{"report_id":"8e4e055c-5735-4974-93ff-697b09c4b552","version":6,"status":"done","tags":["bet365","gambling","phishing"],"date":"2026-03-04T12:49:37Z","url":{"schema":"https","addr":"ong3589.com","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.208.255","port":0,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"title":"新葡京娱乐城","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"ong3589.com","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.208.255","port":0,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-08T12:49:37Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"ong3589.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]},"summary":[{"fqdn":"jn5ec4.pham.xin","ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"domain_registered":"2022-10-09","domain_rank":0,"first_seen":"2026-03-03T22:06:53.934587Z","last_seen":"2026-03-03T22:06:53.934587Z","alert_count":21,"request_count":174,"received_data":11865194,"sent_data":84595,"comment":"","tags":null,"fingerprints":null},{"fqdn":"ong3589.com","ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-05-19","domain_rank":0,"first_seen":"2025-06-02T22:23:25.857863Z","last_seen":"2025-06-02T22:23:25.857863Z","alert_count":16,"request_count":12,"received_data":1325601,"sent_data":6564,"comment":"","tags":null,"fingerprints":[{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Moment.js","description":"Moment.js is a free and open-source JavaScript library that removes the need to use the native JavaScript Date object directly.","website":"https://momentjs.com","common_platform_enumeration":"cpe:2.3:a:momentjs:moment:*:*:*:*:*:*:*:*","icon":"Moment.js.svg","categories":["JavaScript libraries"]},{"name":"jQuery:1.11.3","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Swiper","description":"Swiper is a JavaScript library that creates modern touch sliders with hardware-accelerated transitions.","website":"https://swiperjs.com","common_platform_enumeration":"","icon":"Swiper.svg","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/jquery/jquery-1.11.3.min.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"b091a47f6b91e26c93a848092c6f3788","sha1":"52918af2d431e73464060b35d364640c8db75606","sha256":"329ab92b9276ef4e3148f69be6b208969bebdf2db3121a589caa172453fd9f10","sha512":"ab444102be476f0104eeff79c9b596174852b4fe8cbd0b5a0279d56f106a166ec39304636e09326213de000b102ce8f517bb268a9abb2955c56ee4f18b464ea8","ssdeep":"1536:OP10iSi65U/dXXeyhzeBuG+HYE0WEeLDFoNqLTW8+S5VRZIVI6xSb8xh2ZbQnRmS:R+41ZqLTW8xRrqSb8qGH77da98Hr3","tlshash":"6893d8d9b7d67162977730b850bf510bb13a98eab80c4ca0f0a4d8e47d74a89507bf2d","size":95956,"data":"","first_seen":"2023-03-07T01:10:10Z","last_seen":"2026-06-07T07:30:11.536389Z","times_seen":18326,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/message_zh_CN.js?v=1772438913332","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"6f122062201cd2cedac9761f4c46b2a3","sha1":"5bced4febcad095851dd9d0dc4438d8e96aa8715","sha256":"96e43037ced41b7e8dfe16f604a02f6093aa1b65e9f349ea697e486e29bcd814","sha512":"b9cfd2e598fe9a778bea162e5180ca88bf01d2c02cceaeb27304e827fd0814662733d0df3ed07e2f3d5d0c34fea3f0e25b277d75fdc1a4de20c41eb169d225c0","ssdeep":"384:vTrBmS53qEviCysRI/2aTvfyxtvgfG+S7MjRBQP1RODaP5YnRn21IRBGN9Jaqxk7:IIy92nyfB+vODR01IRBG3JpfsIU","tlshash":"38e23ba604bedffb581615d6d44700c921d96b895afc7928bed0ee1e1b863c604f3387","size":32151,"data":"","first_seen":"2026-01-15T08:15:21.591485Z","last_seen":"2026-06-08T11:55:33.439441Z","times_seen":6853,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/moment.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"36c8f828395a9395549bd6e7307cb7e9","sha1":"f30a4961558e2d3d4405e7d93aa28fdb63245e78","sha256":"5d5e32fa1e06a0bc9396f349d142ad248e82086543e438c890e43f41e692db33","sha512":"40c24a9011e1bbdd98bd95b341c400bdaf48fefd953fcb407368fe3c685ac09196b55e230c03ca9890c35fe9acef2c916bed52423dc1a7b532a1db9817c03a8e","ssdeep":"1536:qOL1yBkBeb9wNoHpH7tjl2Ulwjwaj2BH3fMobEKeYEoZYiMirUw0:qOCWeH70R2BkobE+cw0","tlshash":"aeb35f5a59e31023496362294fdf2011ba388123590dee487d8da3d49f9ed7c47bafec","size":117433,"data":"","first_seen":"2023-07-29T10:21:40Z","last_seen":"2026-06-08T03:51:22.348552Z","times_seen":17488,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"9846b4b0c961f85e4c150bd29f4b86e1","sha1":"adf30369fc215e80b26536f1e24a1824ad3b81d5","sha256":"163a003d567f6d41f861d978c558eced69ed2b25c863055ed8171eefa350784b","sha512":"cf37c88b0608cef82c3627c952577e291343b8f63323da2dd77b34ab0500d5494bf377f85e968cb058124ff32345f184aeea9447eda67d9e887d688e2e5c81de","ssdeep":"","tlshash":"1c80000a8c0088cfac038e00803c00a23acc202a0022c2202a00a803aa00032023a0f2","size":29,"data":"","first_seen":"2023-03-07T01:14:38Z","last_seen":"2026-06-07T07:30:11.574937Z","times_seen":9745,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"7e79bcc10032c83c32aa540daa99a345","sha1":"d0269e0d4c3872aa661d926ff0caf5444dde2c03","sha256":"12fc406091fc36d727e4b33a18a6a5b447db54872dba522882d7c01323abadb1","sha512":"51f5063785510b6ec8a962a25e4af84153125fb23ac11685b8d753f5685776d5309a7a835a452f81e085bc9aaa7405af44db19e2db083b5733edf457e8ec7b20","ssdeep":"","tlshash":"ea9002560a71013d1c205156091912356150852d9c5ed8846412956c54a40200015804","size":49,"data":"","first_seen":"2023-03-07T12:39:28Z","last_seen":"2026-05-23T01:20:32.595305Z","times_seen":156,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/commonPage/lan/i18n.js?t=1772628549.701","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"11f80cdf005847a4f4427ed515bc1395","sha1":"f38ee44ff675d260e559986f4ede4925c6865651","sha256":"f2ff6e2cd0ba9c3efebc47a104985bdaa865066ee79713e681453f8dbfa726f9","sha512":"9f97c3eba478513121bd921586358e4f51fbb3065e692dd8350cc42a3fbd1d2f548606766dbef40745f9bacd08bc148e43a9446463e6f9296a577d5734916f88","ssdeep":"","tlshash":"fd21f158f3e565e32d5e86a3ed623f6b11750abd00973407437831ce017d7979c6c408","size":1310,"data":"","first_seen":"2026-03-04T12:49:49.194707Z","last_seen":"2026-03-04T12:49:49.194707Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/websocket/PopUp.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"07864ad2e2759d53f8f2f14dd4295bd9","sha1":"95144219e2eb702c4c4a707c3622b086876cf41c","sha256":"871bf30791bb89605b61cea815c3786246274b65ede3b8a8b8c2dd9244cfa89d","sha512":"f469d0f23c75e918d55e076d72481fca7043ac5eff9025aaac1f26860d080e4fc3c5d28f8f9ee1dae80719aca2b83f39ea82a129c221980bd7d63c212bacc119","ssdeep":"","tlshash":"9041ae54baf359a12c9b71f3aaaf30413160f2479505ed017d0cb9945f1d228b2cf7e9","size":2088,"data":"","first_seen":"2023-03-07T01:14:38Z","last_seen":"2026-06-08T03:51:22.33842Z","times_seen":17520,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/jquery/jquery.nicescroll.min.