{"report_id":"88d26ba1-80b2-446d-a915-77df8289e0fb","version":6,"status":"done","tags":[],"date":"2025-08-14T22:33:11Z","url":{"schema":"https","addr":"mfs957.net/#/login","fqdn":"mfs957.net","domain":"mfs957.net","tld":"net"},"ip":{"addr":"104.21.88.4","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"mfs957.net/#/login","fqdn":"mfs957.net","domain":"mfs957.net","tld":"net"},"title":"mfs957.net/#/login"},"submit":{"url":{"schema":"https","addr":"mfs957.net/#/login","fqdn":"mfs957.net","domain":"mfs957.net","tld":"net"},"ip":{"addr":"104.21.88.4","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-09-18T22:33:11Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-14","alert":"Sinkholed","trigger":"static.kkchuhai.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-14","alert":"Sinkholed","trigger":"api.kkchuhai.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"mfs957.net","ip":{"addr":"104.21.88.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":9,"received_data":3618031,"sent_data":3937,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"rpc.walletconnect.org","ip":{"addr":"18.185.145.84","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"domain_registered":"2018-03-26","domain_rank":891779,"first_seen":"2023-02-11T03:06:43Z","last_seen":"2025-08-10T23:08:04.421753Z","alert_count":0,"request_count":1,"received_data":1557,"sent_data":491,"comment":"","tags":null,"fingerprints":null},{"fqdn":"static.kkchuhai.cc","ip":{"addr":"104.26.9.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-03-28","domain_rank":0,"first_seen":"2025-05-30T21:53:07.677027Z","last_seen":"2025-08-13T02:42:00.651028Z","alert_count":2,"request_count":2,"received_data":14548,"sent_data":910,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"api.kkchuhai.cc","ip":{"addr":"104.26.9.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-03-28","domain_rank":0,"first_seen":"2025-06-23T17:22:41.584283Z","last_seen":"2025-08-13T02:42:00.648936Z","alert_count":2,"request_count":2,"received_data":6990,"sent_data":1067,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"pulse.walletconnect.org","ip":{"addr":"172.66.157.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2018-03-26","domain_rank":247907,"first_seen":"2023-10-09T08:23:11Z","last_seen":"2025-08-11T04:06:31.23493Z","alert_count":0,"request_count":2,"received_data":667,"sent_data":1140,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"mfs957.net/assets/index-Cg2BWXPG.js","fqdn":"mfs957.net","domain":"mfs957.net","tld":"net"},"ip":{"addr":"104.21.88.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"fdf431b79298dd7cb3ba7722ae97e83d","sha1":"93e184971be3511eaa1514f72884910530128d38","sha256":"eff50dff2c27c216b06e8e7538ea7e5d4ef8a99b28bd91d27e412fac2fdc9c6b","sha512":"6c4c0e80057d1d5fc7fa55e7fbd86fd4c101b4e404d0abc0cf9eb7f42c510fa8815af51e78e1f43e8f3e02ba216323332914c95ffd9227c46a6fc6e4d8631ec3","ssdeep":"49152:cw3wmj8BTrmyIAvyqDcA1fd51b1n5dySMwH6jMEGuoTv1qo8z8zBgMpfk/yojWEi:ZI9h51b1ySO5AHcvS6hwOCdM1ku+","tlshash":"c4e58e8472a6743a476311a8947b2502f234785a680dc0acf6fcd8f76fe5d4856bbf38","size":3266276,"data":"","first_seen":"2025-08-05T20:11:46.004757Z","last_seen":"2025-08-22T08:19:19.752269Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mfs957.net/assets/index-DInTTBWo.js","fqdn":"mfs957.net","domain":"mfs957.net","tld":"net"},"ip":{"addr":"104.21.88.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f66c3df5f5532db1c184d044fdc4ae9f","sha1":"6ff1c442ed31aa938b992b9d3f8c46975141015d","sha256":"31758418f0c223be68c3724a48bb4e2430cee47cdc1fec3f7ec23901ad4987c0","sha512":"73d3d73035aa345df2cb2c4d3b1881b3b19e9e3f2afde79f44ffe9f6a819a7ce7c58facbb8995c5eb35ec4065a2f9935034a1ae6e5b4247d5c6b75c652e1d34d","ssdeep":"3072:32GeKuV/Aya0NWpaCnMVIwlWl0ImASYsiRu0mtA9GFP:32llq0N7CM+lHOYsiRuFtz","tlshash":"89a36c8032a4a17143db44e670b66203e230ac18b48cc47cf6adddfb6e6994d6767f79","size":102943,"data":"","first_seen":"2025-08-03T23:47:14.351426Z","last_seen":"2025-08-22T08:19:19.715354Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"mfs957.net/#/login","fqdn":"mfs957.net","domain":"mfs957.net","tld":"net"},"ip":{"addr":"104.21.88.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-08-14T22:32:48.673Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mfs957.