{"report_id":"885c508a-9457-49db-b2f5-33a35d195bef","version":0,"status":"done","tags":[],"date":"2026-07-20T10:54:06Z","url":{"schema":"http","addr":"979236.com","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":0,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"final":{"url":{"schema":"https","addr":"979236.com/__abp/join-pending?next=%2F","fqdn":"979236.com","domain":"979236.com","tld":"com"},"title":"979236.com/__abp/join-pending?next=%2F","dom":{"size":2834,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2195)","md5":"1ab81c9cc2be46a8ab5138db186a3c8f","sha1":"a01a144c5fe1ca6a508d9d073e187a3b92403a33","sha256":"b6065c59ed164e1f71cd215a22551e9d8f4b859665a791f4a6c26a710aa23dda","sha512":"6af175fe64eba249011b57ccf021ff0c10b72362815a85d17343aa253aa6b482b2b73f216fb01333d5b1dae43b556739c22ae3dfa4853feda795008923c39668","ssdeep":"","tlshash":"2c51b6497596a215a3e33118017fb61c70336c934d89e0c6d22087c17e75a5bca2bffe","dom_hash":"domhashaab000a6a80b6501ef8110334045d886","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"979236.com","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":0,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-24T10:54:06Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"979236.com","ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":81,"request_count":87,"received_data":32486,"sent_data":43730,"comment":"","tags":null,"fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}]},{"fqdn":"www.google.com","ip":{"addr":"142.251.152.119","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"1997-09-15","domain_rank":22,"first_seen":"2015-05-10T13:11:19Z","last_seen":"2026-07-19T22:48:34.906849Z","alert_count":0,"request_count":1,"received_data":1446,"sent_data":490,"comment":"","tags":null,"fingerprints":[{"name":"Google Web Server","description":"","website":"https://en.wikipedia.org/wiki/Google_Web_Server","common_platform_enumeration":"cpe:2.3:a:google:web_server:*:*:*:*:*:*:*:*","icon":"Google.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"979236.com/__abp/join-pending?next=%2F","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":true,"md5":"06b539980cccb72017024716d60a24de","sha1":"17c6821b60ad0c7abe331ec6081ab09dcaae26f3","sha256":"b9fd524a88f70583975c39f10c89aa75f5e624b50bba26f2073872c50169615d","sha512":"21ea7135f3224f53f88a8b36a7e7bb608b20f4315df35b42aadafafe5cbedadecc42b91fc759fd220a969e115eef48f89a63f780e60d26e760b84bad1c662724","ssdeep":"","tlshash":"5fe068ea734e46499bc3319ddb364918642206292c4dd0c6a06814e61a6bd2dce29ffc","size":375,"data":"","first_seen":"2026-07-06T23:31:53.537756Z","last_seen":"2026-07-20T10:58:15.332938Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/__abp/join-pending?next=%2F","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":true,"md5":"53893819b96f31a7b0dbe26a8c1c9627","sha1":"e5222cd70224563da53ae7f641bbe107c3b52431","sha256":"e557a0bf4e13feed32c670b000a9bf858ff72006f10633aa7d6e761cfae8292b","sha512":"5f9cf115523bda2950ba3b027813e213398e9c39b3feca296b2b46d6946438b3cdea7aca225c4eea49f3860cdcc3bc751f5b2516387b27572e4f7e621bad60cb","ssdeep":"","tlshash":"54415349b1d6a211a2e73128017fb619b1336c934d89a1c6d22087817e3195bc62bfff","size":2080,"data":"","first_seen":"2026-07-20T10:54:11.943382Z","last_seen":"2026-07-20T10:58:15.334063Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/wallet-detect.js","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":false,"md5":"93a4e9b120117d62e079a40780c1a416","sha1":"189d1b932821bd0e6b57d9548ef2679a634bab87","sha256":"c1bfd8ec79e339624c8f1765fce279e6fcc0acf0900c7362f6d0544f27a92d3e","sha512":"a2cc52d2d45df182b937202001a90f7748481475d170888106813a2069d22b16057b92754c79a9c7d067c5ba51a4671238adbcd43cccdf974e415aa346bac30e","ssdeep":"","tlshash":"a07132aa006111aec1b851bf0fa3e225db9671672404d2b87f9da2050fb7b05d178fe8","size":3773,"data":"","first_seen":"2026-07-06T23:31:53.536563Z","last_seen":"2026-07-20T10:58:15.326541Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:41.959Z","timestamp":1784544821959,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:53:41 GMT\r\ncross-origin-embedder-policy: require-corp\r\nvia: 1.1 Caddy\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:59.205Z","timestamp":1784544839205,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 20 Jul 2026 10:53:59 GMT\r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/__abp/join-status","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:54:00.004Z","timestamp":1784544840004,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /__abp/join-status HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 19\r\netag: W/\"13-1HrEiv8DSLNSFpVK/mi3YD2mVMA\"\r\ndate: Mon, 20 Jul 2026 10:54:00 GMT\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":19,"size_decoded":304,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"0c821edc24a104d0197c2f87d2fd9383","sha1":"d47ac48aff0348b35216954afe68b7603da654c0","sha256":"e08ff4aec917544328b4ca2be4a23ce025a53e3083cb259f6aa696c0c5b616c1","sha512":"34dd747a1c09b5ed3c47cd7daf4e019ef3d8c8eeebac9c215f2a96895126e5c1877fa4e4fe8b6020496b9ea6e22b7e83f77030e02cface9ff3c2a466ac10dc24","ssdeep":"","tlshash":"a5700022200008088ac80800e0080230a0200300008aa08028ac002c8020800a00c800","first_seen":"2026-07-06T23:31:53.534901Z","last_seen":"2026-07-20T10:58:15.320984Z","times_seen":4,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:40.758Z","timestamp":1784544820758,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 20 Jul 2026 10:53:40 GMT\r\nx-powered-by: Express\r\ncontent-type: application/json; charset=utf-8\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nvia: 1.1 Caddy\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/__abp/join-status","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:56.004Z","timestamp":1784544836004,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /__abp/join-status HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 19\r\netag: W/\"13-1HrEiv8DSLNSFpVK/mi3YD2mVMA\"\r\ndate: Mon, 20 Jul 2026 10:53:56 GMT\r\nx-powered-by: Express\r\ncontent-type: application/json; charset=utf-8\r\nvia: 1.1 Caddy\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":19,"size_decoded":304,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"0c821edc24a104d0197c2f87d2fd9383","sha1":"d47ac48aff0348b35216954afe68b7603da654c0","sha256":"e08ff4aec917544328b4ca2be4a23ce025a53e3083cb259f6aa696c0c5b616c1","sha512":"34dd747a1c09b5ed3c47cd7daf4e019ef3d8c8eeebac9c215f2a96895126e5c1877fa4e4fe8b6020496b9ea6e22b7e83f77030e02cface9ff3c2a466ac10dc24","ssdeep":"","tlshash":"a5700022200008088ac80800e0080230a0200300008aa08028ac002c8020800a00c800","first_seen":"2026-07-06T23:31:53.534901Z","last_seen":"2026-07-20T10:58:15.320984Z","times_seen":4,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:54.404Z","timestamp":1784544834404,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 20\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:53:54 GMT\r\ncontent-type: application/json; charset=utf-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/__abp/join-status","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:39.980Z","timestamp":1784544819980,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /__abp/join-status HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 19\r\netag: W/\"13-1HrEiv8DSLNSFpVK/mi3YD2mVMA\"\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 20 Jul 2026 10:53:39 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":19,"size_decoded":304,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"0c821edc24a104d0197c2f87d2fd9383","sha1":"d47ac48aff0348b35216954afe68b7603da654c0","sha256":"e08ff4aec917544328b4ca2be4a23ce025a53e3083cb259f6aa696c0c5b616c1","sha512":"34dd747a1c09b5ed3c47cd7daf4e019ef3d8c8eeebac9c215f2a96895126e5c1877fa4e4fe8b6020496b9ea6e22b7e83f77030e02cface9ff3c2a466ac10dc24","ssdeep":"","tlshash":"a5700022200008088ac80800e0080230a0200300008aa08028ac002c8020800a00c800","first_seen":"2026-07-06T23:31:53.534901Z","last_seen":"2026-07-20T10:58:15.320984Z","times_seen":4,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/__abp/join-status","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:41.954Z","timestamp":1784544821954,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /__abp/join-status HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvia: 1.1 Caddy\r\ndate: Mon, 20 Jul 2026 10:53:41 GMT\r\nx-powered-by: Express\r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\ncross-origin-opener-policy: same-origin\r\ncontent-length: 19\r\netag: W/\"13-1HrEiv8DSLNSFpVK/mi3YD2mVMA\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":19,"size_decoded":304,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"0c821edc24a104d0197c2f87d2fd9383","sha1":"d47ac48aff0348b35216954afe68b7603da654c0","sha256":"e08ff4aec917544328b4ca2be4a23ce025a53e3083cb259f6aa696c0c5b616c1","sha512":"34dd747a1c09b5ed3c47cd7daf4e019ef3d8c8eeebac9c215f2a96895126e5c1877fa4e4fe8b6020496b9ea6e22b7e83f77030e02cface9ff3c2a466ac10dc24","ssdeep":"","tlshash":"a5700022200008088ac80800e0080230a0200300008aa08028ac002c8020800a00c800","first_seen":"2026-07-06T23:31:53.534901Z","last_seen":"2026-07-20T10:58:15.320984Z","times_seen":4,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:42.358Z","timestamp":1784544822358,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:53:42 GMT\r\nvia: 1.1 Caddy\r\ncross-origin-opener-policy: same-origin\r\ncontent-length: 20\r\nx-powered-by: Express\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"wss://979236.com/user/redirect-ws","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:43.397Z","timestamp":1784544823397,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/redirect-ws HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://979236.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: Xuaep0vIVUcAp7F0hDhbmA==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 401 Unauthorized\r\nAlt-Svc: h3=\":443\"; ma=2592000\r\nVia: 1.1 Caddy\r\nDate: Mon, 20 Jul 2026 10:53:43 GMT\r\nTransfer-Encoding: chunked\r\n\r\n","headers":null,"cookies":null,"status_code":"401","status_text":"Unauthorized","fingerprints":null,"data":{"size":0,"size_decoded":142,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":83,"timings":{"blocked":0,"dns":0,"connect":25,"send":0,"wait":28,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:45.159Z","timestamp":1784544825159,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ndate: Mon, 20 Jul 2026 10:53:45 GMT\r\nvia: 1.1 Caddy\r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:48.368Z","timestamp":1784544828368,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:53:48 GMT\r\ncontent-length: 20\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:48.768Z","timestamp":1784544828768,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvia: 1.1 Caddy\r\ncontent-type: application/json; charset=utf-8\r\nx-powered-by: Express\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:53:48 GMT\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:51.989Z","timestamp":1784544831989,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\nvia: 1.1 Caddy\r\ndate: Mon, 20 Jul 2026 10:53:52 GMT\r\ncross-origin-embedder-policy: require-corp\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nx-powered-by: Express\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:54.005Z","timestamp":1784544834005,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 20\r\ndate: Mon, 20 Jul 2026 10:53:54 GMT\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:41.558Z","timestamp":1784544821558,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 20 Jul 2026 10:53:41 GMT\r\ncross-origin-opener-policy: same-origin\r\nvia: 1.1 Caddy\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nx-powered-by: Express\r\ncross-origin-embedder-policy: require-corp\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/__abp/join-status","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:43.954Z","timestamp":1784544823954,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /__abp/join-status HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\netag: W/\"13-1HrEiv8DSLNSFpVK/mi3YD2mVMA\"\r\ndate: Mon, 20 Jul 2026 10:53:43 GMT\r\ncross-origin-opener-policy: same-origin\r\nvia: 1.1 Caddy\r\ncontent-length: 19\r\nx-powered-by: Express\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":19,"size_decoded":304,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"0c821edc24a104d0197c2f87d2fd9383","sha1":"d47ac48aff0348b35216954afe68b7603da654c0","sha256":"e08ff4aec917544328b4ca2be4a23ce025a53e3083cb259f6aa696c0c5b616c1","sha512":"34dd747a1c09b5ed3c47cd7daf4e019ef3d8c8eeebac9c215f2a96895126e5c1877fa4e4fe8b6020496b9ea6e22b7e83f77030e02cface9ff3c2a466ac10dc24","ssdeep":"","tlshash":"a5700022200008088ac80800e0080230a0200300008aa08028ac002c8020800a00c800","first_seen":"2026-07-06T23:31:53.534901Z","last_seen":"2026-07-20T10:58:15.320984Z","times_seen":4,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:46.360Z","timestamp":1784544826360,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-powered-by: Express\r\ndate: Mon, 20 Jul 2026 10:53:46 GMT\r\nvia: 1.1 Caddy\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/__abp/join-status","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:49.967Z","timestamp":1784544829967,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /__abp/join-status HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 19\r\ndate: Mon, 20 Jul 2026 10:53:49 GMT\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\netag: W/\"13-1HrEiv8DSLNSFpVK/mi3YD2mVMA\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":19,"size_decoded":304,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"0c821edc24a104d0197c2f87d2fd9383","sha1":"d47ac48aff0348b35216954afe68b7603da654c0","sha256":"e08ff4aec917544328b4ca2be4a23ce025a53e3083cb259f6aa696c0c5b616c1","sha512":"34dd747a1c09b5ed3c47cd7daf4e019ef3d8c8eeebac9c215f2a96895126e5c1877fa4e4fe8b6020496b9ea6e22b7e83f77030e02cface9ff3c2a466ac10dc24","ssdeep":"","tlshash":"a5700022200008088ac80800e0080230a0200300008aa08028ac002c8020800a00c800","first_seen":"2026-07-06T23:31:53.534901Z","last_seen":"2026-07-20T10:58:15.320984Z","times_seen":4,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:54.804Z","timestamp":1784544834804,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\nvia: 1.1 Caddy\r\ndate: Mon, 20 Jul 2026 10:53:54 GMT\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nx-powered-by: Express\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/__abp/join-status","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:58.003Z","timestamp":1784544838003,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /__abp/join-status HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvia: 1.1 Caddy\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 20 Jul 2026 10:53:58 GMT\r\nx-powered-by: Express\r\ncontent-length: 19\r\netag: W/\"13-1HrEiv8DSLNSFpVK/mi3YD2mVMA\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":19,"size_decoded":304,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"0c821edc24a104d0197c2f87d2fd9383","sha1":"d47ac48aff0348b35216954afe68b7603da654c0","sha256":"e08ff4aec917544328b4ca2be4a23ce025a53e3083cb259f6aa696c0c5b616c1","sha512":"34dd747a1c09b5ed3c47cd7daf4e019ef3d8c8eeebac9c215f2a96895126e5c1877fa4e4fe8b6020496b9ea6e22b7e83f77030e02cface9ff3c2a466ac10dc24","ssdeep":"","tlshash":"a5700022200008088ac80800e0080230a0200300008aa08028ac002c8020800a00c800","first_seen":"2026-07-06T23:31:53.534901Z","last_seen":"2026-07-20T10:58:15.320984Z","times_seen":4,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:44.760Z","timestamp":1784544824760,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:53:44 GMT\r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 20\r\nvia: 1.1 Caddy\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/wallet-detected","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:45.218Z","timestamp":1784544825218,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"POST /user/wallet-detected HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nContent-Length: 34\r\nOrigin: https://979236.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":34,"data":"{\"hasWallet\":false,\"providers\":[]}"}},"response":{"raw":"HTTP/3 200 \r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 40\r\netag: W/\"28-BMtA/iQKdQlv2i93ISgGDEAdls0\"\r\ndate: Mon, 20 Jul 2026 10:53:45 GMT\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-embedder-policy: require-corp\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":40,"size_decoded":325,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"23805cedec92de6abea431c7f036908c","sha1":"04cb40fe240a75096fda2f772128060c401d96cd","sha256":"fc7028b40b601d2b0976f68a73f359df8cb9cc6e5943bfffba2d1c85437038ae","sha512":"037f6e34c183813c53924204eb2a00a8d7c4e7206aaa8c91e94c3b0b2cfe9f24d5c50045cd2ef2eda7bba88b751e3bece4bddd00e96938fc28c66cf8f5ba2344","ssdeep":"","tlshash":"cd90040553003c7d0701d3c1703c540073d10440f0403007d05d001ddf55cc43153105","first_seen":"2026-07-06T23:31:53.52929Z","last_seen":"2026-07-20T10:58:15.331444Z","times_seen":4,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:45.960Z","timestamp":1784544825960,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 20 Jul 2026 10:53:45 GMT\r\nvia: 1.1 Caddy\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nx-powered-by: Express\r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 20\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:54:00.008Z","timestamp":1784544840008,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 20 Jul 2026 10:54:00 GMT\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:54:00.406Z","timestamp":1784544840406,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-embedder-policy: require-corp\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\nvia: 1.1 Caddy\r\ndate: Mon, 20 Jul 2026 10:54:00 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/__abp/join-status","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:54:02.004Z","timestamp":1784544842004,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /__abp/join-status HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvia: 1.1 Caddy\r\ndate: Mon, 20 Jul 2026 10:54:02 GMT\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 19\r\nx-powered-by: Express\r\netag: W/\"13-1HrEiv8DSLNSFpVK/mi3YD2mVMA\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":19,"size_decoded":304,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"0c821edc24a104d0197c2f87d2fd9383","sha1":"d47ac48aff0348b35216954afe68b7603da654c0","sha256":"e08ff4aec917544328b4ca2be4a23ce025a53e3083cb259f6aa696c0c5b616c1","sha512":"34dd747a1c09b5ed3c47cd7daf4e019ef3d8c8eeebac9c215f2a96895126e5c1877fa4e4fe8b6020496b9ea6e22b7e83f77030e02cface9ff3c2a466ac10dc24","ssdeep":"","tlshash":"a5700022200008088ac80800e0080230a0200300008aa08028ac002c8020800a00c800","first_seen":"2026-07-06T23:31:53.534901Z","last_seen":"2026-07-20T10:58:15.320984Z","times_seen":4,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:54:02.016Z","timestamp":1784544842016,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-embedder-policy: require-corp\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:54:02 GMT\r\ncross-origin-opener-policy: same-origin\r\nvia: 1.1 Caddy\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\nx-powered-by: Express\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:54:03.207Z","timestamp":1784544843207,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 20\r\ndate: Mon, 20 Jul 2026 10:54:03 GMT\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nx-powered-by: Express\r\ncontent-type: application/json; charset=utf-8\r\nvia: 1.1 Caddy\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-20T10:53:39.554Z","timestamp":1784544819554,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-store\r\ncontent-type: text/html; charset=utf-8\r\ncross-origin-embedder-policy: require-corp\r\ncross-origin-opener-policy: same-origin\r\ndate: Mon, 20 Jul 2026 10:53:39 GMT\r\nlocation: /__abp/join-pending?next=%2F\r\nset-cookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874; Path=/; HttpOnly; SameSite=Lax; Max-Age=3600; Secure\r\nvary: Accept\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncontent-length: 57\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":151,"timings":{"blocked":-1,"dns":8,"connect":28,"send":0,"wait":44,"receive":0,"ssl":70},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/wallet-detect.js","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:39.973Z","timestamp":1784544819973,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /wallet-detect.js HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-powered-by: Express\r\ncache-control: public, max-age=0\r\naccept-ranges: bytes\r\nlast-modified: Tue, 12 May 2026 23:05:45 GMT\r\nvia: 1.1 Caddy\r\ncontent-type: application/javascript; charset=UTF-8\r\netag: W/\"ebd-19e1e706d28\"\r\ncontent-length: 3773\r\ndate: Mon, 20 Jul 2026 10:53:39 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":3773,"size_decoded":4068,"mime_type":"application/javascript; charset=UTF-8","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"93a4e9b120117d62e079a40780c1a416","sha1":"189d1b932821bd0e6b57d9548ef2679a634bab87","sha256":"c1bfd8ec79e339624c8f1765fce279e6fcc0acf0900c7362f6d0544f27a92d3e","sha512":"a2cc52d2d45df182b937202001a90f7748481475d170888106813a2069d22b16057b92754c79a9c7d067c5ba51a4671238adbcd43cccdf974e415aa346bac30e","ssdeep":"","tlshash":"a07132aa006111aec1b851bf0fa3e225db9671672404d2b87f9da2050fb7b05d178fe8","first_seen":"2026-07-06T23:31:53.536563Z","last_seen":"2026-07-20T10:58:15.326541Z","times_seen":4,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:43.959Z","timestamp":1784544823959,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\nvia: 1.1 Caddy\r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:53:43 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:44.359Z","timestamp":1784544824359,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:53:44 GMT\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/__abp/join-status","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:51.986Z","timestamp":1784544831986,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /__abp/join-status HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 19\r\netag: W/\"13-1HrEiv8DSLNSFpVK/mi3YD2mVMA\"\r\ndate: Mon, 20 Jul 2026 10:53:52 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":19,"size_decoded":304,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"0c821edc24a104d0197c2f87d2fd9383","sha1":"d47ac48aff0348b35216954afe68b7603da654c0","sha256":"e08ff4aec917544328b4ca2be4a23ce025a53e3083cb259f6aa696c0c5b616c1","sha512":"34dd747a1c09b5ed3c47cd7daf4e019ef3d8c8eeebac9c215f2a96895126e5c1877fa4e4fe8b6020496b9ea6e22b7e83f77030e02cface9ff3c2a466ac10dc24","ssdeep":"","tlshash":"a5700022200008088ac80800e0080230a0200300008aa08028ac002c8020800a00c800","first_seen":"2026-07-06T23:31:53.534901Z","last_seen":"2026-07-20T10:58:15.320984Z","times_seen":4,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"wss://979236.com/user/redirect-ws","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:55.583Z","timestamp":1784544835583,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/redirect-ws HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://979236.