxTcmIog6dn3woRkUBmOVKUfumXbYFyBK9km63gztWk1JCaRmu%2BA0IwFMPI3cf6Kl%2Fe9Je5Nb%2FPmO6jm%2FU7Cjm%2B2KiAcGMQH%2FXtLDWL1dcs4kU0k9Ixggv95YqD5gSL%2Fa7FNyk"}],"group":"cf-nel","max_age":604800}
last-modified: Thu, 20 Feb 2025 15:02:59 GMT
etag: "67b74423-4f87"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec286897856b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1461&min_rtt=459&rtt_var=1095&sent=394&recv=544&lost=0&retrans=0&sent_bytes=25759&recv_bytes=32925&delivery_rate=452066&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=1613&inflight_dur=61&x=40"
GET wss://ws.edgoapp.com/socket.io/?EIO=4&transport=websocket
101 Switching Protocols 0 B URL GET wss://ws.edgoapp.com/socket.io/?EIO=4&transport=websocket
IP
Requested by https://www.8595v.com/am/
Certificate IssuerAmazon
Subjectedgoapp.com
FingerprintBC:01:88:B2:F1:CA:6E:21:5E:27:00:98:50:BE:08:54:60:45:46:6D
ValiditySat, 14 Dec 2024 00:00:00 GMT - Tue, 13 Jan 2026 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /socket.io/?EIO=4&transport=websocket HTTP/1.1
Host: ws.edgoapp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://www.8595v.com
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: sBO0t9m4zRIYzUYn6mUp0w==
DNT: 1
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Accept: IQRUd2Wx0VLR9qHqN+JYVuuXeeM=
GET www.8595v.com/am/script.js
200 OK 3.0 kB URL GET www.8595v.com/am/script.js
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectwww.8595v.com
Fingerprint90:CE:0B:17:2A:06:CF:66:2C:4C:1C:B4:03:90:0D:C9:5F:2E:D5:00
ValidityWed, 21 May 2025 23:26:45 GMT - Tue, 19 Aug 2025 23:26:44 GMT
Hash f8eecd019c338ba178c32c8610741099
ae9efca5d7b3c0152c500cf9a0f81f68ee6812c4
fccb7e772df8ad51861bbdbca14cd444dd40fe832f0a4d50dc8e7d1514b14e19
GET /am/script.js HTTP/1.1
Host: www.8595v.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/am/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Jul 2025 03:05:50 GMT
content-type: application/javascript
content-length: 3024
last-modified: Sat, 17 May 2025 05:25:46 GMT
etag: "68281dda-bd0"
cache-control: max-age=900
access-control-allow-origin: *
access-control-allow-methods: GET
server: cloudfront
x-cache-status: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
GET otc.edgobase.com/keepScroll.js
200 OK 1.5 kB URL GET otc.edgobase.com/keepScroll.js
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
Hash c3907e80b6b6cb2fc8d69712d4ec3a5f
abf31c932cef8c9a5c5af1dcbb892922009fb838
d1496064cc859ac68e77ca36978b673286b0eeccec53dba31e6dc5610eb6f4b8
GET /keepScroll.js HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:51 GMT
Content-Type: application/javascript
Content-Length: 1452
Connection: keep-alive
x-amz-id-2: +oxap3lfpFPwIgfZQMMgzB0pfzE37uPivPzcxb9SrddCo9FvF8Ai3a4T0Ea+XXZ+P8QC+8IGTuCey/QIVHxoure+u4xRZ939
x-amz-request-id: TRQ18J4MZEWQJWRT
x-amz-meta-mtime: 1747896140
Last-Modified: Thu, 22 May 2025 06:56:21 GMT
x-amz-version-id: dcUP4F68Bkns8Ydb8aB1Ec8qdnB14ywW
ETag: "c3907e80b6b6cb2fc8d69712d4ec3a5f"
Server: PWS/8.3.1.0.8
Via: 1.1 PS-HKG-04JlJ51:8 (W), 1.1 PSrdsdgemSTO1sw92:3 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 41453
x-ws-request-id: 6879ba0f_PSrdsdgemSTO1sw92_25942-10671
GET otc.edgobase.com/assets/swiper.min.css
200 OK 14 kB URL GET otc.edgobase.com/assets/swiper.min.css
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type ASCII text, with very long lines (13402), with CRLF line terminators
Hash 92439503b5d06de2c657fd5242037cec
7a4bfebb7061e7d68cdb47fd8e087c8d28b3f650
c89e9d4e466b26ecbfe9cc55ffc1cdf68d13ff68b0d3c932f92a3b7b3e8df987
GET /assets/swiper.min.css HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:51 GMT