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 10 Aug 2025 12:34:39 GMT","end":"Sat, 08 Nov 2025 13:33:03 GMT"},"fingerprint":{"sha1":"0C:21:AA:75:5E:78:35:6B:D8:9D:1B:4A:1B:51:85:BC:69:7D:63:10","sha256":"79:FE:3F:97:2F:D5:78:9A:C5:5A:43:58:70:43:22:44:8D:60:78:BA:C6:73:9A:29:50:4A:F2:B2:C7:BE:50:BB"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: mfs957.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 14 Aug 2025 22:32:49 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 29 Jul 2025 14:16:04 GMT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w68E0LRQm5vltsEs7v%2F9HSSUchoxzfy0Fxt8D0%2BPk2UsSo4iUGbkLWA1V4RmxVTnbhqWjOEYljWN22UasnFnixJhU2p7PTME\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 96f3e9085f6956c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":573,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"408fd3f2910d828c9407280a20bbe46a","sha1":"6aca3e0ba5747254de36c338a39fad12ae31c157","sha256":"3f8c53533383794354cc42343c5f8be000abcf848c38aedd37e7920758b7e54c","sha512":"269648a4adbc249f26a7c2d22861045112ca9481bb27e8c8272a0d7f6e49878300df8ed857f27b5aaff128877fb222ac1b52f695ddbee67806eec81ea717a8da","ssdeep":"","tlshash":"e4f08b8284e08c19632042555de0f5049996db8b8f696e0875ef60bd4f88b498eef4a8","first_seen":"2025-08-03T23:47:14.320977Z","last_seen":"2025-08-22T08:19:19.734324Z","times_seen":7,"resource_available":false,"data":null}},"time_used":476,"timings":{"blocked":21,"dns":5,"connect":2,"send":0,"wait":429,"receive":0,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mfs957.net/assets/index-Cg2BWXPG.js","fqdn":"mfs957.net","domain":"mfs957.net","tld":"net"},"ip":{"addr":"104.21.88.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mfs957.net/#/login","date":"2025-08-14T22:32:49.318Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mfs957.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 10 Aug 2025 12:34:39 GMT","end":"Sat, 08 Nov 2025 13:33:03 GMT"},"fingerprint":{"sha1":"0C:21:AA:75:5E:78:35:6B:D8:9D:1B:4A:1B:51:85:BC:69:7D:63:10","sha256":"79:FE:3F:97:2F:D5:78:9A:C5:5A:43:58:70:43:22:44:8D:60:78:BA:C6:73:9A:29:50:4A:F2:B2:C7:BE:50:BB"}}},"request":{"raw":"GET /assets/index-Cg2BWXPG.js HTTP/1.1\r\nHost: mfs957.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://mfs957.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 14 Aug 2025 22:32:49 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 29 Jul 2025 14:16:04 GMT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=k08h2I%2F9RphWPfQzkcWd0bBEU%2Bc75CGfn4mzO5uK%2BxhaGP2rWz%2FXjMS4g6yfIxFTdnwwCrNy%2BG3jw4iyxLGWstpI3LNKxtNg\"}]}\r\ncache-control: max-age=120\r\ncf-cache-status: MISS\r\netag: W/\"6888d7a4-31d6e4\"\r\ncontent-encoding: br\r\ncf-ray: 96f3e90c3ae856c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3266276,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (40275)","md5":"264b25f43dc6bd6ce7df52a549fcb573","sha1":"ca7f7c4deea13c1f62e4659c5939fdd351928fa8","sha256":"fe888f1fafa0ba02ddafafbdd8e531dd4cca5bdf5790e3388c697ab12e3cb477","sha512":"84c73286ee7618329f8c93094c3ef7938eec03cda938951f0924883f2539f78335b6b27bea2254c7156c298e67fc373940a8a0b1310cb3e7d13092581f2688d6","ssdeep":"24576:cw3wdZPE1jrIBTrmyIkXvyqDcA1fd5Seb19p5dyELN:cw3wmj8BTrmyIAvyqDcA1fd51b1n5dy6","tlshash":"f8354a9872a6703543aa25a4142b3046f23dac7d744990ecf69cecfb3de9844663bf35","first_seen":"2025-08-03T23:47:14.308136Z","last_seen":"2025-08-17T02:24:31.098927Z","times_seen":11,"resource_available":false,"data":null}},"time_used":404,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":404,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rpc.walletconnect.org/v1/supported-chains?projectId=0f0497041e8f9875371375318fd64a32","fqdn":"rpc.walletconnect.org","domain":"walletconnect.org","tld":"org"},"ip":{"addr":"18.185.145.84","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://mfs957.net/#/login","date":"2025-08-14T22:32:51.689Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rpc.walletconnect.org","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Thu, 14 Nov 2024 00:00:00 GMT","end":"Sun, 14 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"1D:90:02:00:57:2E:9D:06:7A:75:0D:AC:8D:14:CA:A2:A0:C8:F8:4A","sha256":"E2:9C:67:C8:C4:82:1B:79:CE:42:68:5B:CB:AF:0E:3A:69:E0:6B:62:05:7C:4D:B3:58:36:FD:79:D4:51:B5:7A"}}},"request":{"raw":"GET /v1/supported-chains?projectId=0f0497041e8f9875371375318fd64a32 HTTP/1.1\r\nHost: rpc.walletconnect.