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: R8CLL++bU4DuXwV0Ndlfuw==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 401 Unauthorized\r\nAlt-Svc: h3=\":443\"; ma=2592000\r\nVia: 1.1 Caddy\r\nDate: Mon, 20 Jul 2026 10:53:55 GMT\r\nTransfer-Encoding: chunked\r\n\r\n","headers":null,"cookies":null,"status_code":"401","status_text":"Unauthorized","fingerprints":null,"data":{"size":0,"size_decoded":142,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":82,"timings":{"blocked":0,"dns":0,"connect":25,"send":0,"wait":27,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:58.805Z","timestamp":1784544838805,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:53:58 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:54:00.805Z","timestamp":1784544840805,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ndate: Mon, 20 Jul 2026 10:54:00 GMT\r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\nvia: 1.1 Caddy\r\ncontent-length: 20\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/__abp/join-pending?next=%2F","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-20T10:53:39.719Z","timestamp":1784544819719,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /__abp/join-pending?next=%2F HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-store, no-cache, must-revalidate, max-age=0\r\ncontent-type: text/html; charset=utf-8\r\ncross-origin-embedder-policy: require-corp\r\ncross-origin-opener-policy: same-origin\r\ndate: Mon, 20 Jul 2026 10:53:39 GMT\r\netag: W/\"b1e-YCr88Mkc1rzwdjWLGz9RXrUAMM0\"\r\npermissions-policy: interest-cohort=()\r\nreferrer-policy: no-referrer\r\nvia: 1.1 Caddy\r\nx-content-type-options: nosniff\r\nx-powered-by: Express\r\nx-robots-tag: noindex,nofollow,noarchive,nosnippet,noimageindex\r\ncontent-length: 2846\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":2846,"size_decoded":3410,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (2192)","md5":"ad255d992fdfdf1c2ea5a90771f31766","sha1":"602afcf0c91cd6bcf076358b1b3f515eb50030cd","sha256":"41b2d2217e64698bd5d88644c4c15e49ce75e3c50fead37f75826f629cde1e23","sha512":"3185605f5da7ec1d7d1fc433a5838aec92fa5031d6f4bfc76964431f8b6c4163bdd063dcb701ee21ef394fd3332cbf1196bf4b907c876c154a8c1a1474f0e84f","ssdeep":"","tlshash":"9951b7497596a215a3e33118017fb61c70376c934d49e0c6d22087c17e75a5bc92bffe","first_seen":"2026-07-20T10:54:11.939697Z","last_seen":"2026-07-20T10:58:15.321962Z","times_seen":2,"resource_available":true,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:41.158Z","timestamp":1784544821158,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 20 Jul 2026 10:53:41 GMT\r\nvia: 1.1 Caddy\r\ncross-origin-embedder-policy: require-corp\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:45.560Z","timestamp":1784544825560,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvia: 1.1 Caddy\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:53:45 GMT\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 20\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:49.168Z","timestamp":1784544829168,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 20 Jul 2026 10:53:49 GMT\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ncross-origin-opener-policy: same-origin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:51.168Z","timestamp":1784544831168,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-embedder-policy: require-corp\r\nvia: 1.1 Caddy\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\nx-powered-by: Express\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:53:51 GMT\r\ncross-origin-opener-policy: same-origin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:52.786Z","timestamp":1784544832786,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:53:52 GMT\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\nvia: 1.1 Caddy\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:53.188Z","timestamp":1784544833188,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 20 Jul 2026 10:53:53 GMT\r\nx-powered-by: Express\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ncross-origin-opener-policy: same-origin\r\nvia: 1.1 Caddy\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:53.587Z","timestamp":1784544833587,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 20 Jul 2026 10:53:53 GMT\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\nx-powered-by: Express\r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 20\r\nvia: 1.1 Caddy\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:51.569Z","timestamp":1784544831569,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 20 Jul 2026 10:53:51 GMT\r\ncross-origin-opener-policy: same-origin\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/__abp/join-status","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:54.003Z","timestamp":1784544834003,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /__abp/join-status HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 19\r\netag: W/\"13-1HrEiv8DSLNSFpVK/mi3YD2mVMA\"\r\ncross-origin-embedder-policy: require-corp\r\ndate: Mon, 20 Jul 2026 10:53:54 GMT\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":19,"size_decoded":304,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"0c821edc24a104d0197c2f87d2fd9383","sha1":"d47ac48aff0348b35216954afe68b7603da654c0","sha256":"e08ff4aec917544328b4ca2be4a23ce025a53e3083cb259f6aa696c0c5b616c1","sha512":"34dd747a1c09b5ed3c47cd7daf4e019ef3d8c8eeebac9c215f2a96895126e5c1877fa4e4fe8b6020496b9ea6e22b7e83f77030e02cface9ff3c2a466ac10dc24","ssdeep":"","tlshash":"a5700022200008088ac80800e0080230a0200300008aa08028ac002c8020800a00c800","first_seen":"2026-07-06T23:31:53.534901Z","last_seen":"2026-07-20T10:58:15.320984Z","times_seen":4,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:55.605Z","timestamp":1784544835605,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-opener-policy: same-origin\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:53:55 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:57.205Z","timestamp":1784544837205,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 20 Jul 2026 10:53:57 GMT\r\ncontent-length: 20\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:58.405Z","timestamp":1784544838405,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-powered-by: Express\r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 20\r\ndate: Mon, 20 Jul 2026 10:53:58 GMT\r\nvia: 1.1 Caddy\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/favicon.ico","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:40.025Z","timestamp":1784544820025,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 \r\ncontent-type: text/plain; charset=utf-8\r\ncross-origin-embedder-policy: require-corp\r\nlocation: https://www.google.com\r\ncontent-length: 44\r\ndate: Mon, 20 Jul 