{"report_id":"86a52ba5-8513-439e-8c3a-f90ddd492e1a","version":0,"status":"done","tags":[],"date":"2026-06-27T10:19:20Z","url":{"schema":"http","addr":"76653333.com/","fqdn":"76653333.com","domain":"76653333.com","tld":"com"},"ip":{"addr":"206.119.82.248","port":0,"asn":140227,"as":"Hong Kong Communications International Co., Limited","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"103.87.242.181:38000/","fqdn":"103.87.242.181","domain":"103.87.242.181","tld":""},"title":"103.87.242.181:38000/","dom":{"size":15949,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (472)","md5":"1497d96a1cbe7120bf797db2e4a92862","sha1":"59ef45e53dca60863ccf72340691e00d70213300","sha256":"811ffe29fc61aa1ed0cdad9835383385391a3e4ef2de52cbb3fb88e2551f1b7a","sha512":"3e589bc7d234cf82b15018e516a7feaed251ab5842b03aa243b8a07191a912f6eb0ee2a57cf4f7e8a61d56a55efdee06af2e2a90d0cb2da3feab57fc62220270","ssdeep":"384:fXvRtoJz8hRFHbGmDCJ34YN7Fxhv9b1nDNNLn:xy2TPKh7T7P","tlshash":"d962cd22e3518e8641620c69b39e7f3c5159020f7f135a629ed70c96cace1fe379b35a","dom_hash":"domhash26f6f2819cf24822697c14b6236e0fae","first_seen":"2026-06-26T02:21:31.206282Z","last_seen":"2026-07-08T04:56:18.303062Z","times_seen":22,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"76653333.com/","fqdn":"76653333.com","domain":"76653333.com","tld":"com"},"ip":{"addr":"206.119.82.248","port":0,"asn":140227,"as":"Hong Kong Communications International Co., Limited","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-01T10:19:20Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":9}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"76653333.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-27","alert":"Phishing Block","trigger":"76653333.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"76653333.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"76653333.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"76653333.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"kyo-cdn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"kyo-cdn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"kyo-cdn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"kyo-cdn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"kyo-cdn.com","ip":{"addr":"172.67.188.11","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-11-11","domain_rank":1756815,"first_seen":"2024-12-05T22:51:48.624351Z","last_seen":"2026-06-21T04:23:17.549059Z","alert_count":4,"request_count":1,"received_data":13274,"sent_data":470,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"127.0.0.1","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":1,"received_data":0,"sent_data":494,"comment":"","tags":null,"fingerprints":null},{"fqdn":"76653333.com","ip":{"addr":"206.119.82.248","port":80,"asn":140227,"as":"Hong Kong Communications International Co., Limited","country":"Hong Kong","country_code":"HK"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-03-26T09:41:47.146847Z","last_seen":"2026-03-26T09:41:49.373302Z","alert_count":10,"request_count":2,"received_data":125,"sent_data":878,"comment":"","tags":null,"fingerprints":null},{"fqdn":"103.87.242.181","ip":{"addr":"103.87.242.181","port":38000,"asn":135581,"as":"19 Chun Wang Street, Tseung Kwan O Industrial Estate, N.T. Hong Kong","country":"Hong Kong","country_code":"HK"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":2,"received_data":16256,"sent_data":1005,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"kyo-cdn.com/layer.js","fqdn":"kyo-cdn.com","domain":"kyo-cdn.com","tld":"com"},"ip":{"addr":"172.67.188.11","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"79d5006484b4af58869160e1c2a48d57","sha1":"9ac7dbefa8e8600c3804e1e0a3145aeaa44cf3e0","sha256":"9431ccb6050cdfbebd47e2f312ddf99b3a78730d7d42d8f12cfb6c7ffae6fef1","sha512":"4902c218384e39d833b01c5037997db3c82803f9cafae48cccb2ff212b945d6137e5b08b55e9f1303b1d96ced65996586055f8555ad389792762c978553d1706","ssdeep":"192:elmpoTE0z/XV+aGBEpSujdVkEKnNgpy35p4rmvz3n5/5y35p4rp:5qI0z/luBEpSkKNgpyHDv1/5yHC","tlshash":"b142a498245535331d263a9f185f490877ba27a1f849681af24f64c0ffd0f6a831feac","size":12392,"data":"","first_seen":"2026-06-27T10:19:24.607209Z","last_seen":"2026-08-02T23:50:38.322032Z","times_seen":45,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"76653333.com/","fqdn":"76653333.com","domain":"76653333.com","tld":"com"},"ip":{"addr":"206.119.82.248","port":80,"asn":140227,"as":"Hong Kong Communications International Co., Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-27T10:18:58.809Z","timestamp":1782555538809,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: 76653333.