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://mfs957.net/\r\nOrigin: https://mfs957.net\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 14 Aug 2025 22:32:51 GMT\r\ncontent-type: application/json\r\ncontent-length: 1214\r\ncache-control: public, max-age=86400, s-maxage=86400\r\nx-request-id: 42f17e9f-53fa-47cf-ad3e-42e87cd573cb\r\naccess-control-allow-origin: *\r\nvary: origin, access-control-request-method, access-control-request-headers\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1214,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"260744c4b54db85293c484e3bd72f738","sha1":"c247aaa209494c2236601a4b7466ae922c83de1d","sha256":"4b5591cb43d06af6413e6fd921e92633e254c60dcc2de48399867fcec1598558","sha512":"0d1741a019e61f93c3663a9d8626aa7404043503d0919d44bdcbf5d27874bde9d757b0a883b757f48239821d29e8d5f1ea0753f53370fcf71f87d5daaf70a2f8","ssdeep":"","tlshash":"6d215b4c88814840ddb4d399dffce8cb95aef053a5cd28998df81c7151bd6b3351266e","first_seen":"2025-08-14T22:33:16.741246Z","last_seen":"2025-08-16T15:06:17.254623Z","times_seen":2,"resource_available":false,"data":null}},"time_used":185,"timings":{"blocked":80,"dns":5,"connect":24,"send":0,"wait":24,"receive":1,"ssl":47},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.kkchuhai.cc/","fqdn":"static.kkchuhai.cc","domain":"kkchuhai.cc","tld":"cc"},"ip":{"addr":"104.26.9.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mfs957.net/#/login","date":"2025-08-14T22:32:51.733Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"kkchuhai.cc","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 1","organization":"CLOUDFLARE, INC."},"validity":{"start":"Mon, 28 Jul 2025 04:00:36 GMT","end":"Sun, 26 Oct 2025 04:03:09 GMT"},"fingerprint":{"sha1":"6B:C6:D4:C0:58:73:99:DB:EC:89:04:F6:C4:EC:E2:4F:AE:39:EF:FD","sha256":"9E:C2:8F:F5:8E:DB:E5:C1:A8:58:B5:30:16:CC:0E:3D:F1:F2:A4:B5:85:4F:1F:E4:59:F5:EB:69:05:E3:EC:01"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: static.kkchuhai.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://mfs957.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\ndate: Thu, 14 Aug 2025 22:32:52 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kihl%2FExRiOnVcpOvQ3Oj5Pih35lrYNh1ODKsnqh%2F5bKLGTIPM7mPB2RZPuET4l8HIKY80bCXOsR81XphlnC2OTg5W0ti3nhHsfb5nLme3Q%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\nx-content-type-options: nosniff\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncontent-encoding: br\r\ncf-ray: 96f3e91bcb450b45-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T22:50:57.108687Z","times_seen":17486805,"resource_available":true,"data":null}},"time_used":561,"timings":{"blocked":66,"dns":21,"connect":1,"send":0,"wait":429,"receive":0,"ssl":41},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-14","alert":"Sinkholed","trigger":"static.kkchuhai.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.kkchuhai.cc/biz/agent_config","fqdn":"api.kkchuhai.cc","domain":"kkchuhai.cc","tld":"cc"},"ip":{"addr":"104.26.9.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://mfs957.net/#/login","date":"2025-08-14T22:32:52.285Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"kkchuhai.cc","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 1","organization":"CLOUDFLARE, INC."},"validity":{"start":"Mon, 28 Jul 2025 04:00:36 GMT","end":"Sun, 26 Oct 2025 04:03:09 GMT"},"fingerprint":{"sha1":"6B:C6:D4:C0:58:73:99:DB:EC:89:04:F6:C4:EC:E2:4F:AE:39:EF:FD","sha256":"9E:C2:8F:F5:8E:DB:E5:C1:A8:58:B5:30:16:CC:0E:3D:F1:F2:A4:B5:85:4F:1F:E4:59:F5:EB:69:05:E3:EC:01"}}},"request":{"raw":"POST /biz/agent_config HTTP/1.1\r\nHost: api.kkchuhai.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nlocale: en\r\nContent-Length: 23\r\nOrigin: https://mfs957.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://mfs957.net/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 14 Aug 2025 22:32:52 GMT\r\ncontent-type: application/json; charset=utf-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Accept-Language,Content-Type,AccessToken,X-CSRF-Token, Authorization, Token,X-Token,X-User-Id,Locale\r\naccess-control-allow-methods: POST, GET, OPTIONS,DELETE,PUT\r\naccess-control-allow-origin: https://mfs957.net\r\naccess-control-expose-headers: Content-Length, Access-Control-Allow-Origin, Access-Control-Allow-Headers, Content-Type, New-Token, New-Expires-At\r\ncf-cache-status: DYNAMIC\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FXXjza0RxWBIp4VOE34hFfprp9Z4OBpmZBw1F2RCBAFJkEAWFvjCRu1GX4EIMqbYKMo2YL4tIxoF6UjThuYvr02od0sKKKTq1fLbCA%3D%3D\"}]}\r\ncontent-encoding: br\r\ncf-ray: 