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"b5bc8cd626b389bde727a91e6ce79436","sha1":"3df6c39300ac286cf596b3bda273cb39ff825429","sha256":"a1eb48eeb3b3f2ba41940d3041464f0b386b7a7c4a8acb42f3017e691f4b116e","sha512":"2c1dde58ce83d9b716919dfc42602aef3022be012b3f92e61b17b674303ecbf0b9d308064b6d6c2443cf3e3dfd36bfb332eab62e64b56bef0be801e6f4610f12","ssdeep":"768:CwJl9VwAdGuMbJVAOi9ee9RjOEe1sdMv5rjITry:Cxb7AdRjOEKhHay","tlshash":"9553a7cd7522346b05de5235d18b4b4a623a9857730b90e4762c8cf46d29bbaf223f7c","size":64651,"data":"","first_seen":"2023-03-07T01:14:38Z","last_seen":"2026-06-08T03:51:22.348002Z","times_seen":17630,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"5755bd33351d998f9a8835d8b6b5fc26","sha1":"c8a3bca55ef8cc490ed41cdd158f1ba7bf6fad4b","sha256":"19c658841673f15b9a19062b15d628002637a68d4e9d5cb005e4ad86bdb46862","sha512":"cabc809e1b159603c89a58fb975984cbac35090ea9afdb414eb9cda84a428ed508a1d63e30d904f76afdcc2105d9725906da98c38d6385fa0cd2826813ff3ced","ssdeep":"","tlshash":"21e0c254a4eaf0530382400600fb7c105e9b2f035f58c891327f2048aff9a8c08d3e6c","size":318,"data":"","first_seen":"2024-09-24T19:10:11Z","last_seen":"2026-06-07T07:30:11.57646Z","times_seen":10332,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"07e2be932f4d6e838e25e45589fbf7fc","sha1":"0c3c252699af003e8dc432b3317feac1966180c0","sha256":"83b4d302d49aee98f086788dc18bec915aedddd8a0f36fc7b95b53ed1e145010","sha512":"9c8814e0e1b282e7c3fd404166213ed57d99e403046d9c7d81b042ffc803c89d744b3552416363e0b018e6cd3f63cb0d1fe7169796cf89b948129fca75a42b87","ssdeep":"","tlshash":"a9c02b30369370520383d07018ff37040d0f8f03a8182089b27e51d45ff0a8e1853d78","size":157,"data":"","first_seen":"2024-07-04T08:35:13Z","last_seen":"2026-06-06T23:55:15.798835Z","times_seen":801,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"5445fe16c2e8d28ae304e282e7e93e39","sha1":"abb962fd9457aa40a50863f4284692a6a37adf98","sha256":"34358dfef4996cd11d420026d175137dbff63bfc348edf8a117fecdc01525c31","sha512":"97f78dc89ad389804453bb390a5ccefbeac193aa48de55468e17cd2630023fbbc2a9488f2943452295537adc4bc1c20a4ad071da7aa2a71f3e217e4b29c493d0","ssdeep":"","tlshash":"9411a530d75590bb89a1137376ae683097da23aa47034fe8f3e38838e7a48d51193768","size":918,"data":"","first_seen":"2024-07-09T10:27:11Z","last_seen":"2026-06-06T16:12:48.069695Z","times_seen":872,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"a2dfe7db95be9792922530c88ef88da4","sha1":"fc992fc77fdfa4abe3570569fbdc53a1c5714c0c","sha256":"d05ab645a69476e9a8ba932b58907e3d8f103bf23aedafbe3e76b27f4a22358a","sha512":"99065782830b3e3f013910fd9aa795fd6b341e7892eaec200ad05305920552798f2446dad45dd254de8185095f36af246cee24052b58f05eb17dee20d59b5abe","ssdeep":"","tlshash":"7f210e524f048a9b77cdc7195060241c6ccca06fbc94b988f6ce9ba70f5ea9e56fd083","size":1279,"data":"","first_seen":"2025-10-03T11:28:12.468736Z","last_seen":"2026-03-15T12:05:04.391268Z","times_seen":1669,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"7ae1506c2cb05a5498965c441eef31b5","sha1":"2402a1add6a3423c8ad1ce5557fc9313ec2acfa5","sha256":"949c49615b8294df958408c55892cbf71530a8b04e464b46ecdd747eb237fe8a","sha512":"a48684549a136c266082112cfc1c6186abaa1bf30f7dbc81c0c7a21eb2fe8821ae825a8db77d4581002959c41a110a746ab672dff831f6c9cc1d756768121471","ssdeep":"","tlshash":"c301f9208c3840907c1123a0232b7b1cb532423b0c81e204721e6b60bfea8bf028a7de","size":704,"data":"","first_seen":"2026-03-03T22:07:02.514727Z","last_seen":"2026-03-10T22:58:05.74932Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"a2dfe7db95be9792922530c88ef88da4","sha1":"fc992fc77fdfa4abe3570569fbdc53a1c5714c0c","sha256":"d05ab645a69476e9a8ba932b58907e3d8f103bf23aedafbe3e76b27f4a22358a","sha512":"99065782830b3e3f013910fd9aa795fd6b341e7892eaec200ad05305920552798f2446dad45dd254de8185095f36af246cee24052b58f05eb17dee20d59b5abe","ssdeep":"","tlshash":"7f210e524f048a9b77cdc7195060241c6ccca06fbc94b988f6ce9ba70f5ea9e56fd083","size":1279,"data":"","first_seen":"2025-10-03T11:28:12.468736Z","last_seen":"2026-03-15T12:05:04.391268Z","times_seen":1669,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"9f5c687461489c9d437a54fb1943e637","sha1":"1ad3753d610c16f1a3d674bff8d880cfb67cfc2d","sha256":"8dda791697a9e83227c00bdb01b0a74144285b7909927974e06b2a27f65f63b4","sha512":"6dd825e0272d1dc65d2acc955443f501e525349a5d37af2cf47b35afb95a8431646999e8065ec76402a1c0dfe8311b9ce2f6d759196d62ef087a7d4367624ec4","ssdeep":"768:2KytGU/wnrevyruNjfWDLWuGze6S1WtxT8+UMsif4xEVEGFg3bL5F6e1A6Iem:VytGU/wnrevCuhf4LWuGze8vI+UMsifx","tlshash":"101341cd7b3a9810b8e3b53fb4472a28329c8c6a6ddd84adbc5c56350fd066221d51ef","size":45411,"data":"","first_seen":"2026-03-03T22:07:02.515975Z","last_seen":"2026-03-10T22:58:05.750302Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"ab8b1bcffc72e505e0f37f693d6a87a5","sha1":"849c792d84445ff1cc946c4458255dce152a68da","sha256":"36e8c37b1055713547aa080372b86615e1f9858d3f632cb0f949e05247f8e607","sha512":"cb717ce8dccbd48d7b8ac79f8018ff327637fce9ef4441b832a9ba7af57cfae5e476170ec2490374e8026a0b6a6a265399d4ad2801ebdb37b7a0092d8f9331a3","ssdeep":"192:1BDi+KreB5FlJ7KRn8rVavN3nryOcCxiAcJGw/d2mi7yn:TTKCBRhKRn6YEDdV","tlshash":"ec42c8a821fe392301d371394f1e6a072532599bc396ad013e5e8b884fe977c46b36c7","size":12737,"data":"","first_seen":"2024-06-28T11:39:26Z","last_seen":"2026-06-07T07:30:11.579799Z","times_seen":12672,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"6681856885ee92601b7711c11d19553f","sha1":"95ab4437869df8c790cad28e0753a4c9ea362e73","sha256":"ce52fd46b2a5cfd741a2f0c39bc2d5218271b5690bdf8ec33af94f1062e98d23","sha512":"5f2a2fe1e899778e0687301ff306fd8c35b869c0675f726653be98393da31fedc388b4d3ed25d7075a0da69656458fc929bb00daf92e1381e19bb49764bea4b5","ssdeep":"192:dvbLsKRfG3Ncq2w30CowkzcDC/L04alCUM:d93d3","tlshash":"1722cb08f1bb1da540b3203c1faff082ae64564b9d89cd02bc4d59c45f09aede971f9a","size":10725,"data":"","first_seen":"2023-04-05T18:30:47Z","last_seen":"2026-06-07T07:30:11.580464Z","times_seen":17284,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"d15a9b513acdcf3e9b08901384511565","sha1":"f1fe72392137895e4952f835c0330f76aacfecdf","sha256":"9fa644edfd9af9be6b244016e8f4f0eaee414732edc6ba3641e8647253359995","sha512":"9bb3e57667fd095c42db5514ac18c9b41baf50b81ded3ff810486ce394e1034751a941fefdb4e0e09bb98613b5dfc0a842d37cd9802671928e5f49380b9eda29","ssdeep":"","tlshash":"b071013cf4fa2228282b6085779b2821a5915427144dfd0cbb1ff3389fe9d25ee566c7","size":3647,"data":"","first_seen":"2023-04-05T18:30:47Z","last_seen":"2026-06-07T07:30:11.581264Z","times_seen":17277,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/float.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"829af863b0cdc4a603919824ae046299","sha1":"1d417b1553e4ecb7125ebf2005b74255291fbf73","sha256":"1dbe4afbc9ed220c08b9e95577b56f83e2e8e0f7620c5dc18266bb325e5bb271","sha512":"e1202fa26fd353dfb2f989d3d45512e0691c062076297399f5fe62f63e7f5b194fec4a3d7fe2f09be1a6a945e197e7d68445d33dcc6f80b23a315112d9ae5b6c","ssdeep":"96:G4SXFXVXDL+R5NxuHie/moRUgIm/Kv3RKXg+Iw3qCNv5IC80b7Yr+HpH:G7xhDL+jNxzeBVLKJ1LeqCwCxb7YspH","tlshash":"04e1506e03b1212195aff1beaf1e424c6631905b2507dd057e0c87c46fa493c4636fee","size":6959,"data":"","first_seen":"2023-03-07T01:14:38Z","last_seen":"2026-06-07T07:30:11.51234Z","times_seen":17483,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/jquery/jquery-1.11.3.min.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"b091a47f6b91e26c93a848092c6f3788","sha1":"52918af2d431e73464060b35d364640c8db75606","sha256":"329ab92b9276ef4e3148f69be6b208969bebdf2db3121a589caa172453fd9f10","sha512":"ab444102be476f0104eeff79c9b596174852b4fe8cbd0b5a0279d56f106a166ec39304636e09326213de000b102ce8f517bb268a9abb2955c56ee4f18b464ea8","ssdeep":"1536:OP10iSi65U/dXXeyhzeBuG+HYE0WEeLDFoNqLTW8+S5VRZIVI6xSb8xh2ZbQnRmS:R+41ZqLTW8xRrqSb8qGH77da98Hr3","tlshash":"6893d8d9b7d67162977730b850bf510bb13a98eab80c4ca0f0a4d8e47d74a89507bf2d","size":95956,"data":"","first_seen":"2023-03-07T01:10:10Z","last_seen":"2026-06-07T07:30:11.536389Z","times_seen":18326,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/lazyload.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"d87854586672bff7f886a47da85da5ed","sha1":"8d0537030dc7a81ade87a41a75fd5a75e4e33da1","sha256":"17859187f895c27de8869fb6bfec579fd68c4588d0af71d08d334be92d144ada","sha512":"d8c3e724f00bcf1ebfe1f8e96dda01243cf22aef18a0fc5a25a42d84458ff58a22a316dabf1d80d1b4f4c28db79edbdf9ba19df755d72f2b0b9f64497137672f","ssdeep":"192:Cdr+EgBD7NiM7B1wV20jSCQrF/bcbe7/bgdCx4RTsmS3KDsS3CggvBSChKRJ0Suk:Cdr+JBDYpV20Ez+obgdsm3ROCJIqSJvG","tlshash":"304200483deb51aba1d3b0f89a5f11447235810b160eee253d6c9395af6093932f2ff9","size":12053,"data":"","first_seen":"2023-08-15T12:01:05Z","last_seen":"2026-06-08T03:51:22.325701Z","times_seen":17244,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/websocket/CometMarathon.