{"report_id":"8ce89912-785f-42e4-94d2-f89d8e4ae5c9","version":6,"status":"done","tags":[],"date":"2026-04-21T19:26:40Z","url":{"schema":"https","addr":"rlmhv.cn/mmixosct/","fqdn":"rlmhv.cn","domain":"rlmhv.cn","tld":"cn"},"ip":{"addr":"172.67.144.29","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"rlmhv.cn/mmixosct/","fqdn":"rlmhv.cn","domain":"rlmhv.cn","tld":"cn"},"title":"rlmhv.cn/mmixosct/","dom":{"size":1760,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"c59e96c47281fefb08ee4bfde46a3be3","sha1":"ca61dbf2140edab54803edd593fb932ae1a372ee","sha256":"5ed9da69b1ac13b995f9a2c5178f3a2c7c748cfe404f7ec5a64787b081724229","sha512":"94128c2646a2b837f0286503fe43f1c529061887577a69a19ca1aeab0ca1ef5b99599c69b3b62ca5fee2f5810d0b62414161e6fe1176898916feb94214f390cc","ssdeep":"","tlshash":"fd318653f4501d5ef3328361e8daf80592a2f625c52c28a0f4ee75ae48c5fc282d767e","dom_hash":"domhashdb906e9700822a8148a44951f11eccbc","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"rlmhv.cn/mmixosct/","fqdn":"rlmhv.cn","domain":"rlmhv.cn","tld":"cn"},"ip":{"addr":"172.67.144.29","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-26T19:26:40Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-21","alert":"Phishing Block","trigger":"rlmhv.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"rlmhv.cn","ip":{"addr":"104.21.87.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-05-06","domain_rank":0,"first_seen":"2026-04-21T12:33:37.577907Z","last_seen":"2026-04-21T12:33:37.577907Z","alert_count":32,"request_count":8,"received_data":335389,"sent_data":3895,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"rlmhv.cn/mmixosct/assets/js/CbtgdPhf.js","fqdn":"rlmhv.cn","domain":"rlmhv.cn","tld":"cn"},"ip":{"addr":"104.21.87.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f8a8632f25fc1c3e23d94b50bdd30da1","sha1":"5682863aad08ed655ef495cf9df47670c1ee3c99","sha256":"d0fb2d1dc8bc746f546ce0add0104241eecbdf7b7054ce2e2f05844557de97fc","sha512":"37a89b77f4b6c4df1372fe30c28224005c345b8d50dfebd8ad2474f4160737446500f33a193691e2459bd9903db7a3d7223f32bfa20631dc32c621ac8b9d4d30","ssdeep":"3072:YA1jGAluQUVTCNDJxY+SfORAUg/U3kIEj2y46yLyBZ/1bl4k:YoGAmEDJDMORAUg/qy46+yb1bT","tlshash":"933439dd7286b0a253b324f1013f100bf27a296a7449d498f19dd8ca3cb9649927bf7d","size":242574,"data":"","first_seen":"2026-01-17T05:55:25.857749Z","last_seen":"2026-07-16T16:26:46.156423Z","times_seen":193,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rlmhv.cn/mmixosct/assets/js/CRKdQYY6.js","fqdn":"rlmhv.cn","domain":"rlmhv.cn","tld":"cn"},"ip":{"addr":"104.21.87.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c8228e92aba54c134eb2389db38261fa","sha1":"11b38192b0e885fbc4c0d3e5e062ed0146da5378","sha256":"6984a1bbdb2a28cc2a40734ea08ef18ec6781e03535dae078dcc97f787ee9957","sha512":"4843e2ba4010a3d4f87cb46100588b2d250d9713022d875ddf3152d1ce3bb156216c801e7d2b372a9fcc7684adb9e36230d6cfee52a8e5426ba61aff8f3756a3","ssdeep":"768:YzJENSox0h6wlGVpUQJaFJCy+K7WE+0cGzksqfz1Bc7DxnywTM95JhKS6DSBiU2b:HePQ9c3wMv","tlshash":"f903fac8b261546683e2a1a380750203f33899557408865cbb2ceef7ad7eeca7173f75","size":41156,"data":"","first_seen":"2025-06-26T16:12:55.034925Z","last_seen":"2026-07-19T15:20:33.838929Z","times_seen":13362,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rlmhv.cn/mmixosct/","fqdn":"rlmhv.cn","domain":"rlmhv.cn","tld":"cn"},"ip":{"addr":"104.21.87.