Content-Type: text/css
Content-Length: 13670
Connection: keep-alive
x-amz-id-2: x6wEjpYmpX3MZCMdLkV6k/UOEzLjYovgOnAlyYxnPwgv4uHojCfqtS6wguGR5gs1QqvlM78IZOk=
x-amz-request-id: XBVKHYYG0VAR8BJD
Last-Modified: Sun, 22 Jun 2025 06:21:54 GMT
x-amz-version-id: sfegIsuGSkERynQjWh8uL7iKTOH8J.9s
ETag: "92439503b5d06de2c657fd5242037cec"
Server: PWS/8.3.1.0.8
via: 1.1 PSrdsdgemSTO1sw92:3 (W)
X-Px: ms PSrdsdgemSTO1sw92ARN(origin)
x-ws-request-id: 6879ba0e_PSrdsdgemSTO1sw92_25942-10630
GET vhimg1.ptallenvery.com/00483/assets/css/common.css?7
200 OK 47 kB URL GET vhimg1.ptallenvery.com/00483/assets/css/common.css?7
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type Unicode text, UTF-8 text, with very long lines (330)
Hash 8e22bf0c457c76727460cdaa417ab0eb
85271fe3f1e8f107ad904565e56ce35a2b46337f
39ca90744a38d29987c3ca629e28b05578d70c4ec5dbfb71f76b4af2860cc908
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/css/common.css?7 HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Jul 2025 03:05:50 GMT
content-type: text/css
server: cloudflare
last-modified: Sat, 17 May 2025 07:06:59 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
vary: accept-encoding
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Yk8BMkulS4bNMvlWM22wDkWkqxnu0KXHaDtsYRDNFh4hdtmrpkGhX%2BSyRq4vL2UvcqUSxpbN8Qiu8X8JN%2FC5UWi6iv1bixaBaPaJTq06sGXxGeWK"}]}
cache-control: max-age=14400
cf-cache-status: HIT
etag: W/"68283593-b6e3"
content-encoding: br
cf-ray: 960ec27b6f460b06-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET otc.edgobase.com/assets/common.css?1222
200 OK 9.7 kB URL GET otc.edgobase.com/assets/common.css?1222
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type ASCII text, with very long lines (326)
Hash 64b6142378aa53da9e3a84e413f9a771
7be37e2248445c87b841abcc68880a258a40bd41
05942c82cb3309640e31b10e6b5d478569049b517bb1074254a7524316919e12
GET /assets/common.css?1222 HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:51 GMT
Content-Type: text/css
Content-Length: 9679
Connection: keep-alive
x-amz-id-2: KkRJNxGXWcwLnbIENWY1XcW4nj5gDZs6auMznsvPp2pL7qKBiItP1Ni4YhAL5aqTTx5wdBhaYpka1mb3kY8r8d+AEAlSbApv
x-amz-request-id: XBVWH84XTBJM3PTZ
Last-Modified: Thu, 26 Jun 2025 14:08:20 GMT
x-amz-version-id: 3bTKLtzATUZ9CixDVCJVsn2XdM53IjFU
ETag: "64b6142378aa53da9e3a84e413f9a771"
Server: PWS/8.3.1.0.8
via: 1.1 PSrdsdgemSTO1sw92:6 (W)
X-Px: ms PSrdsdgemSTO1sw92ARN(origin)
x-ws-request-id: 6879ba0e_PSrdsdgemSTO1sw92_28186-52277
GET vhimg1.ptallenvery.com/00483/assets/images/menu_mark6_off.png
200 OK 2.2 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/menu_mark6_off.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Hash 1ea5adefb4e60cb72d8b35e6a7462b18
cdfa20e424608807883af6aae00c158b6cae136d
c6375d753fc1b08458fb15a79815410457e8bc95de64c51414061fa9b0f6e5af
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/menu_mark6_off.png HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Jul 2025 03:05:50 GMT
content-type: image/png
content-length: 2232
server: cloudflare
last-modified: Thu, 20 Feb 2025 15:02:48 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
etag: "67b74418-8b8"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=vkGjLGzo13DNE%2F6EVLNExQmUqTdym4AGfKZfSIZCZiAdlYIuhrxeo4BsPwLipmTz7HASJM9kzuiVcAasflHCBEHWvasLH5zaObxruq5Ab97%2Bsm3z"}]}
cf-ray: 960ec27b8f5a0b06-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET hm.baidu.com/hm.js?e02bb95747eae69c5526c497c80b4b9e
200 OK 30 kB URL GET hm.baidu.com/hm.js?e02bb95747eae69c5526c497c80b4b9e
IP
ASN #9808 China Mobile Communications Group Co., Ltd.