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"466a7ed7d00986d45375c0cbffb5233c","sha1":"68845ead668e9abd29c24b491dbf97b219226c08","sha256":"7ddafae5a0a552d2d56101cdc8306403e8fb9570759d66c48b25893b409f0123","sha512":"752801557c12ee7830f1f2e55352ab9c033aff01ff79abdffaee1601c54cdfc85a2041facfc5a7e180706812be5ad08668eada116544197fd2a784bac1903ea0","ssdeep":"192:0Pf+0Sn4NyRSTTPhvygOdWuTdC3d7QPXLHOm8cSCl1Ej3m7YAPzhsoqFncJ0j:0Pf+fnwfcXSaGLj","tlshash":"9e32314b6cf75085592b32b50f9f24447239d8572605e81c7dccaae48f98b6c0b6bfb8","size":11905,"data":"","first_seen":"2023-04-05T18:30:47Z","last_seen":"2026-06-08T03:51:22.324795Z","times_seen":17453,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"d577e19b9de1ba4e3992fc71b967129b","sha1":"a69dc3ecd30a1caf27b16e326017f645ef93e4f8","sha256":"82233dec9ef937e12f6801bcfa10ae743a7d3cb42aa064bb9a9b6c1fe312b975","sha512":"33b46bf37757d82f3473d84823e5017c5e31e119cc56d2691c515c72ed2bdfdd80b83b3f4e8d67e9240bfbbfe7a7f791c2ea023842aaffaf185cb1d173c34d81","ssdeep":"768:QwnrevyruNjfWDLWuGze6S1WtxT8+UMsif4xEVEGFg3v+GW5IXIaIqIYpK:QwnrevCuhf4LWuGze8vI+UMsif4xEVVJ","tlshash":"b923eecd3b3a98107ce2753bb5473268319c9c2bacdd88a8bc5c52291fd066671d62df","size":47838,"data":"","first_seen":"2026-03-03T22:07:02.519382Z","last_seen":"2026-03-10T22:58:05.753543Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"9f5bce1aa50f72fd0834901c70db4f43","sha1":"41771079bee5eb45539e694a5eff580732ab26b0","sha256":"a50724b65a2657f6e67adbf98a3dd135de52b4786350f0b1bd142adff38c7ffd","sha512":"d1445eef1431e8e11779bb3aa9da243cfc04ea0abe4cb9a62b6b0f5940a9ea17ad7d0926a51925feb06ce2afc435ce9050c3955ce973407eebfa4dd1d0ca35af","ssdeep":"192:cyzyMkzf77qsBQXbhG1SUnqpT7H8DvswVAJ4jy7j3vU4P8eaoCrHoQcasI4kHwCW:mMkjq0TqEVAJ184P4DiQzR0KmgqQ2N","tlshash":"599210b876f701b24c667477875a2144e100f0ebb648ee087d4e56dc4fa8a34b3a6fd5","size":19701,"data":"","first_seen":"2023-04-05T18:30:47Z","last_seen":"2026-06-07T07:30:11.582699Z","times_seen":17251,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"edaddb8132e9e0880252c5b6c47bf1c1","sha1":"dc08b5b6ca432b46cca94f1f297491e1b08736ea","sha256":"b98809417c0240085bf70f2a1127f0b622c1514651737e7e4ffac4b39e4da17e","sha512":"00dbcc0a7b89e5e377bc26573fa3b9f1d09267044b3ee1c594e22522f8a17733bf041ebfa09ddb2e70a9f495437933f8a4e42875a16a3221067bf1df558c090b","ssdeep":"","tlshash":"da4000000000000000000000000000000000000300000000300000000f000000000000","size":6,"data":"","first_seen":"2023-03-07T01:14:38Z","last_seen":"2026-06-07T07:30:11.58353Z","times_seen":20356,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"cf0aad09d2e7287c48d72501c4ed8cbd","sha1":"7950b8c00d5a278b662dbccd11af31398a408e51","sha256":"72512199b29d971b5fe854b1f610604dcbdec2c38666c106f1d15863e0df32db","sha512":"2c1680bded9b22be2e6c38d76e46ef67bd438c6c9d99c804f9dcb77ca30bd5aa6f090c89a51205cc7efb466040a171eaa318ffe6fdf046c924394ce7867218f7","ssdeep":"","tlshash":"75d02b4472e3280c08f22b214cde250508a271b610484d08b10ce9d64bb5522b97773c","size":278,"data":"","first_seen":"2023-04-14T20:29:13Z","last_seen":"2026-06-07T07:30:11.57416Z","times_seen":13043,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"9f1681b5a72417b33c2869aab85af152","sha1":"b40a6d9c6d058c2bd6e126a1b0191182926b9d04","sha256":"eabdfd0c5237f406e0acbef879968e72e5e3d62dd8e8b6bcee48e5ab7f4d0154","sha512":"d9190153595e85b071dbf1c92212e7c30a5de2e1d6c4533558bb5f4235d6227c327751799ce20fa50a875a4ceb25227f4eb7d133c3257d8770c1131117d8bda4","ssdeep":"","tlshash":"1631d8d2f3cd01fd42099504248620d9b11dc2394219d48efa9d3c8e73d696e232f32f","size":1761,"data":"","first_seen":"2023-04-05T18:30:47Z","last_seen":"2026-06-07T07:30:11.584253Z","times_seen":17228,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"9c3f7d9e5de3b764c32a679ad06ae3db","sha1":"9ab260e36b46c6ca6f58066ee914f3826d86a37f","sha256":"fefe9a763127c0f92edfe95be1000aeed2eda7690482769c90dc9488dbe5d33a","sha512":"1517bde6929159474692270e256f6021611365d30618b57d1fd325e7170bc7540bac8500e1ccd438d2a3d5f3b6cf1456ba39560d5cbc685f4b56b4c2b4126ad3","ssdeep":"","tlshash":"0e51462618e8c076a31b639d0b9f1141b53c750bc3ac8d357d0d5b758fe451452dabdd","size":2561,"data":"","first_seen":"2023-11-23T15:36:17Z","last_seen":"2026-06-07T07:30:11.584941Z","times_seen":15235,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"a0c069d63e6478f1a1bf072159c40381","sha1":"5979227579a26524b2f53faf3681cfd34e1326ad","sha256":"a3d6301cfd00d9b79ae349d4bb18fe4ccfd497941106882cc7ac8b4ea1b54580","sha512":"f14408593c17b9dfc7f97d9bcf49c54e3ab513cc23260577a74d9f3143457c88307676092fd00a978388c3c74873c787fa74c9939b7c1167d504caaf20fb0853","ssdeep":"768:cPHmhEOPRtPvJdcz4nPVCKJV+3/svMIR0Ky3gYeLLvcOvBea/u+IaAVbaa1aTKOz:C0LqRjIIa4aTuUwlo8/b0vwr90AIC8","tlshash":"36c3c71c75e712a664b330791baf31007072941b690dde04bd5dbac06f98a3da3b67ee","size":127040,"data":"","first_seen":"2026-03-03T22:07:02.524247Z","last_seen":"2026-03-10T22:58:05.759757Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"479c01001c455527cf2aafec087accad","sha1":"230c5d853a00977d890c25cb56b5a07c5e0acd0e","sha256":"0ad2a7081ff475ce3a2068fe69547248166c0fd39f26fbf03f2ac5db073a16cf","sha512":"ebedabe18db451b91ae6cfe4a55712d0401a1cd5545a5b9344edcbb68c7cb678a1a8a6efc20f101d99e8cc094a060bb32deccf9e694a837ee17a8f8585bd43c6","ssdeep":"","tlshash":"1f21233e1c17a1b52ef7046a9b7bd5a63af2051b2442e400bc8cd8193f14fc11c25bde","size":1389,"data":"","first_seen":"2023-08-21T11:10:45Z","last_seen":"2026-06-07T07:30:11.586469Z","times_seen":16887,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"7932637ac9b0a1125acfaeffa837b6af","sha1":"01107a42cef642f68e70ef30502ecb6c0de6a0d6","sha256":"f938651bd7efeb3c523dcca3df1c9a0cc63b12f604816c8e49636fda5b1b1c7e","sha512":"6ee9dd22796803d3a44aaf8a59219dc077e2cf7ebe2b58efe545c7f08028496e595fbea31d2990cc0f210054f6cd91055326484acd544aa29889712c2c050f57","ssdeep":"","tlshash":"bc71315e7559bc949bd3202a4a7f1008727b486f2928c850fa5dcc50af5cf0f2362b9f","size":3486,"data":"","first_seen":"2023-10-24T11:42:08Z","last_seen":"2026-06-07T07:30:11.58824Z","times_seen":15967,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/061410/rcenter/common/js/jquery/plugins/jquery.validate/jquery.validate.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"9c41709c2b64126b909c101a27f39153","sha1":"4ab666b36c092577acb41390ad90e96d5fea7711","sha256":"c1963697eeafb63b6c29e95da2d38d91dd907ab656e130e6e1c34d1dcd149f60","sha512":"f235dccead15199e58495c6faee849c50252b9beed29a04ae46a7a9bdbccfd569a8ab452e7fcf923b7048dfda0c3d7bd51261874642d40e994d1640ca89e330e","ssdeep":"768:u4ygd0iB6d9zYDO5qYT8fwTW3Jny+XiKZNtrt2tG:NB0iB6d9zYDO5qYTMwTW3Jny+jrP","tlshash":"e6c2b7093585102f4ecf30fbb897524f72ba95a45019a069b5fca4d1bef9f8530a6f38","size":27822,"data":"","first_seen":"2023-04-05T18:30:47Z","last_seen":"2026-06-08T03:51:22.340504Z","times_seen":17430,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/layer.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"cb96339625e9d456e32f86cdb3c7a7a1","sha1":"1301165c58bbb13c542cba493b7ab5774e87e31f","sha256":"17fb047ba6828fcbdf2ca226fa4594cfded2b2fdfeaff89a5bd81c7cf0359919","sha512":"53083bf4d6d450b1e9402c3f3dc40fb3434a27d47fbabee51f4ce1d3577f2a0aabe90cf5f6dfc22830a3878ec7552a6bf6bff605c82a4f832c79f34f7657ccef","ssdeep":"384:r1dCih92A3DgrLXSt/SdMrXqE6tGLxzAOTElH0jjhtjfs8:r1YiV3D+WtXItqF13k8","tlshash":"6aa2b76a754034976323906ad11fba0b31f21d24d7078128f22bb4ae1dbcd95a2b7f5f","size":21994,"data":"","first_seen":"2023-04-05T18:30:47Z","last_seen":"2026-06-08T03:51:22.32075Z","times_seen":17442,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/idangerous.swiper.min.