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T17:57:00.828237Z","times_seen":235735,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rlmhv.cn/mmixosct/","fqdn":"rlmhv.cn","domain":"rlmhv.cn","tld":"cn"},"ip":{"addr":"104.21.87.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T18:49:28.873698Z","times_seen":731489,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rlmhv.cn/mmixosct/","fqdn":"rlmhv.cn","domain":"rlmhv.cn","tld":"cn"},"ip":{"addr":"104.21.87.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-23T18:49:28.873698Z","times_seen":731489,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rlmhv.cn/mmixosct/","fqdn":"rlmhv.cn","domain":"rlmhv.cn","tld":"cn"},"ip":{"addr":"104.21.87.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-23T17:57:00.828237Z","times_seen":235735,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"rlmhv.cn/mmixosct/assets/js/CRKdQYY6.js","fqdn":"rlmhv.cn","domain":"rlmhv.cn","tld":"cn"},"ip":{"addr":"104.21.87.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rlmhv.cn/mmixosct/","date":"2026-04-21T19:26:19.628Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rlmhv.cn","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Apr 2026 22:50:48 GMT","end":"Thu, 09 Jul 2026 23:48:59 GMT"},"fingerprint":{"sha1":"B7:3A:E5:EB:45:67:B9:F1:58:97:6B:DC:CD:B9:B0:A9:A2:87:BC:3E","sha256":"EF:47:25:80:DB:5B:1B:B4:20:26:71:75:18:E3:2F:1C:D5:82:A0:F9:39:81:13:9F:7C:5B:4B:F3:68:84:B4:A7"}}},"request":{"raw":"GET /mmixosct/assets/js/CRKdQYY6.js HTTP/1.1\r\nHost: rlmhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rlmhv.cn/mmixosct/assets/js/CbtgdPhf.js\r\nCookie: locale=en-us\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 21 Apr 2026 19:26:19 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 02 Dec 2025 16:35:02 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"692f1536-a0c4\"\r\nexpires: Thu, 21 May 2026 12:33:12 GMT\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\nage: 24786\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QOPPa88YogUhoeG8CM942nQRD0%2BlPb1CfOkvyN8%2BrypWAFYGPMy70bZF9YYgcqXvOoBPMlSf1%2BHN9YvE8TLyBIunSzGtxHdU5t1CNB7HAhVWps1VneO1O35OKg%3D%3D\"}]}\r\ncf-ray: 9efec79ca8da0b61-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":41156,"size_decoded":0,"mime_type":"application/javascript","magic":"data","md5":"c8228e92aba54c134eb2389db38261fa","sha1":"11b38192b0e885fbc4c0d3e5e062ed0146da5378","sha256":"6984a1bbdb2a28cc2a40734ea08ef18ec6781e03535dae078dcc97f787ee9957","sha512":"4843e2ba4010a3d4f87cb46100588b2d250d9713022d875ddf3152d1ce3bb156216c801e7d2b372a9fcc7684adb9e36230d6cfee52a8e5426ba61aff8f3756a3","ssdeep":"768:YzJENSox0h6wlGVpUQJaFJCy+K7WE+0cGzksqfz1Bc7DxnywTM95JhKS6DSBiU2b:HePQ9c3wMv","tlshash":"f903fac8b261546683e2a1a380750203f33899557408865cbb2ceef7ad7eeca7173f75","first_seen":"2025-06-26T16:12:55.034925Z","last_seen":"2026-07-19T15:20:33.838929Z","times_seen":13362,"resource_available":true,"data":null}},"time_used":13,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-21","alert":"Phishing Block","trigger":"rlmhv.