96f3e91eae9056a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5099,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"357201135366e053e08e608a50e53487","sha1":"148c8762cb20be9ce43f6326bc0a2efbbc8d2796","sha256":"565c6863918c459e137a893460f05d1f881d5da72ade7b8b9539595dadb68bd8","sha512":"8680c961a66c40cc7855c504f49a26bbdd88ba438be8769ad5f63b0a7b3862d11d6384b0e7ff25549092f189d9cfa439d64d40ea320a6f8fdb6a533bf477f874","ssdeep":"96:eLBlBLBLBVBWBYBMBChIB2QqBukQuBWkQWBqkoBFBhBVBgBhBVBRB1cBjlB9B7Bb:eLBlBLBLBVBWBYBMBChIB2QqBukQuBWh","tlshash":"b5b1bcda002c9cbdc980ac46668f75ca24fc711b7c8edd96a8bdd93c8dde55d2244d0b","first_seen":"2025-08-14T22:33:16.743045Z","last_seen":"2025-08-17T02:24:31.093791Z","times_seen":2,"resource_available":false,"data":null}},"time_used":213,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":213,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-14","alert":"Sinkholed","trigger":"api.kkchuhai.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"static.kkchuhai.cc/uploads/file/66948a4fd3f128cf1debc31fec61a116_20250410180530.png","fqdn":"static.kkchuhai.cc","domain":"kkchuhai.cc","tld":"cc"},"ip":{"addr":"104.26.9.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mfs957.net/#/login","date":"2025-08-14T22:32:52.520Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"kkchuhai.cc","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 1","organization":"CLOUDFLARE, INC."},"validity":{"start":"Mon, 28 Jul 2025 04:00:36 GMT","end":"Sun, 26 Oct 2025 04:03:09 GMT"},"fingerprint":{"sha1":"6B:C6:D4:C0:58:73:99:DB:EC:89:04:F6:C4:EC:E2:4F:AE:39:EF:FD","sha256":"9E:C2:8F:F5:8E:DB:E5:C1:A8:58:B5:30:16:CC:0E:3D:F1:F2:A4:B5:85:4F:1F:E4:59:F5:EB:69:05:E3:EC:01"}}},"request":{"raw":"GET /uploads/file/66948a4fd3f128cf1debc31fec61a116_20250410180530.png HTTP/1.1\r\nHost: static.kkchuhai.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://mfs957.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 14 Aug 2025 22:32:52 GMT\r\ncontent-type: image/png\r\ncontent-length: 13014\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-headers: Origin, Content-Type, Accept, Authorization\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-origin: *\r\ncf-bgj: imgq:85,h2pri\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-polished: origSize=16321\r\netag: \"67f8086a-3fc1\"\r\nlast-modified: Thu, 10 Apr 2025 18:05:30 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\naccept-ranges: bytes\r\nx-content-type-options: nosniff\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NfrbVsDchkHFuZxJdYbUlT%2F5VgSPyWaQIhbO1FfScbxLaIKlHwtQGo%2BXvlWB4MjoW7YaEPN811ixJUWD5mMkSPREbCNr5LNW2pw%2FZwxikw%3D%3D\"}]}\r\ncf-ray: 96f3e9204ec20b45-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13014,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"22ba81f6bf3f54751ad56827ca3b55f0","sha1":"777aa859b36ebdd85caf7423f75754997dbb142f","sha256":"655f701b07b5b2d6a6f8781f2d334efde86911fffe20cd0ad101efcc30c580ad","sha512":"02f89c904a89d16bbcfd906b544569d49982b10941a16ea3c763c93f8954052c5174ee0bbbea7c1bff0b9cde850d1693fa3135f8d1e822c744f388e629995e85","ssdeep":"384:axfvHTRN9Wy1bMhJQ3SwuUjKFII5c4Ft0/ZWo:kFN9WnoCwuJameWo","tlshash":"6642cf22fe695d918844406871f0ea056dc1ff075fcbb4bbdfb2cdd624a7846a85e443","first_seen":"2025-08-13T16:17:42.592058Z","last_seen":"2025-08-17T02:24:31.097684Z","times_seen":3,"resource_available":false,"data":null}},"time_used":394,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":393,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-14","alert":"Sinkholed","trigger":"static.kkchuhai.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mfs957.net/favicon.ico","fqdn":"mfs957.net","domain":"mfs957.net","tld":"net"},"ip":{"addr":"104.21.88.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mfs957.net/#/login","date":"2025-08-14T22:32:51.103Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mfs957.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 10 Aug 2025 12:34:39 GMT","end":"Sat, 08 Nov 2025 13:33:03 GMT"},"fingerprint":{"sha1":"0C:21:AA:75:5E:78:35:6B:D8:9D:1B:4A:1B:51:85:BC:69:7D:63:10","sha256":"79:FE:3F:97:2F:D5:78:9A:C5:5A:43:58:70:43:22:44:8D:60:78:BA:C6:73:9A:29:50:4A:F2:B2:C7:BE:50:BB"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: mfs957.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://mfs957.