2026 10:53:40 GMT\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\nvary: Accept\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:43.158Z","timestamp":1784544823158,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvia: 1.1 Caddy\r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 20\r\ndate: Mon, 20 Jul 2026 10:53:43 GMT\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:50.768Z","timestamp":1784544830768,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ncontent-length: 20\r\ndate: Mon, 20 Jul 2026 10:53:50 GMT\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:56.805Z","timestamp":1784544836805,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 20 Jul 2026 10:53:56 GMT\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:54:02.407Z","timestamp":1784544842407,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvia: 1.1 Caddy\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 20\r\nx-powered-by: Express\r\ncontent-type: application/json; charset=utf-8\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:54:02 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:54:02.807Z","timestamp":1784544842807,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:54:02 GMT\r\ncontent-length: 20\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"wss://979236.com/user/redirect-ws","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:54:03.671Z","timestamp":1784544843671,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/redirect-ws HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://979236.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: JWSO7cKdY7OPHhedECb3UA==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 401 Unauthorized\r\nAlt-Svc: h3=\":443\"; ma=2592000\r\nVia: 1.1 Caddy\r\nDate: Mon, 20 Jul 2026 10:54:03 GMT\r\nTransfer-Encoding: chunked\r\n\r\n","headers":null,"cookies":null,"status_code":"401","status_text":"Unauthorized","fingerprints":null,"data":{"size":0,"size_decoded":142,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":82,"timings":{"blocked":0,"dns":0,"connect":25,"send":0,"wait":27,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:52.386Z","timestamp":1784544832386,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 20 Jul 2026 10:53:52 GMT\r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:56.006Z","timestamp":1784544836006,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvia: 1.1 Caddy\r\ncross-origin-embedder-policy: require-corp\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\ndate: Mon, 20 Jul 2026 10:53:56 GMT\r\nx-powered-by: Express\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:59.606Z","timestamp":1784544839606,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 20 Jul 2026 10:53:59 GMT\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\nvia: 1.1 Caddy\r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:54:01.607Z","timestamp":1784544841607,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-powered-by: Express\r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 20 Jul 2026 10:54:01 GMT\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nvia: 1.1 Caddy\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/__abp/join-status","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:54:04.004Z","timestamp":1784544844004,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /__abp/join-status HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-opener-policy: same-origin\r\ncontent-length: 19\r\ndate: Mon, 20 Jul 2026 10:54:04 GMT\r\nvia: 1.1 Caddy\r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\netag: W/\"13-1HrEiv8DSLNSFpVK/mi3YD2mVMA\"\r\nx-powered-by: Express\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":19,"size_decoded":304,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"0c821edc24a104d0197c2f87d2fd9383","sha1":"d47ac48aff0348b35216954afe68b7603da654c0","sha256":"e08ff4aec917544328b4ca2be4a23ce025a53e3083cb259f6aa696c0c5b616c1","sha512":"34dd747a1c09b5ed3c47cd7daf4e019ef3d8c8eeebac9c215f2a96895126e5c1877fa4e4fe8b6020496b9ea6e22b7e83f77030e02cface9ff3c2a466ac10dc24","ssdeep":"","tlshash":"a5700022200008088ac80800e0080230a0200300008aa08028ac002c8020800a00c800","first_seen":"2026-07-06T23:31:53.534901Z","last_seen":"2026-07-20T10:58:15.320984Z","times_seen":4,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:54:04.043Z","timestamp":1784544844043,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:54:04 GMT\r\nx-powered-by: Express\r\ncontent-length: 20\r\nvia: 1.1 Caddy\r\ncross-origin-opener-policy: same-origin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:54:04.443Z","timestamp":1784544844443,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:54:04 GMT\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:39.985Z","timestamp":1784544819985,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvia: 1.1 Caddy\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\ndate: Mon, 20 Jul 2026 10:53:40 GMT\r\nx-powered-by: Express\r\ncross-origin-embedder-policy: require-corp\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ncross-origin-opener-policy: same-origin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.251.152.119","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:40.295Z","timestamp":1784544820295,"http_version":"HTTP/3","security_state":"","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: www.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/html; charset=UTF-8\r\ndate: Mon, 20 Jul 2026 10:53:40 GMT\r\nexpires: -1\r\ncache-control: private, max-age=0\r\nstrict-transport-security: max-age=31536000\r\ncontent-security-policy-report-only: object-src 'none';base-uri 'self';script-src 'nonce-PutcsndSVDDUDIEfWbWYOQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp\r\ncross-origin-opener-policy: same-origin-allow-popups; report-to=\"gws\"\r\nreport-to: {\"group\":\"gws\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/gws/other\"}]}\r\naccept-ch: Sec-CH-Prefers-Color-Scheme\r\np3p: CP=\"This is not a P3P policy! See g.co/p3phelp for more info.