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nLocation: https://103.87.242.181:38000\r\nContent-Type: text/html\r\nContent-Length: 0\r\nConnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-03T03:47:08.747654Z","times_seen":17683683,"resource_available":true,"data":null}},"time_used":1295,"timings":{"blocked":-1,"dns":16,"connect":220,"send":0,"wait":1059,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"76653333.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-27","alert":"Phishing Block","trigger":"76653333.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"76653333.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"76653333.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"76653333.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"103.87.242.181:38000/","fqdn":"103.87.242.181","domain":"103.87.242.181","tld":""},"ip":{"addr":"103.87.242.181","port":38000,"asn":135581,"as":"19 Chun Wang Street, Tseung Kwan O Industrial Estate, N.T. Hong Kong","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-27T10:19:00.124Z","timestamp":1782555540124,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"103.87.242.221","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Fri, 12 Jun 2026 00:00:00 GMT","end":"Sun, 27 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"01:B5:DD:A9:69:0F:74:27:D6:E7:FE:D0:A1:6C:7B:C6:03:99:45:A9","sha256":"A9:55:1E:B3:2E:1C:EF:4F:EB:59:28:D3:35:B0:B5:7C:8B:1D:60:83:89:C2:60:30:EF:4A:2B:84:BE:08:1F:8A"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 103.87.242.181:38000\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 27 Jun 2026 10:19:01 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 18 Jun 2026 05:08:19 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a337d43-3d56\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15702,"size_decoded":1617,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (470)","md5":"dbac0287d4cac9aa9fd23570fee96104","sha1":"0f7bbefa0e1f9de315bcb41b3e8fc0a44b539191","sha256":"18dcf5be6da9a242844f627ed5717ea3848918b52941408dcdabe4853262f67e","sha512":"5a64187b3bcf6b7dc5bff712540e964881f14484469df394c5d15632f4f98f72f3b4ee1e2a742c06c7790720acdeb68a6a73529c7a0cf4b803e684c021ee8331","ssdeep":"192:jt6Utt62Gettrt6Ob6+t6Kb6it6mb6Bt6Yb6Qt6Zb6Yt6mb6et6Lb6jt6ab6pt6D:jjBHj3NzTo/5oFd/QKXUlat6IIDS","tlshash":"30728c32e3518e8140620da9b38e7f2c6518411f7f075b669e960d5acfce1ba275f34a","first_seen":"2026-06-26T02:21:31.207962Z","last_seen":"2026-07-08T04:56:18.309133Z","times_seen":22,"resource_available":true,"data":null}},"time_used":1933,"timings":{"blocked":-1,"dns":0,"connect":241,"send":0,"wait":240,"receive":0,"ssl":1451},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kyo-cdn.com/layer.js","fqdn":"kyo-cdn.com","domain":"kyo-cdn.com","tld":"com"},"ip":{"addr":"172.67.188.11","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://103.87.242.181:38000/","date":"2026-06-27T10:19:02.538Z","timestamp":1782555542538,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kyo-cdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Jun 2026 22:44:05 GMT","end":"Tue, 22 Sep 2026 23:43:55 GMT"},"fingerprint":{"sha1":"88:0C:AD:13:44:FC:AF:39:1E:03:12:14:35:82:C9:B9:5B:00:A7:50","sha256":"F2:3A:90:2E:E3:B5:18:EB:49:E9:B7:ED:B9:AF:3A:5B:44:E2:21:D6:61:07:D3:D4:72:68:13:6B:42:A2:57:FB"}}},"request":{"raw":"GET /layer.js HTTP/1.1\r\nHost: kyo-cdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://103.87.242.181:38000/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sat, 