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"f15409fb02c527ce1f66a2fd3c4aa0e9","sha1":"1e1e1bcc0f49e99e14ba34991cffe0745178d302","sha256":"1a1b5d3d6fbfc28abe37a668abd59494208c63c5f0b5d040cf4bbbd137f87c27","sha512":"66a384d6ad5fba862e778e24c43326a718328b6f860469fb5eb69c2687b0bbdc3c2dfa9049b0e3d5509214db1dbec4477f5c3654dc04446a505379a4300d4908","ssdeep":"768:oTFZ8CkWyYzh9MTvl7prcAgQW5ppZ+rPPWRqKDyBuq0t:cZiY9uTJuAgQW5LZ+rPPWRLt","tlshash":"5613f8c1b32031a741f3626e91fecb4271f54966aa05d4dcb5ed84c41ab489a03beff9","size":45187,"data":"","first_seen":"2023-08-15T12:01:05Z","last_seen":"2026-06-07T07:30:11.533498Z","times_seen":17303,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"dd4934ec50598a49950c57836d268ba9","sha1":"9830d9f40b0baf411ea1e7b7a4b65675cf35ae04","sha256":"89e8ae92a48e530a676704a7858edcc65fdd1488e39280ba8da4cb80dc5729d5","sha512":"1b7e75147ff199dc7900be58df3ab41039a70322ab2db2d697238b166447a915cefafb3e1cc17377a7ecfc08b641fd9ab51351f060abb405ceed36ee1e5b1b9c","ssdeep":"","tlshash":"c641df0d25ee1008d01729a9fbbbf50c632994272ca4ed08b50dd2154f6ed7ed2b9a9f","size":2036,"data":"","first_seen":"2023-11-22T16:18:01Z","last_seen":"2026-06-07T07:30:11.5897Z","times_seen":15182,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/061410/rcenter/common/static/js/gb.validation.min.js?v=1772438913332","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"a55780dc13cbf1a8d375f14ebb659cf2","sha1":"9548cc269bcde0dc48e166fa6bab37af8a649e57","sha256":"35d147a863ab8828e073ca1ae89d476a9cede797c410ac555597c1f442452cc8","sha512":"3514366118d038da9131739e4557dc5fd92b8b7d3a27af00a7c2d8f4cfd49f4932991cba899fcc8171ac59eb356b25e717494225912f37d65600305ce2d3ace9","ssdeep":"768:WqBveMjZ1oE/eL8hhMjm9a1hI4vhej4pZ:Xpo5GhMjm9a1hI4vheUpZ","tlshash":"cee231166b7701e2916b71e10e4f9a083174952b5a87ce08bdac92e09f18d787373ff8","size":32679,"data":"","first_seen":"2023-04-05T18:30:47Z","last_seen":"2026-06-08T03:51:22.342072Z","times_seen":17750,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/jquery/jquery.super-marquee.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"f77d83590bc0a69298f2fbcc5d9911cd","sha1":"1d6aa25d7052f53ad0181385e5efe72f224bbdb9","sha256":"1d042b9441e860ddcc01b9e9e5e8d354121ee0e31b47f6e18a321e2e633d22e7","sha512":"a39dc6c01df32c8f72842af346f4d67e1278d37a74a0541537b8274b421bcfbc547a2f4844f3c4b6c5cdda4c78f0a8f41171c87ffd149ab52526a95bc6c5bf61","ssdeep":"96:nwzrUsI9/8w/ISEgOGXFRNcrc8PQjc3Pb:+rUsk88OnJQA3D","tlshash":"2991252d7290f5d559cf3c3be02b0b050c785123a54e00927a65def279ba379a607e1f","size":4433,"data":"","first_seen":"2023-03-07T01:14:38Z","last_seen":"2026-06-08T03:51:22.3474Z","times_seen":17508,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/websocket/Comet.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"1008fe6a5e1a182d7775963b85405bb2","sha1":"e174a7b08cc3cb5545af1cd33d2814e604119392","sha256":"7479f6f22194ac37dd6d3f5a579b4682ac8dcb6389fb961cf4140f3fcc707a20","sha512":"26e07821ee1e8e94c4bada028e049df7572cac06f2e8dae958baa7a011eb201a6a1d4ed0cfa15017a3f52a0cb949343de0b33ca6da7c245f763c86d5adfb0223","ssdeep":"192:4Pf+aTbLSru4NyRs8VDv1KygOdWuTyVC3d7QPXLHOm8cSCl1Ej7bY8l7YJIJvO5N:4Pf+aTbe4M2cXzsjDUfj","tlshash":"ab721e4a2cf76086552732b90f5f64543235a8172605e91c7dcca6e08f98b7c1babff8","size":17162,"data":"","first_seen":"2023-04-05T18:30:47Z","last_seen":"2026-06-07T07:30:11.494719Z","times_seen":17452,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/bootstrap-dialog.min.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"5ce8851dc823429a42ab6147554403cc","sha1":"28f381f0e0aa4f5d56690e65723bd97fb59a38e6","sha256":"dd1edf5e54071903c4c1e81e33636444899d645df6b18bad22249da07f91c811","sha512":"f42a4d48c666d9c78fcb6c6061141452899085c504bf15e23749611dda00b6913e75ebbe47ca436a2ed016175d0918f193e474f13974a2f6a5304e18909a87ee","ssdeep":"384:3ai3F3N3VKUINthDa7Vnq86z3JCDKSz1m0hMtkJI2Cg0WEUOv5Dq:T3l3INthDu1YCDKS5flC9m1","tlshash":"6a9261ccb2d9b54c47abe072143f200df03a996951496119bc79e9ebecf060aa077f79","size":20132,"data":"","first_seen":"2023-03-07T01:14:38Z","last_seen":"2026-06-08T03:51:22.346942Z","times_seen":17554,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"d1880ce6f7e86a563b54412066416edc","sha1":"379f66a5c76c995e8255b0f825f2d2ef05d3ab74","sha256":"dadb28dfc6a383dc589a4c01a6db796fab7be6c40b7f7d413a189394ecac0bf1","sha512":"c5764f5080dc814bc985f6c4b26e18684cfe09bd3bb2dadb92e45500f82f583561e31d4b722d43628a014f5bb0c4f97019f91dbf0432d38909e7468e86e2bc49","ssdeep":"","tlshash":"70312f221117907787f2fb12a27f2406c80f878a953c99ee739f9070bb014fd71aaa4d","size":1827,"data":"","first_seen":"2024-07-12T23:08:52Z","last_seen":"2026-06-07T07:30:11.591126Z","times_seen":12357,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"e6ea297058f6d52d83390d9ea7f914aa","sha1":"349df987c3c4c50687d993b31f83cfea7f796730","sha256":"2f21ca2376a9112f70c12ecc46d75ff792b067f5edceae5ea06011c13cf14e56","sha512":"80999dd48f3db744a7cc59dc9cec9303b35216f65d2711891705dbc5dcfb34a18c5c015a2615573aaf59315882c5724ab5dc0e218e8f9cfa2579c4ef37d81cc5","ssdeep":"96:Ge2n8LmEhLzcRXKBxap3cSubfC7WjnM9LidafQa+X9MhsvVQCi:D2n8LmEhAXKfapMSu7C7w2WX988QCi","tlshash":"e0c10e4e72e120b199a7a52c929f901024725403080fdd1dbe4d93a4df89d7fb6ba3ef","size":6025,"data":"","first_seen":"2023-08-02T04:42:13Z","last_seen":"2026-06-07T07:30:11.592514Z","times_seen":17147,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/gui-base.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"e6ce47d880d7a50ddf91b074c8572edf","sha1":"6a3657c67209136e5b544859daecf16f2d153b72","sha256":"c49e04c7ecfd07c74b58cf161ef2b58f2bc837a9091ed1ae090a33734cdaa734","sha512":"0946a1cb9d048b485dadf4056a4aa7be685a8906240a828a5ac776a4e1eae2ed5ef238bd0724da41cce33324357ba44704d34a6766430f1552630f9a17b664f4","ssdeep":"768:+lkflKVlvREcS38xHmuqrRO/5IS3oFaJX+mQdudqD9jAXImsUh8H3yALdODRG4eK:6ClKVlvREcYoHz0PszIfoALkMEY16pB","tlshash":"4353c80a72b130a106efb1b6515f460d323a6927d44ac458b97c9ae43f74f28316bf7e","size":60909,"data":"","first_seen":"2023-08-26T00:19:56Z","last_seen":"2026-06-08T03:51:22.34618Z","times_seen":16698,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"1ccde2639f16107879c4f9fe78d1d7d5","sha1":"703e333aadece9ec3a5375b6a02e96b0cfbb823b","sha256":"ee21b98c285f4f197844a4e17d4acc2f7fe7e41f7c13c28087791d089b980ddd","sha512":"070a169799cdec70139b63b5abe6169cabdf98fed224cfe23698f27f31c71b6e6f62382773871fb4dc1ddb6b710f4e7bcb48169e8874ba5279d2488c03508bb6","ssdeep":"","tlshash":"f0f09e45d67b55a1907364a83b7f20346cee530f910cce68be2c17c26f485250bb479d","size":584,"data":"","first_seen":"2026-03-03T22:07:02.530954Z","last_seen":"2026-03-10T22:58:05.766069Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/061410/rcenter/common/js/gamebox/common/jquery.validate.extend.msites.