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 14 Aug 2025 22:32:51 GMT\r\ncontent-type: image/x-icon\r\nvary: accept-encoding\r\ncontent-encoding: br\r\nlast-modified: Tue, 29 Jul 2025 14:16:04 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DCWcwtUNGO0lIZlZ3wY%2BazF9QDI9W6HGRJh4CW4YjuHntvS33pV5uKS%2F4vXrqYMvZeZPdzgzwA9I11PH4dYMsPAYG4Fxdz%2Fm\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=120\r\ncf-cache-status: MISS\r\netag: W/\"6888d7a4-10be\"\r\ncf-ray: 96f3e9176c765694-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4286,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"3c3953b3cf3c875eb862836d3b4fa515","sha1":"aa84c1084434fdfa07168dc3f5caece76ddc5d07","sha256":"f22e029e16e9fc5e7df8c600828d4ca12c82ee8319da7ab2c6a19a1c9bd2a148","sha512":"b71a778418e0aba0557eebc8a8be34d15a169c23c83cfc32530c06b717f006f5b999ef4b4fb536986e56e53c62c38a41652013cec5167c3e5fc1aaf4ba877f8f","ssdeep":"96:ifetp/OLJn94zBYyvqt/VqT7/GWvvaOWM:i6lOLJnCxv+qX/GWvvaOWM","tlshash":"d791c298c8536367dcd1c6fe4617cc39ac8d4e35c318c89809b8dfad5bbe2d40919697","first_seen":"2025-05-30T21:53:14.425986Z","last_seen":"2026-07-03T12:38:51.179546Z","times_seen":35,"resource_available":false,"data":null}},"time_used":432,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":432,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mfs957.net/assets/customservice-7u_IVuTE.webp","fqdn":"mfs957.net","domain":"mfs957.net","tld":"net"},"ip":{"addr":"104.21.88.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mfs957.net/#/login","date":"2025-08-14T22:32:51.764Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mfs957.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 10 Aug 2025 12:34:39 GMT","end":"Sat, 08 Nov 2025 13:33:03 GMT"},"fingerprint":{"sha1":"0C:21:AA:75:5E:78:35:6B:D8:9D:1B:4A:1B:51:85:BC:69:7D:63:10","sha256":"79:FE:3F:97:2F:D5:78:9A:C5:5A:43:58:70:43:22:44:8D:60:78:BA:C6:73:9A:29:50:4A:F2:B2:C7:BE:50:BB"}}},"request":{"raw":"GET /assets/customservice-7u_IVuTE.webp HTTP/1.1\r\nHost: mfs957.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://mfs957.net/assets/index-CxChNcRR.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 14 Aug 2025 22:32:52 GMT\r\ncontent-type: image/webp\r\ncontent-length: 85200\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 29 Jul 2025 14:16:04 GMT\r\netag: \"6888d7a4-14cd0\"\r\naccept-ranges: bytes\r\ncache-control: max-age=120\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=07OlUYgmX1f57jfaV0a9MdfIJyik9%2BKKb6qY4IYq7o8g6LYaWGoCKgU6XWQ1Jo%2FzQyjFnSrJHfVERi5cSmsHMxegvqVW9%2Bfz\"}]}\r\nvary: accept-encoding\r\ncf-ray: 96f3e91b9cad5694-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":85200,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"068cfb4ec13f046836c55fe4b3bc4554","sha1":"20089f8deda331008f3ea5fed2fdc61ad0cbecfd","sha256":"9a94497bc3c5fcc0b363d4cdc51d81c91c1d343596e9d360102fe688843a0a4e","sha512":"47947e3c4e08d5d1f2de85294d1bd8fa0718680937005bd38c44b63e01d5e905c85b6522b082f39391db3a91b771de17432e5a7a3ceee97305bf5e40db9f2637","ssdeep":"1536:AYS0vmtez8gN6iWB45VI/PcX/aDAACV/JOWs3xNOm3dNXP2HmdDp6yIC67A:tJeeggbWB4mcyDAAuMWs3BNeHmddIhc","tlshash":"8c8312016c4c1f16893c569114a7cb2e13250d5b3b86a78b487b35bb72fabcbaf1650b","first_seen":"2025-05-30T21:53:14.410024Z","last_seen":"2026-07-03T12:38:51.161238Z","times_seen":35,"resource_available":false,"data":null}},"time_used":774,"timings":{"blocked":11,"dns":0,"connect":0,"send":0,"wait":385,"receive":378,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pulse.walletconnect.org/e","fqdn":"pulse.walletconnect.org","domain":"walletconnect.org","tld":"org"},"ip":{"addr":"172.66.157.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://mfs957.net/#/login","date":"2025-08-14T22:32:51.810Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"walletconnect.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 19 Jun 2025 18:35:29 GMT","end":"Wed, 17 Sep 2025 19:35:11 GMT"},"fingerprint":{"sha1":"C2:66:07:74:A1:41:B7:AE:4E:6A:D7:71:F1:C4:C4:8E:E4:1E:68:18","sha256":"E3:61:E0:4C:8E:9A:E9:D5:57:12:63:9A:3C:35:51:2A:12:C0:08:74:AB:6F:A2:08:C3:8D:C7:20:3E:65:59:50"}}},"request":{"raw":"POST /e HTTP/1.1\r\nHost: pulse.walletconnect.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://mfs957.net/\r\nx-project-id: 0f0497041e8f9875371375318fd64a32\r\nx-sdk-type: appkit\r\nx-sdk-version: html-ethers-1.6.8\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 746\r\nOrigin: https://mfs957.net\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 202 Accepted\r\ndate: Thu, 14 Aug 2025 22:32:51 GMT\r\ncontent-type: text/plain;charset=UTF-8\r\ncontent-length: 0\r\ncf-ray: 96f3e91b9a65b4fd-OSL\r\naccess-control-allow-origin: *\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"202","status_text":"Accepted","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T22:50:57.108687Z","times_seen":17486805,"resource_available":true,"data":null}},"time_used":124,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":124,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mfs957.net/assets/index-CxChNcRR.css","fqdn":"mfs957.net","domain":"mfs957.net","tld":"net"},"ip":{"addr":"104.21.88.