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rlmhv.cn/open/?apiName=NtZNrG%2FPpxpxZbl04DWTC%2FEpMgU3MAaZQLEaznaPrfu2DQeNsUo5bw31PHZdVpQS","fqdn":"rlmhv.cn","domain":"rlmhv.cn","tld":"cn"},"ip":{"addr":"104.21.87.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://rlmhv.cn/mmixosct/","date":"2026-04-21T19:26:19.780Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rlmhv.cn","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Apr 2026 22:50:48 GMT","end":"Thu, 09 Jul 2026 23:48:59 GMT"},"fingerprint":{"sha1":"B7:3A:E5:EB:45:67:B9:F1:58:97:6B:DC:CD:B9:B0:A9:A2:87:BC:3E","sha256":"EF:47:25:80:DB:5B:1B:B4:20:26:71:75:18:E3:2F:1C:D5:82:A0:F9:39:81:13:9F:7C:5B:4B:F3:68:84:B4:A7"}}},"request":{"raw":"POST /open/?apiName=NtZNrG%2FPpxpxZbl04DWTC%2FEpMgU3MAaZQLEaznaPrfu2DQeNsUo5bw31PHZdVpQS HTTP/1.1\r\nHost: rlmhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nContent-Length: 579\r\nOrigin: https://rlmhv.cn\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rlmhv.cn/mmixosct/\r\nCookie: locale=en-us\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":579,"data":"{\"data\":\"VTnr8BJAXBmxz44ZS4rKDhCbsrEI2nsRap3EDhVBb96q9fkuKj1yXHf7gsrD8l%2F9sYp0mZj9Lesfo6bBEyRQM%2FPoHlTO0DwU%2FEt8gDtqcc%2FHrXYgWDr6Pqa7zLIx2PF%2FOkWnIyqZgYH%2BiO5Txyd%2BGvr3OZhUeknoIIE8s5Wr8RiaqSk8jUEmRtqGm3yrmgCjjl6xpzccD28ToIkeI5vd6HRwDlocJCMuTHVjRGbzjW94%2Bglq3O7QNqVpG6jGMm4n7gGNcM8dbq2NF850GR%2FUROSETdhVCSOS8Xn3edWVrCW78PN6qgwK24krayWliTPQK%2FqqcoOh50mNycXQHnHA%2FDwCFlWFHOHGDvu5wgAu9OQ1FHvlijRK92oEMdxqeQfRqk7Px0Uuatl9omv6sKc5cnnxtghPJcHdGYuftOoThpbV%2FwlqVC4CMZ%2Be50y5qUI9To30mcfenSpKTIjIXq4Yg%2FBT06Ng5ocuZQQdy6Usk7TGa5LIk4lDizDWTK20Ncv9lTcMdQT54eZg74bT2DRVQw%3D%3D\"}"}},"response":{"raw":"HTTP/3 404 Not Found\r\nserver: cloudflare\r\ndate: Tue, 21 Apr 2026 19:26:20 GMT\r\ncontent-type: text/plain; charset=utf-8\r\ncontent-length: 9\r\npriority: u=3,i=?0\r\nvary: Origin\r\naccess-control-allow-origin: https://rlmhv.cn\r\nset-cookie: locale=en-us; path=/; max-age=31557600; expires=Thu, 22 Apr 2027 01:26:19 GMT\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Bdpcb65Vpx1GOhk4aL2lvd2%2Fu6X402y9WrFgOG768gR44lhJQaU3iMiDV9ogj17Nyso%2BtFveQifUy6g7LR874JN2o40KBTHTTptjWCO7NgafOzyrlfs5wWIAxA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9efec79da8e90b61-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"9d1ead73e678fa2f51a70a933b0bf017","sha1":"d205cbd6783332a212c5ae92d73c77178c2d2f28","sha256":"0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5","sha512":"935b3d516e996f6d25948ba8a54c1b7f70f7f0e3f517e36481fdf0196c2c5cfc2841f86e891f3df9517746b7fb605db47cdded1b8ff78d9482ddaa621db43a34","ssdeep":"","tlshash":"a250000c0003c3cc0000003030c0000000000300300000300000c000000000000c000c","first_seen":"2023-03-08T03:03:03Z","last_seen":"2026-07-23T18:26:37.277254Z","times_seen":87826,"resource_available":true,"data":null}},"time_used":288,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":288,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-21","alert":"Phishing Block","trigger":"rlmhv.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rlmhv.cn/mmixosct/favicon.ico","fqdn":"rlmhv.cn","domain":"rlmhv.cn","tld":"cn"},"ip":{"addr":"104.21.87.