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"4fe7dadf050dad2dcfd386d21b880281","sha1":"07e7feb8dc9309fe66d86d7a9e27f8efd32ab0bd","sha256":"aa891aafe8e98e1e15d81b2b116e6c3808d0bbbec56cd24818e2e7ac911877c9","sha512":"9da40e5132ece9fe346f27aa467b2496545c84197131c633e5b1ff1f641ece723440ec0289e82d7948b85bcd901b9e3eb6e36f8e0339ae05e4a32621e895accf","ssdeep":"384:yC+tJn9Dbvbf1P3QSBxDrdiewZnnoTW39if+04xSlR4nbiamdrjNfrzInGINYlor:NWJnlN3QSBxDMewZnnoTW39L0MSR4biK","tlshash":"a762954d3a9514bb4adf31b770ab204f767e8800852c91c4bdbca0d166b5ee072e7e6d","size":14857,"data":"","first_seen":"2023-03-07T01:14:38Z","last_seen":"2026-06-08T03:51:22.328454Z","times_seen":17500,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"c2c998d7ca2764a732999f41912e334a","sha1":"d9a0b0c2747579bcd56fb57824458355bc92de08","sha256":"cf45d13769cbd70c78e6b136444c6c2c95c57243a42ebe92c5139b79d96b0070","sha512":"c2bf78c3517531e64a27f0700af855a8fcb8b55b060258d6ae0599effaa91492fdadf709998e89fb7434e41b22c9a284e531b636e6a9a0185a7fd5d626443e5f","ssdeep":"","tlshash":"b321bb08f3a8106878f72579987c31d442240183cc4ac8b5f97de5b14fe42987643e6a","size":1268,"data":"","first_seen":"2024-07-04T08:35:13Z","last_seen":"2026-06-06T23:55:15.813284Z","times_seen":696,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"9874913519398714a17ed34a481d8c17","sha1":"a0c912639cc3ec5c885308d523b668d1fd5061b6","sha256":"1376b927e5a8cb5bb265cb8681082e55fa62252a6d4996ad20da6e6b6c50cd72","sha512":"b4bc76aeb3f4aa7bdfaf044202d01aa5926382ae3f33ce545ca57eff9386b5180e8e7c5e5468f5582c3102ac2bf08d6e6083da85a0f945cb0ee5f66e7fe51f9f","ssdeep":"192:XMyuljaGmxfqnPVrHIfeaw1YP+U5mEPmCQp8er9wg23fk+rsFTGTXFP/T3m5tTG2:8yuJajx2KlJlp94f","tlshash":"83f1ce2165439497405251816eaf2500c78d62f3cd17e0d8fb5f4aa8fffb6ce2a23749","size":7794,"data":"","first_seen":"2024-08-29T18:11:34.925387Z","last_seen":"2026-03-10T22:58:05.767956Z","times_seen":22,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"fdbeb368d98d7a8ddbaf17f5d36998f5","sha1":"6f2639e563be4ca4c8c901379a7282242fb0a714","sha256":"77d0161c91e8906df555610f5eacd396fc43c3ddd502c63e29eb2dfd3e0224ac","sha512":"543943c429b1cac557550f2f32542ecb25832a55319b8b03ab488beff4fa7c3f00f481711b6f5fc898de412e1cacbd3c292781532e02ba6f547d55449e694b2f","ssdeep":"","tlshash":"0251d20835a811aa28a3307a5cbf61c8157252378758dd14788e3540cf98da93a7b7fa","size":2764,"data":"","first_seen":"2024-08-29T18:11:34.926958Z","last_seen":"2026-03-10T22:58:05.768838Z","times_seen":22,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/themes/gui-skin-default.css","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.067Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/themes/gui-skin-default.css HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Tue, 11 Jul 2023 08:40:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"64ad1569-7b6e\"\r\nDate: Thu, 26 Feb 2026 22:28:03 GMT\r\nContent-Type: text/css\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Sun, 01 Mar 2026 22:28:03 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 253\r\nContent-Length: 6253\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 954254298470391220\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":31598,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (7014)","md5":"1d6c464e8e5800ca483689206174ec6e","sha1":"d5ff05232c516152a711ec5c6d060a2f2cc791e3","sha256":"08d29322d883091252b3348e9514dac589896516374e8a319fd1190dd67f8e30","sha512":"4e259baddb36f5a8894c26f0f50c453200cb738c5e9d8131e146288a0d25ed3d4dd42f173392f8dbae521fd8344425b2b6e1ade92bd08edf7ab010cb577f775e","ssdeep":"384:/FboUEeh9ScJRfc0uGWw8Ms4N4muQh8v8brn8w/NtSmdz:/FbPSVGmNQjLPFtSi","tlshash":"7be29834f20022a9b563c7a570d1dd4a362de592d2170ebdf26b319c8f425ce263bb6c","first_seen":"2025-04-07T03:18:03.900415Z","last_seen":"2026-06-08T11:55:33.439999Z","times_seen":10718,"resource_available":false,"data":null}},"time_used":4686,"timings":{"blocked":2200,"dns":1561,"connect":271,"send":0,"wait":277,"receive":1,"ssl":374},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/message_zh_CN.js?v=1772438913332","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.109Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ong3589.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 15 Feb 2026 17:36:53 GMT","end":"Sat, 16 May 2026 17:36:52 GMT"},"fingerprint":{"sha1":"D1:0F:86:D0:08:A4:EE:0F:52:A3:3A:D7:FC:F2:E8:89:8B:5C:11:07","sha256":"96:F3:97:A9:8E:8D:98:27:50:DA:C4:B7:D6:B3:F8:FB:B6:20:E3:8C:37:23:42:97:5B:24:BB:39:D5:0B:49:BD"}}},"request":{"raw":"GET /message_zh_CN.js?v=1772438913332 HTTP/1.1\r\nHost: ong3589.com:8989\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\ncache-control: max-age=259200\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript;charset=UTF-8\r\ndate: Wed, 04 Mar 2026 12:49:10 GMT\r\nexpires: Sat, 07 Mar 2026 12:49:10 GMT\r\nout-line: gb-cdn-014\r\nuuid: 07285-01-00000000-1772628550a192\r\nvary: Accept-Encoding\r\nx-cache: HIT\r\nx-frame-options: SAMEORIGIN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":33499,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"Unicode text, UTF-8 text, with very long lines (15759), with LF, NEL line terminators","md5":"5e29a736bb07482814f4fb40f94618e3","sha1":"95031dd994aa15757b741e35e8165e6e54b396e6","sha256":"9cc0606e9e078be2bd4a7f0128364ad8a989ba363258d3d6058d8cf79b1fd3a8","sha512":"6df469c4d40670119fc0071f8339fc104ef3f9b8e96608462fb533295ae361da6c177d7d67a3ea50bb2da87e8c27cab6f4a54019f8feb61c5a846350d315c8c8","ssdeep":"768:IIy92nyfB+vODR01IRBG3Jpf3OEg7/wiwL38:Ib9BB+vF1IRBG/Op","tlshash":"05f24c8746fecbf68a4a0af99c5301ae22b557c8c9ec79147f90ddd92b457c900a7383","first_seen":"2026-01-15T08:15:21.544222Z","last_seen":"2026-06-07T07:30:11.553837Z","times_seen":6773,"resource_available":false,"data":null}},"time_used":313,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":313,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"ong3589.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/index/getUserTimeZoneDate.html?t=mmc19unn","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:14.893Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ong3589.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 15 Feb 2026 17:36:53 GMT","end":"Sat, 16 May 2026 17:36:52 GMT"},"fingerprint":{"sha1":"D1:0F:86:D0:08:A4:EE:0F:52:A3:3A:D7:FC:F2:E8:89:8B:5C:11:07","sha256":"96:F3:97:A9:8E:8D:98:27:50:DA:C4:B7:D6:B3:F8:FB:B6:20:E3:8C:37:23:42:97:5B:24:BB:39:D5:0B:49:BD"}}},"request":{"raw":"GET /index/getUserTimeZoneDate.html?t=mmc19unn HTTP/1.1\r\nHost: ong3589.com:8989\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nCookie: sticket=VPV1ExTFRZeFpEQXp\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncachettl: 3\r\ncontent-disposition: inline;filename=f.txt\r\ncontent-encoding: br\r\ncontent-type: text/html;charset=utf-8\r\ndate: Wed, 04 Mar 2026 12:49:15 GMT\r\nout-line: gb-cdn-014\r\nset-cookie: route=44d17259ab44b1b54887077d522d7137; Path=/\r\nsub-sys: msite\r\nuuid: 07285-01-00000000-177262855488f8\r\nvary: Accept-Encoding\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 99\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":119,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"JSON text data","md5":"1cb5041eb5bd688991a02b816e33d43c","sha1":"6eb0e2ed5cf2d07c1a8a2e48f3057ce30530f6ef","sha256":"89fe2c094dd7178fb5e7ac6f7aedf386a7dd9457be610438a304f9aebdc1ec2e","sha512":"df64785e68c99d35c1d5ff19a25cb4f11494b219871d2cb98e71099635b0ffe6c6bf41a8eb2f9a5a3e09d10fb0aba04b603e9c4abc5208de25cfcdb5468684a3","ssdeep":"","tlshash":"00b0926482e26e5e0a2440e1ca85f5c91da6a15b48c3c9102aa79e1ca89da995808623","first_seen":"2026-03-04T12:49:49.155257Z","last_seen":"2026-03-04T12:49:49.155257Z","times_seen":1,"resource_available":false,"data":null}},"time_used":232,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":232,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"ong3589.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/mobile-api/v5/origin/loginSwitchCheck.html","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.523Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ong3589.