Requested by https://www.8595v.com/am/
Certificate IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint21:BF:66:0D:67:BE:7A:7F:49:48:05:30:F4:7F:09:F2:30:36:CA:63
ValidityWed, 09 Jul 2025 07:01:02 GMT - Mon, 10 Aug 2026 07:01:01 GMT
File type JavaScript source, ASCII text, with very long lines (624)
Hash b6d286c38346f051218409ee9079a1aa
fc299ed21345335e100596efcc84024d2c56ca37
1c6b295ae4b5fc29e7c2055ea82af810d22e8134cbe6154c36b418c6bb895d83
GET /hm.js?e02bb95747eae69c5526c497c80b4b9e HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11294
Content-Type: application/javascript
Date: Fri, 18 Jul 2025 03:05:51 GMT
Etag: f0857382f49774eaf75596ac1fcb09b0
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=1E20B87D3C68B8C5; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
GET vhimg1.ptallenvery.com/00483/assets/js/qbcsnake.js
200 OK 1.8 kB URL GET vhimg1.ptallenvery.com/00483/assets/js/qbcsnake.js
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type HTML document, Unicode text, UTF-8 text
Hash ad4ba6e11d197b44ae7bab42fbe5396a
32ded61606aec28d7a6a682d14c2e315b32b293d
ddce3a0538f59b8cc4a302cf92e4a4af8a4bd22d6925c8a83d421741a620b71b
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/js/qbcsnake.js HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Jul 2025 03:05:50 GMT
content-type: application/javascript
server: cloudflare
last-modified: Sun, 22 Jun 2025 06:22:13 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
vary: accept-encoding
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=YIHTZWARz6uBhfq2EvWEV8SW9MIe4j5mZet1usCZrCrVtmU0gmFesVSJ8S4N4QnLAUYnlwyX9atsr4AO7ZahTVceU1IIyuc4pkklMcKe5t2Icg9w"}]}
cache-control: max-age=14400
cf-cache-status: HIT
etag: W/"6857a115-6f2"
content-encoding: br
cf-ray: 960ec27bff930b06-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET otc.edgobase.com/assets/kjimg/f32/ball-green.png
200 OK 9.2 kB URL GET otc.edgobase.com/assets/kjimg/f32/ball-green.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type PNG image data, 59 x 59, 8-bit/color RGBA, non-interlaced
Hash 39f9c5d176afc38af6f95e07a8dad94b
51d9b892a4dc57f2e6ea9a59c761d03b8581ee5c
4dabddf810e954b916ea0902d5d47656d8120b832bcfa5f1954b5db25571b30e
GET /assets/kjimg/f32/ball-green.png HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://otc.edgobase.com/assets/kj.css?v=1.0.04
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:54 GMT
Content-Type: image/png
Content-Length: 9160
Connection: keep-alive
x-amz-id-2: EfTH4/Z+Gu6e3c2mbIy8ocIEPlDF9UVuu0dLsYmToEYjLy8B1DNl8IA40UxUyRdzqyZdY7aCI30=
x-amz-request-id: HXVTV1M5JRRFBG3A
Last-Modified: Tue, 22 Apr 2025 08:16:35 GMT
x-amz-version-id: _5T2Vems5Z.Nzprfg5BQI0w_lMVPJYSE
ETag: "39f9c5d176afc38af6f95e07a8dad94b"
Server: PWS/8.3.1.0.8
via: 1.1 x140:2 (W), 1.1 PSrdsdgemSTO1sw92:14 (W)
X-Px: ms PSrdsdgemSTO1sw92ARN, ms x140HKG(origin)
x-ws-request-id: 6879ba11_PSrdsdgemSTO1sw92_33319-16394
GET otc.edgobase.com/assets/jquery.min.js
200 OK 96 kB URL GET otc.edgobase.com/assets/jquery.min.js
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type JavaScript source, ASCII text, with very long lines (32341)
Hash 52d16e147b5346147d0f3269cd4d0f80
4566b5815f47f976c7c3d3083c600ad5561b6fc0
2e945ebcd9b955e7c543ba4ad41e8f7779a077b482a0207db74bd6ded2021d17
GET /assets/jquery.min.js HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:51 GMT
Content-Type: application/javascript
Content-Length: 96380
Connection: keep-alive
x-amz-id-2: a72Li1zx+NcnAqdiUvunJYNqeWey6F1dGzYzh9Hzi00CBAyx8jSzUyU4CCsFjmtdhzprY+7iXjO28P/JicNfYA==
x-amz-request-id: VNPB30K0FWA41SDT
Last-Modified: Sun, 22 Jun 2025 06:37:06 GMT
x-amz-version-id: QMoTLqfmg0GIrbi7f_sEfzInocT6AFYg