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mfs957.net/#/login","date":"2025-08-14T22:32:49.320Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mfs957.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 10 Aug 2025 12:34:39 GMT","end":"Sat, 08 Nov 2025 13:33:03 GMT"},"fingerprint":{"sha1":"0C:21:AA:75:5E:78:35:6B:D8:9D:1B:4A:1B:51:85:BC:69:7D:63:10","sha256":"79:FE:3F:97:2F:D5:78:9A:C5:5A:43:58:70:43:22:44:8D:60:78:BA:C6:73:9A:29:50:4A:F2:B2:C7:BE:50:BB"}}},"request":{"raw":"GET /assets/index-CxChNcRR.css HTTP/1.1\r\nHost: mfs957.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://mfs957.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 14 Aug 2025 22:32:49 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 29 Jul 2025 14:16:04 GMT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=McR6UjDDJi5KUMGtcHoCxIhkwQPmL7TGMDRncBTvZm7st570XjY08LnHQz7meOXHf1QOzouAnpJ4E4W0X5sDYMP5FB%2BQmnN1\"}]}\r\ncache-control: max-age=120\r\ncf-cache-status: MISS\r\netag: W/\"6888d7a4-a44f\"\r\ncontent-encoding: br\r\ncf-ray: 96f3e90c3aea56c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42063,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (42062)","md5":"6baf01886dc1d1e816a88ad93cfe20a5","sha1":"320d143a44ac9b590719b53d98168dc710a1078c","sha256":"cec2283668f4290a4fc91b15c215333b58a4af3c5ff92ff3131a0f249e3c26d6","sha512":"138205ac8583d3e5fe7a5265e58db4c38acf252b1ea977851c527ce787106183ecb317830b0d3e45ad9ddf7dad39e40bfe6f439955489621d6f87784a531c425","ssdeep":"768:0fesyDF83XNmbzjZN2b8JFLDVZpbZGZmvrJ1m:0fenEXgbzYyZpbZ7m","tlshash":"ca13ea2d2714143b6d1389f2d6e4abfce529b4c1cf3789aeb4c25800cbe36f6199b644","first_seen":"2025-08-03T23:47:14.336922Z","last_seen":"2025-08-22T08:19:19.738896Z","times_seen":12,"resource_available":false,"data":null}},"time_used":392,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":392,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mfs957.net/assets/login_img-D3psgoyI.webp","fqdn":"mfs957.net","domain":"mfs957.net","tld":"net"},"ip":{"addr":"104.21.88.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mfs957.net/#/login","date":"2025-08-14T22:32:51.742Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mfs957.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 10 Aug 2025 12:34:39 GMT","end":"Sat, 08 Nov 2025 13:33:03 GMT"},"fingerprint":{"sha1":"0C:21:AA:75:5E:78:35:6B:D8:9D:1B:4A:1B:51:85:BC:69:7D:63:10","sha256":"79:FE:3F:97:2F:D5:78:9A:C5:5A:43:58:70:43:22:44:8D:60:78:BA:C6:73:9A:29:50:4A:F2:B2:C7:BE:50:BB"}}},"request":{"raw":"GET /assets/login_img-D3psgoyI.webp HTTP/1.1\r\nHost: mfs957.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://mfs957.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 14 Aug 2025 22:32:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 107386\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 29 Jul 2025 14:16:04 GMT\r\netag: \"6888d7a4-1a37a\"\r\naccept-ranges: bytes\r\ncache-control: max-age=120\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sLpKQb8oT%2F%2F8chAbUB%2FTCfjNl1%2BA9nEhaecJq7ZBVwVlu63VVcPNTmq3RSWt%2B2bhP9Xtap0u%2F4HlxuikyaumKt%2Fp%2Fad0Hnq7\"}]}\r\nvary: accept-encoding\r\ncf-ray: 96f3e91b6cac5694-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":107386,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"3a58310183f6453f7f0f648668ea0027","sha1":"bcd3fbb267b96303b3de46f64b297a6a5d5c3c3e","sha256":"016f074b155beec5b7053a3a45346dae3eacec15c305e13c23fb98f97dec82d0","sha512":"fc6739c81099d5e1e02d8889ee8519617a72361b412003f861a866d34d825fe177cf43a7c54d3217523225b201c0a2cabff0dca79f34ffee329f26fe95785e75","ssdeep":"3072:wuym5GDOBDVY8GyppBgkBvzqWO5HR/9yPXXJG:wuwakYBBzjO/1qHU","tlshash":"bfa312b0e7e784f3492583eb91c797cda6ffc080762a51838192b9d2bcd0d5aa938d14","first_seen":"2025-05-30T21:53:14.408926Z","last_seen":"2026-02-02T20:16:27.178411Z","times_seen":27,"resource_available":false,"data":null}},"time_used":772,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":201,"receive":571,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mfs957.net/","fqdn":"mfs957.net","domain":"mfs957.net","tld":"net"},"ip":{"addr":"104.21.88.