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 15 Feb 2026 17:36:53 GMT","end":"Sat, 16 May 2026 17:36:52 GMT"},"fingerprint":{"sha1":"D1:0F:86:D0:08:A4:EE:0F:52:A3:3A:D7:FC:F2:E8:89:8B:5C:11:07","sha256":"96:F3:97:A9:8E:8D:98:27:50:DA:C4:B7:D6:B3:F8:FB:B6:20:E3:8C:37:23:42:97:5B:24:BB:39:D5:0B:49:BD"}}},"request":{"raw":"GET /mobile-api/v5/origin/loginSwitchCheck.html HTTP/1.1\r\nHost: ong3589.com:8989\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nCookie: sticket=VPV1ExTFRZeFpEQXp; route=44d17259ab44b1b54887077d522d7137\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-headers: Content-Type,Access-Token,X-Requested-With\r\naccess-control-allow-methods: *\r\naccess-control-max-age: 3600\r\ncontent-disposition: inline;filename=f.txt\r\ncontent-encoding: br\r\ncontent-type: text/html;charset=utf-8\r\ndate: Wed, 04 Mar 2026 12:49:15 GMT\r\nout-line: gb-cdn-014\r\nset-cookie: route=4bf55577ceef236451cccfe77519a18d; Path=/\r\nsub-sys: mobile\r\nuuid: 07285-01-00000000-1772628555235b\r\nvary: Accept-Encoding\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 113\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":174,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"JSON text data","md5":"1452cebf3e2bb129b06762f43f09e5c8","sha1":"0ec65f1e79233e8c59f76c55fb89ac8637cfb070","sha256":"99a31cd18b8ce37d3725d0a77d5e314452d2906ed2b54b8b19d4de849d1bf13d","sha512":"758e5238156c2ffef164019c0090d96ae3567b56cdb9180b179f9f20dbefa3d184a9b0776e96d10667ecc0bef04ebccad0959b1eecbf5526077c096e22cfe919","ssdeep":"","tlshash":"b6c08c49f00458abce02239456d828402fec189270c9eccddc0c4a58f2cb4dfe322c2b","first_seen":"2023-04-05T18:30:47Z","last_seen":"2026-06-07T07:30:11.558795Z","times_seen":15814,"resource_available":false,"data":null}},"time_used":227,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":227,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"ong3589.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/chess/ly-img.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.891Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/chess/ly-img.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-28bc7\"\r\nDate: Tue, 03 Feb 2026 09:45:38 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:38 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1265\r\nContent-Length: 115552\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 12515025010677081636\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":166855,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"2eb8320318e63185f06b87b10c308f6b","sha1":"a4c7e70d940f7410e2b0b87c8037586bf03c51a5","sha256":"cda44bd60f71ab3ed4a36301e2028bd6a39484ef795df81ae316e90f5462ac38","sha512":"bfd2ca625da13d8257090d566a72082d235e3171f95aaa31f58c7e52f493fd817662ca9b549780c4d17867a9dff56a25bd98653485ca9f1eed8a18da51ed2996","ssdeep":"3072:7fOl/f7wRBke2uu4C8dWf5KWBS5kwvzjkZcgzR4y9QNfaHmjO5USmf30fSR:bOlH7wRd2/4fGKp5tbjkZcgzeyqNfOm5","tlshash":"f3f301b32c977fa10b6f8531d1ee6ee94f2d1fb70c029a11a01815d101db74adad699c","first_seen":"2024-08-29T18:11:34.798977Z","last_seen":"2026-03-10T22:58:05.723262Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2827,"timings":{"blocked":2506,"dns":0,"connect":0,"send":0,"wait":288,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/chess/cq-img.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.908Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/chess/cq-img.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-2cd45\"\r\nDate: Tue, 03 Feb 2026 09:45:38 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:38 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13950\r\nContent-Length: 133630\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 11104624676506019000\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":183621,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"63833a59c5946e1647aaa37c9e7d97a0","sha1":"d94f38797d28e0d5527d92cbdc2d82a5344c490e","sha256":"17e0c080d1d4a3f26fa9834757a3ac8f6090c6fc24780333e77ea2c91c66bcc3","sha512":"57c47186a6eea016f235f169d340e4ed2f1b4a363562d25ff2b2c246e5fae11634c751e26337b65acb7763cd3df4de518a4239d6794b5e174d4c8217da436668","ssdeep":"3072:7xhek4cn3Ppq+ES16+zYnOujiG8MF6QnT2k/zIQztPeoFZwZXyZYeOhfhsR:ZBjElBO7G8McUXsQxPeo8XyueO1h2","tlshash":"af0412332f42ffd70f01d14679deb4c02d9d6b974a4e09892a1e77c675eb90289e2888","first_seen":"2024-08-29T18:11:34.804015Z","last_seen":"2026-03-10T22:58:05.704005Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3000,"timings":{"blocked":2704,"dns":0,"connect":0,"send":0,"wait":262,"receive":34,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/lives/xbb.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.947Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/lives/xbb.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-102c5\"\r\nDate: Tue, 03 Feb 2026 09:45:41 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:41 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13961\r\nContent-Length: 49516\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5029266382740910779\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":66245,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"870a21ebf4f89d44802d1d4ad97a8a6c","sha1":"0b3b8ed58c4b034afda686b4be2a4d0892291c54","sha256":"379de2361ba5bc0a0220706a73ab5d41f15fafdc6c634bb6aa9849572ccf5d47","sha512":"4b742b31587977d6c806d55a3d7f130553eab23f72ef01088f984ff3b3110a63bc7ead7567c66b8f083044f958e0c68de74a6a8ea854f8d5ca73e532840ef466","ssdeep":"1536:42g37NK43OH8eehTORFT4PbQkmV+JhAcl7CXTU0w:u73fpODT4Xk+3zZCXTU0w","tlshash":"49530139c0714cad849ebc1b555a79f9776cf2a0885e48ef2058bff2d824b92889f570","first_seen":"2024-08-29T18:11:34.82265Z","last_seen":"2026-03-10T22:58:05.720407Z","times_seen":22,"resource_available":false,"data":null}},"time_used":4602,"timings":{"blocked":4332,"dns":0,"connect":0,"send":0,"wait":268,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/images/qq.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.384Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/images/qq.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nEtag: \"6673fb50-384\"\r\nDate: Tue, 03 Feb 2026 09:45:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:55 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12244\r\nContent-Length: 900\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 7287015681540366494\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":900,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"018d8070aa19a83a4d0f5ee55aa1da2c","sha1":"6fb83ad47520b92a2ff45b89f4f0f7b715060591","sha256":"ac40bbdd19aea1ecd6a12ab4f4142ea96fc14893c56293f3146beb6f31c385d4","sha512":"a559275177393e69871109cec9b4e7ad76aea6d0bd2b0fdf7823c55dd01c11889e4232e59bf88966b4aebdca07156738a366bfd8eb9e977e1bb7ff7399fab596","ssdeep":"","tlshash":"201163b6b693783310c0d98d4b4e90213fe277391a1881142f8918217cb7b01cccced2","first_seen":"2024-08-29T18:11:34.841893Z","last_seen":"2026-03-10T22:58:05.705482Z","times_seen":22,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":283,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/websocket/PopUp.