ETag: "52d16e147b5346147d0f3269cd4d0f80"
Server: PWS/8.3.1.0.8
Via: 1.1 x140:14 (W), 1.1 PSrdsdgemSTO1sw92:3 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 41092
x-ws-request-id: 6879ba0f_PSrdsdgemSTO1sw92_25942-10672
GET vhimg1.ptallenvery.com/00483//assets/images/340199.jpg
200 OK 206 kB URL GET vhimg1.ptallenvery.com/00483//assets/images/340199.jpg
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=3, software=Adobe Photoshop 21.1 (Windows), datetime=2025:04:10 19:11:30], progressive, precision 8, 512x512, components 3
Size 206 kB (205818 bytes)
Hash bf311e9670dce943b881b1f60174b587
e87ddf5b9b8cd2998e60e5ab9bd0c790c4e3db42
c52f1e81f79ec98fee0e7913d78c750d1ddcf6d6744930c37601c116f819546b
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483//assets/images/340199.jpg HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:52 GMT
content-type: image/jpeg
content-length: 205818
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eUOxLTKRNhRbMM0zhNQbWQZalOtYq82A%2FyiT3bVP6YBS521LZjYHNBd66BUqR%2BChHP7TDGX1EqYAoAvRgxLdqG%2FESPGw05SKa%2BWn4JFvfWWQIZDj%2BQDO9XQOgqyDy93N8M5nPs7pyPaj"}],"group":"cf-nel","max_age":604800}
last-modified: Mon, 14 Apr 2025 11:48:31 GMT
etag: "67fcf60f-323fa"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec286a97b56b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=548&min_rtt=0&rtt_var=80&sent=668&recv=585&lost=0&retrans=0&sent_bytes=392572&recv_bytes=34861&delivery_rate=23498251&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=1654&inflight_dur=94&x=40"
GET cdn.edgobase.com/assets/img/az.png
200 OK 4.0 kB URL GET cdn.edgobase.com/assets/img/az.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Hash 9a9b8c0ca3ed7cbc8473cb2e264cb762
bbfc7a8e51fe86b36a0f88d3efa61813097a5f5d
f86361830013708a83bb8ae824db42b8b05dcd33c95d3d0394ee2ff1e4985d55
GET /assets/img/az.png HTTP/1.1
Host: cdn.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:52 GMT
Content-Type: image/png
Content-Length: 4027
Connection: keep-alive
Server: PWS/8.3.1.0.8
Last-Modified: Tue, 25 Jun 2024 14:30:11 GMT
ETag: "667ad473-fbb"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Accept-Ranges: bytes
Via: 1.1 PSxgHKG8ir123:1 (W), 1.1 PSrdsdgemSTO1sw92:5 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 158148
x-ws-request-id: 6879ba10_PSrdsdgemSTO1sw92_27440-39696
GET vhimg1.ptallenvery.com/00483/assets/images/nav-icon.png
200 OK 3.1 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/nav-icon.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced
Hash d4a570a37423166552c78eceec1307b1
5350b8ab7f68d666f2904c4299386a61b469f395
69bb1984239e9d9f861397363b7708810f0bf4aa79048831be160ea8845f5562
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/nav-icon.png HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://vhimg1.ptallenvery.com/00483/assets/css/style.css?12255
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:52 GMT
content-type: image/png
content-length: 3103
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mGU90Xr%2FFcJsOEACEQg68q7rn%2FXNPvhxm3o%2FFAUZCFW8cZFoflCN4co5UhCEgFBvisQXH51IVd%2BWScBmIjID4JJBcDIONhJoxxGFU62ttPGC6PHdJlmyf%2FzqNjyNfaE1rpQaPQYF5ylZ"}],"group":"cf-nel","max_age":604800}
last-modified: Thu, 20 Feb 2025 15:02:49 GMT
etag: "67b74419-c1f"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec286e98556b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=663&min_rtt=0&rtt_var=231&sent=866&recv=614&lost=0&retrans=0&sent_bytes=667790&recv_bytes=36549&delivery_rate=31620696&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=1685&inflight_dur=126&x=40"
GET otc.edgobase.com/com.js?101
200 OK 1.8 kB URL GET otc.edgobase.com/com.js?101