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rlmhv.cn/mmixosct/","date":"2026-04-21T19:26:18.440Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rlmhv.cn","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Apr 2026 22:50:48 GMT","end":"Thu, 09 Jul 2026 23:48:59 GMT"},"fingerprint":{"sha1":"B7:3A:E5:EB:45:67:B9:F1:58:97:6B:DC:CD:B9:B0:A9:A2:87:BC:3E","sha256":"EF:47:25:80:DB:5B:1B:B4:20:26:71:75:18:E3:2F:1C:D5:82:A0:F9:39:81:13:9F:7C:5B:4B:F3:68:84:B4:A7"}}},"request":{"raw":"GET /mmixosct/favicon.ico HTTP/1.1\r\nHost: rlmhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rlmhv.cn/mmixosct/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 21 Apr 2026 19:26:18 GMT\r\ncontent-type: image/x-icon\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wXp6dFKSSsGGmo6DR2Qz2OtNHhFi27PdW9sIlN3aMPaAiShPDyKwz89RdpJY83%2B9pxgAjnwgiZKtQKKZwHH9CcKYZ5kJBGXPCsnWh11Yg9GsHBMcDszIHYErCA%3D%3D\"}]}\r\nlast-modified: Sun, 02 Nov 2025 11:47:18 GMT\r\npriority: u=6,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Thu, 21 May 2026 12:33:11 GMT\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: br\r\nage: 24786\r\ncf-cache-status: HIT\r\netag: W/\"690744c6-576e\"\r\ncf-ray: 9efec79548540b61-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":22382,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"891e510219786f543ca998282ed99f45","sha1":"19fe2ff6a2418bcb44b02308b998cef84199ee08","sha256":"e4bdf72e2f803f7e19907c12f407ac7f7cd5f1f94bfd730b9be24b0d49191b48","sha512":"e6729e7e1ed1909297317e249adb7af6c230b2a7082ea792c7776fa5037c8ed8aaf02bcc4015334b6c439732f965ce19291ffe863126d0c20bed9a0c89c4a95b","ssdeep":"48:sSY37LOM5M80I15CEARV/acnFNOpaF/vXE:sSw7LOekI1EE+fPOpaF30","tlshash":"4ea290bf6358f8d5d25d4ee0c91d82fc16196e20f8e0858f2a303e7d76b9ee28401617","first_seen":"2023-04-12T07:52:52Z","last_seen":"2026-07-23T10:17:27.463702Z","times_seen":15095,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-21","alert":"Phishing Block","trigger":"rlmhv.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rlmhv.cn/open/?apiName=nBmBX9EWaFzJUV9431G8XK9zUQwLVwoI6gpNOE%2BlffRa42rRVj6iaYQW0YibAIKG","fqdn":"rlmhv.cn","domain":"rlmhv.cn","tld":"cn"},"ip":{"addr":"104.21.87.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://rlmhv.cn/mmixosct/","date":"2026-04-21T19:26:18.821Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rlmhv.cn","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Apr 2026 22:50:48 GMT","end":"Thu, 09 Jul 2026 23:48:59 GMT"},"fingerprint":{"sha1":"B7:3A:E5:EB:45:67:B9:F1:58:97:6B:DC:CD:B9:B0:A9:A2:87:BC:3E","sha256":"EF:47:25:80:DB:5B:1B:B4:20:26:71:75:18:E3:2F:1C:D5:82:A0:F9:39:81:13:9F:7C:5B:4B:F3:68:84:B4:A7"}}},"request":{"raw":"POST /open/?apiName=nBmBX9EWaFzJUV9431G8XK9zUQwLVwoI6gpNOE%2BlffRa42rRVj6iaYQW0YibAIKG HTTP/1.1\r\nHost: rlmhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nContent-Length: 3637\r\nOrigin: https://rlmhv.cn\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rlmhv.cn/mmixosct/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":3637,"data":"{\"data\":\"z9r5pXNPg4rhN0vzNK7AJNwuGNuF5iHJH1nMPRNtUX8ONLCcMd5%2FSvXA6zasl6xdAliI3oBR%2FQKBQcpzaRfk8KFMYmdN9t%2F9wbB%2B3UJ4wdXsmUbice%2FSKKmds0CIwFK5gTRiSeIOF8%2BH6MmyntRZx%2FgePAA%2BX7Vlze3MJhUhBozDg6KCEGym9EXg2qyhXXJWy4iKPLtaUDECNLaM19wJgoBZlTx5mejl6s8%2Bp5qTzi6pmBmJLn4%2Bx5n4W9NcnEdl3IxX%2BvF9PGVYUNTS%2FG4KLGI73NqLq75HaoAxQ56fqXSI2laQY4O%2FXpgxpo%2BY8OZsBCItr8%2FCGbwc2UOhoNbYNc9Xx730aSEgjA9FiIfZRQfWSYGsOS0GZwd%2FbF9xWT0HnS0HKmcx3SGnouP4BHSD8e3PCHlbpxxJ7lvRgjdXgpUGSbEEPh8aEwtu7LNoKaFCOxDadH%2Bc6GHOMUhIlVTg92evOFY6jcyJaBzO6ygkFyY%2FfmqwREw46dPetfvMcd7fEhmaSSl3Hf8bACvNWBPW4qWDygGL%2FO29tJsUUJnmJb3X9shczbc%2B%2B4zXtMBsuCN70DLbzZYSyNjp0pmASkOcHEIuHtmcHjxNOml%2FdJltyZNcJwT06nnAXSFgz27Wa90Cm9rs%2BE4W7kUZc48y4dogYnNZ9sfo%2FveZw2aTcr8WBFie4sfGWMF%2FiKqIh02AiGG9AH9rn1psP8wAvqJC%2Fz%2FVGgYjhoIjzvVwY4m6Jnm1nYMgGqEkgmmYsVYFWswL%2F0QfDynNl%2FzwqQwZVRQTe6zL5pi1b6AIcvnM879zmy70G4A4uqsYeug7Ppu%2FQV%2FKzh8Pffb%2BCqRA2c4uwaflfHH4weMUP3h9Pq3oNa4s1jlGOJ9BD6QBcSqAVPUi0UMiMQRw5G%2BKbTJeFJOCvdBc7Nx72cJ1CGiZL%2BjRMwUjvsGPlXYTZOeM1yKf4twp23VG%2FE9lIdrrkbGWrq4h1IqS7IMNOaUDugy7eA4zVQojx0YHgqLwaS66vxS7W4MH%2Fu8CsF1n0J1NevMSoXmwB1pVHDXT5Yc0tAx56FeW5Zb2yNOId84%2FgbK83%2Fc7Hq%2FJwmi1bg4flg%2FioRxBes4DWqGocJTSV5q0vnCo5hU4Q9EQ5Dg6K9YqZT71CH%2FvIQBswjapyTSwUaRtRuRkqP8SlegkT2jaXspOPIVqb%2BZFlX6KBer7mljlkIMGeCkOOVqf5yUsA3AB3xtnZCW1IDPNzVV%2FK%2FMj57SBT5UCudcb4pYAxL9ZZovgk1Lyo9xE2Hlg0bsXsR%2FTjNLbu%2F%2BJkbfK3Twir6mPhbsDknK5VKaMN7Vkd3KqNoduibaRc17tE7mrgjksENqARfTH5CZrw9tJ5rPoRPAlsq%2BHab5c%2FPIba10Dx4sDhuX94Da7PMUpWTIlim2Go%2Fk7Mv2im57b6ygFqzEq1bOOaAFigcuOuv1otWTN8%2FKvhKu8PVmKgW1oOVbuqqlUvE8eKt%2BHUhxZGob9J9dZYI6dLqUi0Jun0AqivCS4zMeGX2zgbJHiF3%2FOVPWOXc1QfISDEQ2wwBQO3zVWYWdcAHcAbrQcnpHx%2FUiLpea%2B4%2Fb842BD4NVghzh4FOlStAYP%2BU9kj1o6fuX4RftNIGxL7KNSWQw08ACnjdFWazZ5mDK97V6gs%2FcSbAF6tLW0AZCFgbffua10JgSO3j4Yt1%2BTdHwBiFoNVGTHedHmKeVyg2Y%2FJGGXeI5Db%2FV5K0VSAZcMHQHLmjJigi5crQPkifNekGRsVq1bTV%2BBQtOpT1Z4rUanvEqN8QHJ69N7sB5AQqrYKo5uAxSLgtc3Zje9nORsoJlxrXr8b0fUwiQPBJNvQYTUFJT1MSLSn6YbWPVQlPT1vswJJmftuDvqQvTQ3%2Bw1WqmHOShslDcbK0A0gaiQbCN%2Fs2QZ7g9rWFrSVQKyHH7xazDx6WF9xzF%2BzymaxF9o5%2F4cIYgwpAz4LXmls8V0S4XL1ZhlAQPZ%2FzylO0RhycNiPHKqi8Y9llEtajbuiwbLy06pVZqvtztpCsMWqTJYQ6l8dVltP1OOUyhhJws40oVMfIvJ3l98hRCnGEllKsKldxYdLHnobvgl3tdwkYfCSHsdFTFBVv8FcTk9rC47h2KQCUvtyYsomuPyTBBc4Jybmg7aGEuq8xeGGsS%2BizajMqxwHOfjFFvJJUGLXDKjPOkKQ%2FgBQMmxw6w%2FaEvzQB4fyQwF%2Bgt5IYqiTdFltjicQSonHtV7v9ygCzQZ7AsNDH%2BWwuT6f6EjBH0%2BVxxG85Kvd%2Fc9Oekc9LpYOFrGBcWZIePa9D15Fm56tEGYnx05kwW3lwudZbQBIdxumB1o3H5r2ffYw8jyXGgiCowXvhvymCszf6BORzHq0Dum8r%2BDFP%2FDu%2B%2BoFmvhsdBZvqNbd%2BQrwZTy0HDWOJd5ohT2fKVzBrXhP81kynqT9Q50YP1fzo8f3AI%2F0F5jn54NsRi4POTJyqJzSjr%2F8nDbi297tN1zzh8Z%2FqX9U8ruzOA%2BQ9alV3rf%2FuFk3SBcyE%2FOPx5Q9L%2FjsY7PxMOliml77tSLfQc9vAFI7yYF8oKxOpR%2Ft%2BlL7gJ%2Fh2N%2FzfoiGfHgzj%2BU%2Fz8k0FVkj8UwPVJ%2F7%2BJ95dr9MK0wgkfzz0WCWMX461Xo4Yg%2F3KJb2%2BQqcXMsXhMgKz%2BIr20ljnO0a8xrj7s9LUmBG5DvtLdq3hye4aH9YdB9IPBSZ3PcpDwWEn0yUQWz8h5lTVfNc90lwOMKn6QqSXITCrzPVMRFRnhDof6IFnSvkicqsgRfmtJSDxUw68KKc%2B4h9ZaObMA%2BXH9fJ18lN8sJ5DE81ywmWCRIMeqqMpJHqimpL95zRNKUZP4JqW8NUaEEIWui%2FUbyYEUDDA1hPN8e8LqbPg4nswKC1NE5pXWri%2F6xoiz2TwNRiKeppoMO2rMHskq1v9ghs0a5bpM%2BWFHVuX8MpnOM5jyLE%2ByB7qzoS2GEZF9m1zw4bDDzyLsB6oc%2BnC7eBPRXPqiT2ETE3QV5kEKUA%2BIjJNK598pXef%2BcRbJth5M8LlFFE4w%2FKHBWeWd0GdtHlGedO6rnbMrPSV%2FhpjBR9Ax0SKCbEb2b%2FZCh51hKiBSFlqrZGJkLhUclOJqEnfTwEMchyzCLIIp8a%2BbZg5rLM9txgNmobs4o2R7gVPZa%2B7jSTkjT8uvJyrVR3L7%2BTwZefLODRO8OfaBhR2MLlnoCZDyvemjeIpYp4KyLTV3F0r43RvG9Hrc%2BdxSzpjl0xnIiu%2BaJCZ5wZuMahvRA2UmsJwJ4%2BWFKOREryc06GdUd2RbPexC4qBzS%2FtI%2FowfRO9NingX6C6kyEOLzUqraQfu41psnVn6HAjwnpTl6FMZJWN9TMefOM15DmjBozsQxUP0oj8iIQ0xf2wzdZDhvyUObIQytLeJNboupZLriarMVFdvG\"}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 