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://mfs957.net/#/login","date":"2025-08-14T22:32:52.792Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mfs957.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 10 Aug 2025 12:34:39 GMT","end":"Sat, 08 Nov 2025 13:33:03 GMT"},"fingerprint":{"sha1":"0C:21:AA:75:5E:78:35:6B:D8:9D:1B:4A:1B:51:85:BC:69:7D:63:10","sha256":"79:FE:3F:97:2F:D5:78:9A:C5:5A:43:58:70:43:22:44:8D:60:78:BA:C6:73:9A:29:50:4A:F2:B2:C7:BE:50:BB"}}},"request":{"raw":"HEAD / HTTP/1.1\r\nHost: mfs957.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://mfs957.net/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"HEAD"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 14 Aug 2025 22:32:53 GMT\r\ncontent-type: text/html\r\ncontent-encoding: br\r\nlast-modified: Tue, 29 Jul 2025 14:16:04 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nSGOLemJ1kUcB4JtXZN1mzKySCz82mUskGizDGHKnidPqYF5WfneaH%2BfjFL20JYxTIH%2Bj61GJ%2Blvl4iPbUO6NO38dbJ7WrGp\"}]}\r\ncf-cache-status: DYNAMIC\r\ncf-ray: 96f3e921fd025694-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T22:50:57.108687Z","times_seen":17486805,"resource_available":true,"data":null}},"time_used":409,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":409,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pulse.walletconnect.org/e","fqdn":"pulse.walletconnect.org","domain":"walletconnect.org","tld":"org"},"ip":{"addr":"172.66.157.155","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://mfs957.net/#/login","date":"2025-08-14T22:32:51.702Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"walletconnect.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 19 Jun 2025 18:35:29 GMT","end":"Wed, 17 Sep 2025 19:35:11 GMT"},"fingerprint":{"sha1":"C2:66:07:74:A1:41:B7:AE:4E:6A:D7:71:F1:C4:C4:8E:E4:1E:68:18","sha256":"E3:61:E0:4C:8E:9A:E9:D5:57:12:63:9A:3C:35:51:2A:12:C0:08:74:AB:6F:A2:08:C3:8D:C7:20:3E:65:59:50"}}},"request":{"raw":"OPTIONS /e HTTP/1.1\r\nHost: pulse.walletconnect.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: x-project-id,x-sdk-type,x-sdk-version\r\nReferer: https://mfs957.net/\r\nOrigin: https://mfs957.net\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Thu, 14 Aug 2025 22:32:51 GMT\r\ncf-ray: 96f3e91b5a24b4fd-OSL\r\naccess-control-allow-origin: *\r\nvary: Access-Control-Request-Headers, Accept-Encoding\r\naccess-control-allow-headers: x-project-id,x-sdk-type,x-sdk-version\r\naccess-control-allow-methods: OPTIONS,POST\r\naccess-control-max-age: 86400\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T22:50:57.108687Z","times_seen":17486805,"resource_available":true,"data":null}},"time_used":97,"timings":{"blocked":28,"dns":1,"connect":1,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mfs957.net/assets/index-DInTTBWo.js","fqdn":"mfs957.net","domain":"mfs957.net","tld":"net"},"ip":{"addr":"104.21.88.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mfs957.net/#/login","date":"2025-08-14T22:32:51.716Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mfs957.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 10 Aug 2025 12:34:39 GMT","end":"Sat, 08 Nov 2025 13:33:03 GMT"},"fingerprint":{"sha1":"0C:21:AA:75:5E:78:35:6B:D8:9D:1B:4A:1B:51:85:BC:69:7D:63:10","sha256":"79:FE:3F:97:2F:D5:78:9A:C5:5A:43:58:70:43:22:44:8D:60:78:BA:C6:73:9A:29:50:4A:F2:B2:C7:BE:50:BB"}}},"request":{"raw":"GET /assets/index-DInTTBWo.js HTTP/1.1\r\nHost: mfs957.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://mfs957.net/assets/index-Cg2BWXPG.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 14 Aug 2025 22:32:52 GMT\r\ncontent-type: application/javascript\r\nvary: accept-encoding\r\ncontent-encoding: br\r\nlast-modified: Tue, 29 Jul 2025 14:16:04 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6%2BgmSuVRcVwnaE5kN6H2BcqLy3Xk%2BqQhLZsDOcn0rXh%2FlUhWB3SplKsyzo9AdsD2MgWSsGWawTiWXPYMTow07USHZHiKe80z\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=120\r\ncf-cache-status: MISS\r\netag: W/\"6888d7a4-1921f\"\r\ncf-ray: 96f3e91b4ca85694-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":102943,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"f66c3df5f5532db1c184d044fdc4ae9f","sha1":"6ff1c442ed31aa938b992b9d3f8c46975141015d","sha256":"31758418f0c223be68c3724a48bb4e2430cee47cdc1fec3f7ec23901ad4987c0","sha512":"73d3d73035aa345df2cb2c4d3b1881b3b19e9e3f2afde79f44ffe9f6a819a7ce7c58facbb8995c5eb35ec4065a2f9935034a1ae6e5b4247d5c6b75c652e1d34d","ssdeep":"3072:32GeKuV/Aya0NWpaCnMVIwlWl0ImASYsiRu0mtA9GFP:32llq0N7CM+lHOYsiRuFtz","tlshash":"89a36c8032a4a17143db44e670b66203e230ac18b48cc47cf6adddfb6e6994d6767f79","first_seen":"2025-08-03T23:47:14.351426Z","last_seen":"2025-08-22T08:19:19.715354Z","times_seen":12,"resource_available":true,"data":null}},"time_used":1050,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":427,"receive":621,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mfs957.net/locales/en.webp","fqdn":"mfs957.net","domain":"mfs957.net","tld":"net"},"ip":{"addr":"104.21.88.