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type JavaScript source, ASCII text, with very long lines (387)
Hash 45ce1de567d13f82633da6a67373d0e7
9e031cada2c50528e7d0f92efef4f62824196ebf
5b00d92cbf2786254963ca186560879da1825ce89160fabb7daeed5ee5cc6734
GET /com.js?101 HTTP/1.1
Host: otc.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:50 GMT
Content-Type: application/javascript
Content-Length: 1841
Connection: keep-alive
x-amz-id-2: 8u72x9tQrKnuVnzHZvJEQZq+ts/HI629tz1PW7AA1B3SlYA022BraodtiApjMan2QtgUZ4zdRFg1ELZ4ok4sMgnRHCX343Cy
x-amz-request-id: 0PXJWB4CW1PEJCDE
Last-Modified: Fri, 27 Jun 2025 10:19:58 GMT
x-amz-version-id: p09Xaf5MYwyEc6J3ixr6FnST.2hoS0Eh
ETag: "45ce1de567d13f82633da6a67373d0e7"
Server: PWS/8.3.1.0.8
Via: 1.1 PS-HKG-046K749:3 (W), 1.1 PSrdsdgemSTO1sw92:6 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 34707
x-ws-request-id: 6879ba0e_PSrdsdgemSTO1sw92_28186-52274
GET cdn.edgobase.com/assets/img/rz.png
200 OK 4.7 kB URL GET cdn.edgobase.com/assets/img/rz.png
IP
Requested by https://www.8595v.com/am/
Certificate IssuerLet's Encrypt
Subjectedgobase.com
Fingerprint38:D7:25:35:14:AC:9D:46:A9:23:24:2E:3A:AB:83:2A:1F:61:38:C0
ValiditySun, 22 Jun 2025 05:02:47 GMT - Sat, 20 Sep 2025 05:02:46 GMT
File type PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
Hash ec476fdf66103212b0d7e5f6252b9d1f
1849884fcb3785cbccf7f43c70b63f4f5c0419e1
dccc8e91b78ba7b840a47fbcedc06638b698a601da38c30014878c38a8cad35d
GET /assets/img/rz.png HTTP/1.1
Host: cdn.edgobase.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.8595v.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 18 Jul 2025 03:05:52 GMT
Content-Type: image/png
Content-Length: 4733
Connection: keep-alive
Server: PWS/8.3.1.0.8
Last-Modified: Tue, 25 Jun 2024 14:30:12 GMT
ETag: "667ad474-127d"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Accept-Ranges: bytes
Via: 1.1 PSxgHKG8ir123:9 (W), 1.1 PSrdsdgemSTO1sw92:11 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
Age: 158148
x-ws-request-id: 6879ba10_PSrdsdgemSTO1sw92_31589-53148
GET vhimg1.ptallenvery.com/00483/assets/images/theme-tab11-r.jpg
200 OK 1.4 kB URL GET vhimg1.ptallenvery.com/00483/assets/images/theme-tab11-r.jpg
IP
Requested by https://www.8595v.com/am/
Certificate IssuerGoogle Trust Services
Subjectptallenvery.com
FingerprintD0:EC:FA:54:2A:59:D5:6B:53:93:6A:B5:95:7A:DB:4A:77:59:09:09
ValidityWed, 02 Jul 2025 02:24:20 GMT - Tue, 30 Sep 2025 03:22:02 GMT
File type JPEG image data, baseline, precision 8, 38x56, components 3
Hash 94a7381b6cf7b5329bbea3f9dcba02c7
61af49f98dfc35cf4ef2f8f8f09876c91093e1fc
a998004799490cea87f116a3f46d86b09b115227fa3a4e0fbd8d76baaed21abe
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /00483/assets/images/theme-tab11-r.jpg HTTP/1.1
Host: vhimg1.ptallenvery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://vhimg1.ptallenvery.com/00483/assets/css/style.css?12255
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Jul 2025 03:05:52 GMT
content-type: image/jpeg
content-length: 1397
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3jjIr4ERyMkq8nb3w2oQIdvGEMXHpGnJlEdlZ2Bap1nUaGcp0%2BKUSa7GlY9KbXkGnzeT0LtQHZQB%2BNGPnjtR9%2F%2FnYfGGR8livGsGycnvFO%2BIXS5Vbh8Y2YzGZXj6MoJbJxXmn95GzP5m"}],"group":"cf-nel","max_age":604800}
last-modified: Thu, 20 Feb 2025 15:02:53 GMT
etag: "67b7441d-575"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 960ec286d98256b4-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=575&min_rtt=0&rtt_var=87&sent=786&recv=602&lost=0&retrans=0&sent_bytes=555790&recv_bytes=35816&delivery_rate=29372888&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=695e0b7c249b5848&ts=1675&inflight_dur=114&x=40"
18.162.145.8
111.45.3.198
104.21.75.245
163.171.134.109