21 Apr 2026 19:26:19 GMT\r\ncontent-type: application/json; charset=utf-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding, Origin\r\naccess-control-allow-origin: https://rlmhv.cn\r\nset-cookie: locale=en-us; path=/; max-age=31557600; expires=Thu, 22 Apr 2027 01:26:19 GMT\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=haWFIbPGBm2bghI6z9D0F2PPHwOn%2FV6gS1JV%2FmKvzChBukGGgueON%2BzhURVKoT7qpiZnsVkueIdMaDFEgyqJC%2BHWgu1rKxMLkNj5hSM%2Fxq9z8Cxu5RqnEzFkVQ%3D%3D\"}]}\r\ncf-ray: 9efec797a8670b61-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"e0a4a09f97c732edeabd8580d721e7c2","sha1":"f0e11c0e56128ba246d782c8678a2f88f4e2391b","sha256":"8bc55f760a8ad956e66394c3a32b26711b660c74d20d358b35ec1e3b2ba2c728","sha512":"1eca591203c21924c9b9582a162a01001acf4b5f1449f7842a0d171e99b265a34ca9bc7eb61d77ce4601e20e8d51748cc29b8d6df0072a6b9b91b6c6da0dc41c","ssdeep":"","tlshash":"9b800082020cace823233802320e2a8820e830a0c2802aaaac2c023c8f08c28e083220","first_seen":"2025-06-24T22:10:16.160171Z","last_seen":"2026-07-22T16:23:36.508635Z","times_seen":44355,"resource_available":false,"data":null}},"time_used":519,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":519,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-21","alert":"Phishing Block","trigger":"rlmhv.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rlmhv.cn/mmixosct/","fqdn":"rlmhv.cn","domain":"rlmhv.cn","tld":"cn"},"ip":{"addr":"104.21.87.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-21T19:26:17.075Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rlmhv.cn","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Apr 2026 22:50:48 GMT","end":"Thu, 09 Jul 2026 23:48:59 GMT"},"fingerprint":{"sha1":"B7:3A:E5:EB:45:67:B9:F1:58:97:6B:DC:CD:B9:B0:A9:A2:87:BC:3E","sha256":"EF:47:25:80:DB:5B:1B:B4:20:26:71:75:18:E3:2F:1C:D5:82:A0:F9:39:81:13:9F:7C:5B:4B:F3:68:84:B4:A7"}}},"request":{"raw":"GET /mmixosct/ HTTP/1.1\r\nHost: rlmhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 21 Apr 2026 19:26:17 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Tue, 02 Dec 2025 16:35:02 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2B6DUrR%2B%2FW0GtROGjbBThE36NRojebtoqhmYrM%2FM9b%2BYYJztVBvQSqBqI2MMyZvBC0UpFGHI0x8fsrNVNzfZ0NdUbbCmPZ4d8Ku2RILZ%2BGa5%2B4koZFEKrnnxOAQ%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9efec78e4c3fc759-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1787,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"5431e1fe86f22d1617cf988f45c2274e","sha1":"250228f6376fa2204817c9f90509243fb90ce9d9","sha256":"a094f82c6c49af1e8f90ffb46f009e247fa26f9c650aa993d94a09cd0d75194e","sha512":"151e27d59e5f2f6d7f85c8d82f3efc820ac8b30a1a98737c0f52c005c400be3ab2b0081ccf4298aeca6e4bdcc678cafa6b57e71c9f5000d7969e1a90f3201bd6","ssdeep":"","tlshash":"27319753f4501d5ef23283a5e8daf80582a2f624c51c2890f0ee78aa4cc5fd292d727e","first_seen":"2026-01-17T05:55:25.855238Z","last_seen":"2026-07-16T16:26:46.153996Z","times_seen":193,"resource_available":true,"data":null}},"time_used":1030,"timings":{"blocked":249,"dns":231,"connect":1,"send":0,"wait":527,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-21","alert":"Phishing Block","trigger":"rlmhv.