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.107Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/js/websocket/PopUp.js HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 21 Apr 2022 04:30:12 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6260ddd4-828\"\r\nDate: Sat, 07 Feb 2026 21:09:08 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Tue, 10 Feb 2026 21:09:08 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 254\r\nContent-Length: 797\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 17736217304646733517\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2088,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text","md5":"07864ad2e2759d53f8f2f14dd4295bd9","sha1":"95144219e2eb702c4c4a707c3622b086876cf41c","sha256":"871bf30791bb89605b61cea815c3786246274b65ede3b8a8b8c2dd9244cfa89d","sha512":"f469d0f23c75e918d55e076d72481fca7043ac5eff9025aaac1f26860d080e4fc3c5d28f8f9ee1dae80719aca2b83f39ea82a129c221980bd7d63c212bacc119","ssdeep":"","tlshash":"9041ae54baf359a12c9b71f3aaaf30413160f2479505ed017d0cb9945f1d228b2cf7e9","first_seen":"2023-03-07T01:14:38Z","last_seen":"2026-06-08T03:51:22.33842Z","times_seen":17520,"resource_available":true,"data":null}},"time_used":3128,"timings":{"blocked":2850,"dns":0,"connect":0,"send":0,"wait":278,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/language/language-vi_VN.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.852Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/language/language-vi_VN.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-7e7\"\r\nDate: Tue, 03 Feb 2026 09:45:38 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:38 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12240\r\nContent-Length: 1428\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 17001127033336855047\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2023,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"3d5eee7726266b36e35da0cd9816ccc8","sha1":"e1a24829929dba71a23b55170eaa180e94747263","sha256":"0f5c6e47bf158fd5177856fd3542a45705c1caea18a96042913718d0f07a419a","sha512":"b7a46206595874106df181e1e47d2bd8dc52302264f85e7a44f6abe75177b8c8ddfbd60375350529eb0e4b496631b1c8836649f314901a57409e4d6ef94eaf86","ssdeep":"","tlshash":"27416c3f2b91b60ff071a2b89553227f3c1e0dcf057a233e882896622d197308340c5d","first_seen":"2023-04-16T16:45:37Z","last_seen":"2026-06-07T07:30:11.571319Z","times_seen":5821,"resource_available":false,"data":null}},"time_used":2056,"timings":{"blocked":1741,"dns":0,"connect":0,"send":0,"wait":314,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/chess/p-ky-img.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.884Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/chess/p-ky-img.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-45089\"\r\nDate: Thu, 05 Feb 2026 03:05:36 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Sun, 08 Feb 2026 03:05:36 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12241\r\nContent-Length: 202354\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 3408154829911655588\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":282761,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"62ef8e3a0da4d0166f91ad75ff011685","sha1":"216b39c39828545e4ba45c16a0914f1259a31ded","sha256":"fd9211e3bd48caf8a8b427a1bae087fa0c473eb53631dbbecb6c279a4b184920","sha512":"faab43a05d696a3cc5b4065238b14fe15afbdb3c7c864ba256aac5f803b07afe2accaa9a694d8cfb6d6acb69a28c1241f3dd175352c3fddb8e826f92022df6ed","ssdeep":"6144:0FPusEDdrlyG1pvYS6ECT+cTuMSCkrIlQpCh3QLPiKAra:0cs6QG1pAbE9cTuMvkCh3APiKz","tlshash":"15541273bd9b9d4baf54c2497ace31f69ccc0f836e094d29c9ea71d41855b01cbe2928","first_seen":"2024-08-29T18:11:34.797971Z","last_seen":"2026-03-10T22:58:05.639988Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2657,"timings":{"blocked":2332,"dns":0,"connect":0,"send":0,"wait":317,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/chess/qly-img.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.889Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/chess/qly-img.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-125d9\"\r\nDate: Tue, 03 Feb 2026 09:45:38 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:38 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12241\r\nContent-Length: 51879\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 8729136545313668560\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":75225,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"6a4cc4ba7b85b5e08217ad6c4e87b7c0","sha1":"94495c2abec380fdb40cbcfd1357a8368749ad58","sha256":"b038775285d604251c35eae1fb6efba1190c3ecfd917d2c7d42f10c52409fbba","sha512":"d79534f2c216f778b7cb0bc13d241b660d4588368554ae1689dc30bb4cb80055c8edbe8af66e4aae4f5273bf91e5d28ae21f2ec1620a8cb9c6cffa99e1fb3c39","ssdeep":"1536:d2/D8h88lqlxlYKLLi7Di3FDfx4mZI101HBqfImiy4e34gtTb:wwyOqT14i15tue7miLu1b","tlshash":"f573e177ae937e410f318b1a95cea6eb1d0e7fa3fa1884d4a5583ce010d972345d8e39","first_seen":"2024-08-29T18:11:34.795068Z","last_seen":"2026-03-10T22:58:05.646193Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2723,"timings":{"blocked":2448,"dns":0,"connect":0,"send":0,"wait":266,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/carousel/10164/1770986830251.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.949Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/carousel/10164/1770986830251.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Fri, 13 Feb 2026 12:47:10 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"698f1d4e-2ab91\"\r\nDate: Fri, 13 Feb 2026 13:08:01 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Mon, 16 Feb 2026 13:08:01 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12244\r\nContent-Length: 132528\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 6481747822647882885\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":174993,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"b4c9fe613b80d990ed7b15a62c894150","sha1":"9d00a53601ca2d409e9f738b56b98b8052cfaa78","sha256":"9af3b23f2a63eb5f3572a5df11458a76f9259b8b06fbbad47854b6171e2b6fd0","sha512":"b4d9d6e03e984fab699f0f8ba99d69723c997b26da36002cea59c9ae8394793d32c42ecbf98ee6154da99332a40b6675162ef4e68b0816884c1e0d933845a20c","ssdeep":"3072:WseG/Lbhv/gMnG83mMZ5/gfo/MJpYdKfuU8YNZ2U0560ObUE:kmgMG83mM0bJpY8fuU8zX60ObUE","tlshash":"bc04123a15997a312ff0c5379e7b3ea5ae3065d8e210920795f850d86b1ddcf3e230a6","first_seen":"2026-03-03T22:07:02.482202Z","last_seen":"2026-03-10T22:58:05.704655Z","times_seen":9,"resource_available":false,"data":null}},"time_used":4653,"timings":{"blocked":4416,"dns":0,"connect":0,"send":0,"wait":233,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/floatImage/233/1709812337078.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.541Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/floatImage/233/1709812337078.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 07 Mar 2024 11:52:17 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"65e9aa71-13031\"\r\nDate: Tue, 03 Feb 2026 09:45:41 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Feb 2026 09:45:41 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12246\r\nContent-Length: 58832\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 15660183367631026534\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":77873,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"0ca4810f65317db4d064e8aea0b5ccb6","sha1":"fcdadef81dc66466f6280ca79a2f89ab43dbabc0","sha256":"52e91ff729a0b1cceb41bf48d42427172d36b33c80740b98ebe2c61f5ba44260","sha512":"0d849dccf46cdee2fa54c204d7a4c3593f92b99d388724d4bcc21d3a12fad0ddf6b20d557c7bbe2e9a9227f5b1e4cb9f8328cc3adfcca489c04cc97cf6e37c25","ssdeep":"1536:bMDpPPyGfAuB+7lWILRvEdDBQ9epX274ldvq2VsI+Pop:IHyGf8lWuRvoBVm74+lw","tlshash":"f17312ebfb0a0f8f4c24a0753d4358bc2d476cac9ac07a83c49d59dc2d449d626ab557","first_seen":"2024-08-29T18:11:34.88009Z","last_seen":"2026-03-10T22:58:05.716779Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3477,"timings":{"blocked":3145,"dns":0,"connect":0,"send":0,"wait":330,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/carousel/10110/1715595992954.