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mfs957.net/#/login","date":"2025-08-14T22:32:51.739Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mfs957.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 10 Aug 2025 12:34:39 GMT","end":"Sat, 08 Nov 2025 13:33:03 GMT"},"fingerprint":{"sha1":"0C:21:AA:75:5E:78:35:6B:D8:9D:1B:4A:1B:51:85:BC:69:7D:63:10","sha256":"79:FE:3F:97:2F:D5:78:9A:C5:5A:43:58:70:43:22:44:8D:60:78:BA:C6:73:9A:29:50:4A:F2:B2:C7:BE:50:BB"}}},"request":{"raw":"GET /locales/en.webp HTTP/1.1\r\nHost: mfs957.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://mfs957.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 14 Aug 2025 22:32:52 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3766\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 29 Jul 2025 14:16:04 GMT\r\netag: \"6888d7a4-eb6\"\r\naccept-ranges: bytes\r\ncache-control: max-age=120\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BV36DiZh7EEtlnnA2bkOVqRpOXO2WiIvfmgYga0klculcG9nrdcs2SWJ8yi%2FWkkCUP9nG7whuubrY7wol4kEJ6f3GtCyCxGF\"}]}\r\nvary: accept-encoding\r\ncf-ray: 96f3e91b5cab5694-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3766,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"630f673b1b371fd1beda717a54729938","sha1":"b5a41126719701e7d04000b14ea31710103d2d90","sha256":"978b699811c7d5d7e4aa7ac33b94ef1306393874f6f347035bf453ad9f8d3d0f","sha512":"07b43be81a6fb7bf8e642dc482d189f421d7d3b9ab3f2ff487ad36d6577fa45599bd842d5433e85321b61c96b78f9e99c8767c33a392562c3bd7e9d6135c267a","ssdeep":"","tlshash":"59716c13a090ca98bd7f9c6b22db878b654ce1410669c4634a7f5b90ee90e4ff3f4443","first_seen":"2025-05-30T21:53:14.422444Z","last_seen":"2026-07-03T12:38:51.168809Z","times_seen":35,"resource_available":false,"data":null}},"time_used":427,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":427,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.kkchuhai.cc/biz/agent_config","fqdn":"api.kkchuhai.cc","domain":"kkchuhai.cc","tld":"cc"},"ip":{"addr":"104.26.9.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://mfs957.net/#/login","date":"2025-08-14T22:32:51.757Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"kkchuhai.cc","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 1","organization":"CLOUDFLARE, INC."},"validity":{"start":"Mon, 28 Jul 2025 04:00:36 GMT","end":"Sun, 26 Oct 2025 04:03:09 GMT"},"fingerprint":{"sha1":"6B:C6:D4:C0:58:73:99:DB:EC:89:04:F6:C4:EC:E2:4F:AE:39:EF:FD","sha256":"9E:C2:8F:F5:8E:DB:E5:C1:A8:58:B5:30:16:CC:0E:3D:F1:F2:A4:B5:85:4F:1F:E4:59:F5:EB:69:05:E3:EC:01"}}},"request":{"raw":"OPTIONS /biz/agent_config HTTP/1.1\r\nHost: api.kkchuhai.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type,locale\r\nReferer: https://mfs957.net/\r\nOrigin: https://mfs957.net\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Thu, 14 Aug 2025 22:32:52 GMT\r\nserver: cloudflare\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Accept-Language,Content-Type,AccessToken,X-CSRF-Token, Authorization, Token,X-Token,X-User-Id,Locale\r\naccess-control-allow-methods: POST, GET, OPTIONS,DELETE,PUT\r\naccess-control-allow-origin: https://mfs957.net\r\naccess-control-expose-headers: Content-Length, Access-Control-Allow-Origin, Access-Control-Allow-Headers, Content-Type, New-Token, New-Expires-At\r\ncf-cache-status: DYNAMIC\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XQ%2B1M5iZHxS9MHaEZBixk8g2Y1lQA4QnQ3RA8Q6Y3CoI%2BVxyqRWL2j6PKyuDxNb6wAlXrKGkvuRMCR4N%2FCSWRMcWAOnLMuUAij%2F1Kw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 96f3e91bcbda56a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T22:50:57.108687Z","times_seen":17486805,"resource_available":true,"data":null}},"time_used":532,"timings":{"blocked":47,"dns":5,"connect":1,"send":0,"wait":435,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-14","alert":"Sinkholed","trigger":"api.kkchuhai.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}