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rlmhv.cn/mmixosct/assets/js/CbtgdPhf.js","fqdn":"rlmhv.cn","domain":"rlmhv.cn","tld":"cn"},"ip":{"addr":"104.21.87.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rlmhv.cn/mmixosct/","date":"2026-04-21T19:26:18.040Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rlmhv.cn","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Apr 2026 22:50:48 GMT","end":"Thu, 09 Jul 2026 23:48:59 GMT"},"fingerprint":{"sha1":"B7:3A:E5:EB:45:67:B9:F1:58:97:6B:DC:CD:B9:B0:A9:A2:87:BC:3E","sha256":"EF:47:25:80:DB:5B:1B:B4:20:26:71:75:18:E3:2F:1C:D5:82:A0:F9:39:81:13:9F:7C:5B:4B:F3:68:84:B4:A7"}}},"request":{"raw":"GET /mmixosct/assets/js/CbtgdPhf.js HTTP/1.1\r\nHost: rlmhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rlmhv.cn/mmixosct/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 21 Apr 2026 19:26:18 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 02 Dec 2025 16:35:02 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"692f1536-3b38e\"\r\nexpires: Thu, 21 May 2026 12:33:09 GMT\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\nage: 24788\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Qj4s2SmFowCMHq2uayoCN4XOrw8Bzl7q77eAdglfXC00mPtGw3PTzL3BUsaxAtxUjH%2BdAorFPYNFcLz7cmGlZcvNrRvbpFT6e7dyJ9rD9vddiPnx6OrfGHrJZA%3D%3D\"}]}\r\ncf-ray: 9efec792b8310b61-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":242574,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (26372)","md5":"f8a8632f25fc1c3e23d94b50bdd30da1","sha1":"5682863aad08ed655ef495cf9df47670c1ee3c99","sha256":"d0fb2d1dc8bc746f546ce0add0104241eecbdf7b7054ce2e2f05844557de97fc","sha512":"37a89b77f4b6c4df1372fe30c28224005c345b8d50dfebd8ad2474f4160737446500f33a193691e2459bd9903db7a3d7223f32bfa20631dc32c621ac8b9d4d30","ssdeep":"3072:YA1jGAluQUVTCNDJxY+SfORAUg/U3kIEj2y46yLyBZ/1bl4k:YoGAmEDJDMORAUg/qy46+yb1bT","tlshash":"933439dd7286b0a253b324f1013f100bf27a296a7449d498f19dd8ca3cb9649927bf7d","first_seen":"2026-01-17T05:55:25.857749Z","last_seen":"2026-07-16T16:26:46.156423Z","times_seen":193,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-21","alert":"Phishing Block","trigger":"rlmhv.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rlmhv.cn/mmixosct/assets/css/CWKIglBF.css","fqdn":"rlmhv.cn","domain":"rlmhv.cn","tld":"cn"},"ip":{"addr":"104.21.87.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rlmhv.cn/mmixosct/","date":"2026-04-21T19:26:18.041Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rlmhv.cn","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Apr 2026 22:50:48 GMT","end":"Thu, 09 Jul 2026 23:48:59 GMT"},"fingerprint":{"sha1":"B7:3A:E5:EB:45:67:B9:F1:58:97:6B:DC:CD:B9:B0:A9:A2:87:BC:3E","sha256":"EF:47:25:80:DB:5B:1B:B4:20:26:71:75:18:E3:2F:1C:D5:82:A0:F9:39:81:13:9F:7C:5B:4B:F3:68:84:B4:A7"}}},"request":{"raw":"GET /mmixosct/assets/css/CWKIglBF.css HTTP/1.1\r\nHost: rlmhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rlmhv.cn/mmixosct/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 21 Apr 2026 19:26:18 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 02 Dec 2025 16:35:02 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"692f1536-5422\"\r\nexpires: Thu, 21 May 