27 Jun 2026 10:19:03 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 24 Jun 2026 02:40:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a3b43a3-305c\"\r\nexpires: Sat, 27 Jun 2026 22:19:03 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uZ93M9qxgfo3JUZ5lkK1xSRmE4HQ3KCqDjaRwu%2BcYva%2B%2FCrFlOVe9YoFMfygOAvAOgiC1RwfRBeZOL5wNL4G6TxbzxVgx6oSiqK%2F9uP1BdvHJbZQ1qotrPtev8xy6A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a123b60d0ef58deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12380,"size_decoded":4682,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1708)","md5":"45db933ea2028b72adf9993ddcac958f","sha1":"c62c7bf9645f5a1d82a66cf477ec2f14d92bf56d","sha256":"c4b2f8ef832643cd6bb7d80d574800d1603ba5623392607afb6df911b88a3572","sha512":"dbf4798b96ea06b35a6b4249292435dde48bdb968fb614486168b3c04e84eb436706736e0d0122068639b17f1390072cc72a5a9b0cf518149b65fd06176aa73b","ssdeep":"192:elmpoTE0z/XV+aGBEp2/XujdVkEKrNgpy35p4rmvz3n5/5y35p4rp:5qI0z/luBEpGkKpgpyHDv1/5yHC","tlshash":"4942b698245625331d663a9f185f4d0877ba2761f849681af24f64c0ffd0f6a831feac","first_seen":"2026-06-24T08:08:43.919077Z","last_seen":"2026-08-02T23:50:38.315149Z","times_seen":120,"resource_available":true,"data":null}},"time_used":734,"timings":{"blocked":-1,"dns":9,"connect":2,"send":0,"wait":708,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"kyo-cdn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"kyo-cdn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"kyo-cdn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"kyo-cdn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"127.0.0.1:33899/","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://103.87.242.181:38000/","date":"2026-06-27T10:19:03.307Z","timestamp":1782555543307,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: 127.0.0.1:33899\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-03T03:47:08.747654Z","times_seen":17683683,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"103.87.242.181:38000/favicon.ico","fqdn":"103.87.242.181","domain":"103.87.242.181","tld":""},"ip":{"addr":"103.87.242.181","port":38000,"asn":135581,"as":"19 Chun Wang Street, Tseung Kwan O Industrial Estate, N.T. Hong Kong","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://103.87.242.181:38000/","date":"2026-06-27T10:19:03.313Z","timestamp":1782555543313,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"103.87.242.221","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Fri, 12 Jun 2026 00:00:00 GMT","end":"Sun, 27 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"01:B5:DD:A9:69:0F:74:27:D6:E7:FE:D0:A1:6C:7B:C6:03:99:45:A9","sha256":"A9:55:1E:B3:2E:1C:EF:4F:EB:59:28:D3:35:B0:B5:7C:8B:1D:60:83:89:C2:60:30:EF:4A:2B:84:BE:08:1F:8A"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: 103.87.242.181:38000\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://103.87.242.181:38000/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sat, 27 Jun 2026 10:19:03 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":279,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-08-03T03:20:28.375535Z","times_seen":546015,"resource_available":true,"data":null}},"time_used":240,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":240,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"76653333.com/","fqdn":"76653333.com","domain":"76653333.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-27T10:18:58.337Z","timestamp":1782555538337,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: 76653333.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-03T03:47:08.747654Z","times_seen":17683683,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"76653333.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"76653333.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"76653333.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-27","alert":"Phishing Block","trigger":"76653333.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-27","alert":"Sinkholed","trigger":"76653333.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}