\"\r\ncontent-encoding: br\r\nserver: gws\r\ncontent-length: 85451\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nset-cookie: AEC=AdJVEauJResRZIKt7LY-_1jlexRpM2pVgCnm-uK5OVfww70c8mXRSzd7-EY; expires=Sat, 16-Jan-2027 10:53:40 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax\n__Secure-ENID=35.SE=kkTqYCPmbpCPOFvwI34uuLHL9FCJ9H2Iu2Fjg4Vi0OjiDjrFnD0PHlD7qab-9V_p5EuqfMK2Dd1_tQzktMqbVT4rtpsGDOXko3AtUXZAceHPj0Iow2YUP2xHcW3LHbYpWwZq1HvDJVZq87IiJvQMjM7qz-CRg0ISDTR7-csHdz6OiUVX4L-JxzJWnueH4Rj7fSUVik_42aKPhBQzQXUNQEyGpcXtHNThGkxcHS_Up8JzyipP3NYBEXd-0qxlwg; expires=Fri, 20-Aug-2027 03:11:58 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Google Web Server","description":"","website":"https://en.wikipedia.org/wiki/Google_Web_Server","common_platform_enumeration":"cpe:2.3:a:google:web_server:*:*:*:*:*:*:*:*","icon":"Google.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:58.007Z","timestamp":1784544838007,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ncross-origin-opener-policy: same-origin\r\ndate: Mon, 20 Jul 2026 10:53:58 GMT\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-embedder-policy: require-corp\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:54:01.206Z","timestamp":1784544841206,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 20\r\ndate: Mon, 20 Jul 2026 10:54:01 GMT\r\nvia: 1.1 Caddy\r\ncontent-type: application/json; charset=utf-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:54:03.643Z","timestamp":1784544843643,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nx-powered-by: Express\r\ncross-origin-embedder-policy: require-corp\r\ndate: Mon, 20 Jul 2026 10:54:03 GMT\r\nvia: 1.1 Caddy\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:47.161Z","timestamp":1784544827161,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:53:47 GMT\r\nx-powered-by: Express\r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 20\r\ncross-origin-opener-policy: same-origin\r\nvia: 1.1 Caddy\r\ncontent-type: application/json; charset=utf-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:47.560Z","timestamp":1784544827560,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 20 Jul 2026 10:53:47 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:49.971Z","timestamp":1784544829971,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:53:49 GMT\r\nx-powered-by: Express\r\nvia: 1.1 Caddy\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:55.204Z","timestamp":1784544835204,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ndate: Mon, 20 Jul 2026 10:53:55 GMT\r\nvia: 1.1 Caddy\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:42.759Z","timestamp":1784544822759,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ndate: Mon, 20 Jul 2026 10:53:42 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:46.760Z","timestamp":1784544826760,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 20 Jul 2026 10:53:46 GMT\r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nvia: 1.1 Caddy\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:47.971Z","timestamp":1784544827971,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nx-powered-by: Express\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\ndate: Mon, 20 Jul 2026 10:53:47 GMT\r\nvia: 1.1 Caddy\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/redirect-stream","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:39.983Z","timestamp":1784544819983,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/redirect-stream HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/event-stream\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 204 \r\ncontent-length: 0\r\nvia: 1.1 Caddy\r\ndate: Mon, 20 Jul 2026 10:53:40 GMT\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":195,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"wss://979236.com/user/redirect-ws","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:39.989Z","timestamp":1784544819989,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/redirect-ws HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://979236.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: chp9ViWlH5xtAUxCHv2lBA==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 401 Unauthorized\r\nAlt-Svc: h3=\":443\"; ma=2592000\r\nVia: 1.1 Caddy\r\nDate: Mon, 20 Jul 2026 10:53:40 GMT\r\nTransfer-Encoding: chunked\r\n\r\n","headers":null,"cookies":null,"status_code":"401","status_text":"Unauthorized","fingerprints":null,"data":{"size":0,"size_decoded":142,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":266,"timings":{"blocked":-1,"dns":92,"connect":117,"send":0,"wait":27,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:43.559Z","timestamp":1784544823559,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-powered-by: Express\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\ndate: Mon, 20 Jul 2026 10:53:43 GMT\r\nvia: 1.1 Caddy\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/__abp/join-status","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:45.955Z","timestamp":1784544825955,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /__abp/join-status HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 19\r\netag: W/\"13-1HrEiv8DSLNSFpVK/mi3YD2mVMA\"\r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 20 Jul 2026 10:53:45 GMT\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":19,"size_decoded":304,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"0c821edc24a104d0197c2f87d2fd9383","sha1":"d47ac48aff0348b35216954afe68b7603da654c0","sha256":"e08ff4aec917544328b4ca2be4a23ce025a53e3083cb259f6aa696c0c5b616c1","sha512":"34dd747a1c09b5ed3c47cd7daf4e019ef3d8c8eeebac9c215f2a96895126e5c1877fa4e4fe8b6020496b9ea6e22b7e83f77030e02cface9ff3c2a466ac10dc24","ssdeep":"","tlshash":"a5700022200008088ac80800e0080230a0200300008aa08028ac002c8020800a00c800","first_seen":"2026-07-06T23:31:53.534901Z","last_seen":"2026-07-20T10:58:15.320984Z","times_seen":4,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/__abp/join-status","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:47.967Z","timestamp":1784544827967,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /__abp/join-status HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\netag: W/\"13-1HrEiv8DSLNSFpVK/mi3YD2mVMA\"\r\ndate: Mon, 20 Jul 2026 10:53:47 GMT\r\nvia: 1.1 Caddy\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 19\r\nx-powered-by: Express\r\ncross-origin-embedder-policy: require-corp\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":19,"size_decoded":304,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"0c821edc24a104d0197c2f87d2fd9383","sha1":"d47ac48aff0348b35216954afe68b7603da654c0","sha256":"e08ff4aec917544328b4ca2be4a23ce025a53e3083cb259f6aa696c0c5b616c1","sha512":"34dd747a1c09b5ed3c47cd7daf4e019ef3d8c8eeebac9c215f2a96895126e5c1877fa4e4fe8b6020496b9ea6e22b7e83f77030e02cface9ff3c2a466ac10dc24","ssdeep":"","tlshash":"a5700022200008088ac80800e0080230a0200300008aa08028ac002c8020800a00c800","first_seen":"2026-07-06T23:31:53.534901Z","last_seen":"2026-07-20T10:58:15.320984Z","times_seen":4,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:50.368Z","timestamp":1784544830368,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-opener-policy: same-origin\r\nvia: 1.1 Caddy\r\ncross-origin-embedder-policy: require-corp\r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 20 Jul 2026 10:53:50 GMT\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nx-powered-by: Express\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:57.605Z","timestamp":1784544837605,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\nvia: 1.1 Caddy\r\ndate: Mon, 20 Jul 2026 10:53:57 GMT\r\nx-powered-by: Express\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"wss://979236.com/user/redirect-ws","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:41.299Z","timestamp":1784544821299,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/redirect-ws HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://979236.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: C8qVDjTKiUFGcWIx79yxqA==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 401 Unauthorized\r\nAlt-Svc: h3=\":443\"; ma=2592000\r\nVia: 1.1 Caddy\r\nDate: Mon, 20 Jul 2026 10:53:41 GMT\r\nTransfer-Encoding: chunked\r\n\r\n","headers":null,"cookies":null,"status_code":"401","status_text":"Unauthorized","fingerprints":null,"data":{"size":0,"size_decoded":142,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":92,"timings":{"blocked":0,"dns":0,"connect":29,"send":0,"wait":31,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"wss","addr":"wss://979236.com/user/redirect-ws","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:47.486Z","timestamp":1784544827486,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/redirect-ws HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://979236.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: LgA/BRzOdRI8Y5rMDFw7IQ==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 401 Unauthorized\r\nAlt-Svc: h3=\":443\"; ma=2592000\r\nVia: 1.1 Caddy\r\nDate: Mon, 20 Jul 2026 10:53:47 GMT\r\nTransfer-Encoding: chunked\r\n\r\n","headers":null,"cookies":null,"status_code":"401","status_text":"Unauthorized","fingerprints":null,"data":{"size":0,"size_decoded":142,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":90,"timings":{"blocked":0,"dns":0,"connect":28,"send":0,"wait":30,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:49.568Z","timestamp":1784544829568,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 20 Jul 2026 10:53:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvia: 1.1 Caddy\r\nx-powered-by: Express\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-embedder-policy: require-corp\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:56.404Z","timestamp":1784544836404,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-embedder-policy: require-corp\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nvia: 1.1 Caddy\r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\ndate: Mon, 20 Jul 2026 10:53:56 GMT\r\nx-powered-by: Express\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"979236.com/user/check-redirect?here=%2F__abp%2Fjoin-pending","fqdn":"979236.com","domain":"979236.com","tld":"com"},"ip":{"addr":"91.92.35.67","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://979236.com/__abp/join-pending?next=%2F","date":"2026-07-20T10:53:40.358Z","timestamp":1784544820358,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"979236.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 12:52:36 GMT","end":"Sat, 17 Oct 2026 12:52:35 GMT"},"fingerprint":{"sha1":"1A:CF:26:30:51:40:C4:28:B4:A2:3A:7B:57:B2:20:20:DB:B2:CB:15","sha256":"5A:DC:FC:BB:81:93:AD:1F:F1:46:BB:EE:39:0B:E5:30:22:77:5E:52:92:65:0A:7E:6D:BE:68:EE:1B:73:47:37"}}},"request":{"raw":"GET /user/check-redirect?here=%2F__abp%2Fjoin-pending HTTP/1.1\r\nHost: 979236.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: abp_q=eedb68ef4229d86327f713463a467709ad320ed0ebab1874\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncross-origin-opener-policy: same-origin\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 20\r\netag: W/\"14-KQBOzsPQFclYtlJE18g8YCXeack\"\r\nx-powered-by: Express\r\ncross-origin-embedder-policy: require-corp\r\ndate: Mon, 20 Jul 2026 10:53:40 GMT\r\nvia: 1.1 Caddy\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20,"size_decoded":305,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9056a80bcafa761426ae826a7ae01d14","sha1":"29004ecec3d015c958b65244d7c83c6025de69c9","sha256":"f28b9c0f4b39c8845f3ce8fee7f071d00f8ef161ef54e4bb6af46351fd2e162a","sha512":"76c58ed828752dd339c6a84c7ed1b505087e1f7f4593058ab30e7468e59a32dc2799df8c00e1bd705d659ea26acfcd1b82c6e8e676167d356ba955d86eb801e8","ssdeep":"","tlshash":"7a700000a0ac2020200e80c800088800030a0802a02c0c28c0080b080a882220020802","first_seen":"2023-04-26T21:10:33Z","last_seen":"2026-07-22T06:38:00.148804Z","times_seen":106,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"979236.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}