2026 12:33:09 GMT\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\nage: 24788\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DRXjBqT84mhhiIr21eff5okYzrNX32W6xxzqL7dhKmtwkjx8dCsxU4U%2BgfOkKns4BdWtN5z24emaGgJKcuTaih65xv6Cvj%2BvXrAD5GOOdcRYivDT9VRqEOZNgA%3D%3D\"}]}\r\ncf-ray: 9efec792b8320b61-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21538,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (20108)","md5":"13d6bd63c8f99f179332a87e39c72026","sha1":"046fe6825f75b508a7489a3f675ff51a21d86228","sha256":"e70d606b957cb6b8898562ec303ecf9c7344943a77291236ed4e1ccde398ce24","sha512":"4e8c7de53109ff5e330e745122919271834a2f0e56910a969d4523eb35e5c28f80bd4d263369dc6a334be30bb410d29022677ce03edfae0643b26753c4ff1c35","ssdeep":"192:bbxwOW9JyW9Jy4y3NpEpTgyxr4T+zA+x731X/T/HZNReLb3Izh:RwopEp1PzLX/T/HZNRLh","tlshash":"13a2331e6e1405767d5380f6f5e5eb49b21ab0c6ef26a7febd822500d7c63a61c82708","first_seen":"2026-01-17T05:55:25.860639Z","last_seen":"2026-07-16T16:26:46.15738Z","times_seen":194,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-21","alert":"Phishing Block","trigger":"rlmhv.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rlmhv.cn/77hjewsayjy.png","fqdn":"rlmhv.cn","domain":"rlmhv.cn","tld":"cn"},"ip":{"addr":"104.21.87.151","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rlmhv.cn/mmixosct/","date":"2026-04-21T19:26:18.459Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rlmhv.cn","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Apr 2026 22:50:48 GMT","end":"Thu, 09 Jul 2026 23:48:59 GMT"},"fingerprint":{"sha1":"B7:3A:E5:EB:45:67:B9:F1:58:97:6B:DC:CD:B9:B0:A9:A2:87:BC:3E","sha256":"EF:47:25:80:DB:5B:1B:B4:20:26:71:75:18:E3:2F:1C:D5:82:A0:F9:39:81:13:9F:7C:5B:4B:F3:68:84:B4:A7"}}},"request":{"raw":"GET /77hjewsayjy.png HTTP/1.1\r\nHost: rlmhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rlmhv.cn/mmixosct/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\nserver: cloudflare\r\ndate: Tue, 21 Apr 2026 19:26:18 GMT\r\ncontent-type: text/html\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=08nzJsspE4yDs3lAGSEiiYf40oXG2LHALTL6ktAQH4PshHdCEV3cBocCmTM8JNCmDiTz3VfcMnd3je1jCt9Ype%2BdS7Bsqp7Vz5i7VshRmvvHAY4dxOAnDBrIAw%3D%3D\"}]}\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9efec79558550b61-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":153,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"eb1be3f5478c6751f0de6e9128fecbf2","sha1":"94b9d1087b2551a6ab432abc63d64cafb5c212ad","sha256":"6e95d3011ecc51a72fec8b2a8e5b06b4e134c2b2cfe513bfce42d9029c6c8dd1","sha512":"78753808ec755c160823978aa8ebcc391c7c2c71a0b27c2271f2aa0be61349fff888e3775a9fbe9bef7f22d01adb60e1480356fa4654999ee40e6439e32f28e4","ssdeep":"","tlshash":"61c02b7d3513bc4cc5a3317422c37090c0da833764ba81128440810331cf3998ac3397","first_seen":"2026-03-26T19:37:59.367855Z","last_seen":"2026-07-22T12:57:44.658131Z","times_seen":1635,"resource_available":false,"data":null}},"time_used":526,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":525,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-21","alert":"Phishing Block","trigger":"rlmhv.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-21","alert":"Sinkholed","trigger":"rlmhv.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}