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:23.867Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/carousel/10110/1715595992954.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Mon, 13 May 2024 10:26:32 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6641ead8-b15cd\"\r\nDate: Tue, 03 Feb 2026 09:46:34 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Feb 2026 09:46:34 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 5195\r\nContent-Length: 548035\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 2270819664665401841\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":726477,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"a050d76731191d91c260258d37c13c8d","sha1":"33952b414cc836bc51000eaff683643b68706ae9","sha256":"7c0cc599496e0169604b87ccf7df84f12c71a05b91b96849bf0a3f68d4dfe438","sha512":"00c36c605651b5de5b1ddbeac664342eb77bcf9cdcdafdab47ae3a1037b7f35769a329bc1fd8b2612f6675a18815fda91209559bed5b276bab61732e6f40ebf5","ssdeep":"12288:Ras5js7KrrIGTWk/g7uyDyiXwNoUrg11pjSk0foNy3/9J50S5Priee6rAM4xNVPC:R/ts+UDbQF5MuPuur26cPVPC","tlshash":"d5f42374ad839e604f64c72770793f371f70cec728c85bd5879caad150c6291caa786a","first_seen":"2024-08-29T18:11:34.834774Z","last_seen":"2026-03-10T22:58:05.662302Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1161,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":306,"receive":855,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/language/language-zh_CN.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.842Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/language/language-zh_CN.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-7d2\"\r\nDate: Tue, 03 Feb 2026 09:43:50 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:50 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12239\r\nContent-Length: 1408\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 16392415927729700257\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2002,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"acb0023f8ae926ffbfce1ce7a486ada5","sha1":"38957d4c98b63fb887eedadf574cf2a3865846b3","sha256":"16a91990d7d8f863e9026abde2f29b64705da2e87a4a3ffc035b127e26caa586","sha512":"afcba2198b038f7e892bf764d762d5d744e9fba27898dcd760948f23e513bbd770cd9f79132457d3826684479db6d50109625230d0474e5c9d363b9227839ca6","ssdeep":"","tlshash":"5a410c3e66d67e0e0820c614d7eab52b393d8ece68121a7d84dc1a8b9519f315100c8e","first_seen":"2023-04-16T16:45:37Z","last_seen":"2026-06-07T07:30:11.520782Z","times_seen":5826,"resource_available":false,"data":null}},"time_used":245,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":245,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/hot.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.880Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/hot.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-781\"\r\nDate: Tue, 03 Feb 2026 09:45:38 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:38 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12241\r\nContent-Length: 1245\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5056664325697800922\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1921,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"081943375d1dd5575c9b2864749a2882","sha1":"5f2a6a412e0594c2e16f2f7010f17d122cc0042d","sha256":"47b0fe6fba430f6538eba8f6ba1e60fa4bf1622ea72ac9fc8eaa06679def3e49","sha512":"d327668c19ef65b8bc0c4ce82afc21ed6bd4db30f723b9ebfa991ff365c1362e38074fe2c2a36c0cd8da8bbc9ee9ecf99f0dc4bbb1159b68588a09ba3a4d96e1","ssdeep":"","tlshash":"8541db7d5327335e6825cd1899ecb8181f58dc171e2b1f9ec53b3312058b77541585d6","first_seen":"2023-10-16T02:24:16Z","last_seen":"2026-06-04T13:13:28.791423Z","times_seen":824,"resource_available":false,"data":null}},"time_used":2515,"timings":{"blocked":2205,"dns":0,"connect":0,"send":0,"wait":310,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/chess/sd-img.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.899Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/chess/sd-img.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-1d836\"\r\nDate: Tue, 03 Feb 2026 09:43:51 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:51 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12241\r\nContent-Length: 75298\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 11985470490931731308\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":120886,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"13209dab6b0f66a0e0b2fe8a17c78aa3","sha1":"01ea7ad6efb22834a59617964ce14d46ec188c68","sha256":"d8109912cbfab034f6bb3ba67535d3ae35f135e542727e994cdcfe4fcf96b15c","sha512":"546c4511b94ec9aef21e1e0c46919fcbbda19abe8544f135db074df47fa5d6921a8166927a00e5a1efe1327d0432edf287099b48586c07f96c1ba0b0dcefdb65","ssdeep":"3072:EogUKnFba/1iAQpvLOVlgBVMGjYdOUicF+:3gUeg1iAqvwgBVRWOUy","tlshash":"bfc3b0ba1c566e17bfb0070428cc7de49ebd2bfb5c09fa63d49934e814486aa16c45fc","first_seen":"2024-08-29T18:11:34.800144Z","last_seen":"2026-03-10T22:58:05.722599Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2858,"timings":{"blocked":2613,"dns":0,"connect":0,"send":0,"wait":229,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/zh_CN/pubads/images/ads2.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.395Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/zh_CN/pubads/images/ads2.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Mon, 01 Jul 2024 10:00:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"66827e29-6655\"\r\nDate: Tue, 03 Feb 2026 09:45:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:32 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12244\r\nContent-Length: 19812\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5068458063427514791\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":26197,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"134cab569b32d8e806132a4a16de2f4f","sha1":"84bf6e92d2d6d7c9d280e251095589bddbff41ad","sha256":"a1f9fa4a21d84a44696634d64020a8517e2f63858fd460e4717aa9a54acbb410","sha512":"4f0b40c8c6affef43e31772d681245ee4862ac5efd86f12eb89272ceee764ab9cbb7a09e42903df1a9d0abf67298e9fbaebbeb86e2cece25eeb22f7c3c1237b8","ssdeep":"768:Wyek0+Drh5jUQpp6u3i7F6Jc68hTzT42Nda:WyekN5vY9UJcrTz02e","tlshash":"51c2e15f778922be3b0e0523bd51bd2682995f2370a218a5a4df623545b283081ef8e5","first_seen":"2024-07-09T10:27:14Z","last_seen":"2026-06-06T16:12:48.004579Z","times_seen":792,"resource_available":false,"data":null}},"time_used":550,"timings":{"blocked":247,"dns":0,"connect":0,"send":0,"wait":302,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/xiao.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.506Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/xiao.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-24ef\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13947\r\nContent-Length: 7193\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 12950076823127243729\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":9455,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"a19b1e8df8cccf07256d2ade6c26ddf6","sha1":"3490cd33b91e3482f732dd91402503aa28353f7f","sha256":"58ffad04bcdcc35be398974450a158f46825a403aff5d329bc99b60ee36d4a2f","sha512":"ecae134ab163db7dad5aa853538acc3f26e76dc4fc259168b7cf87befc3a520a1c2d07c4e39fe8e72bfc7a7d5ec2c0acfe9d4a813faa5b4fab81da447ca5ff0f","ssdeep":"192:9Wb7xxT2v2l1CczaykZEOBEiozqLvBy50zoxmOIs6UOPLvXocXyaP1T:9c7XT6Y1ysOeiozcvY50zCPIsJIjYcXz","tlshash":"d912c0c833e3e24c7c24bd8032d9e297998882ad8d39acf7675d954cc8758b4f1311c0","first_seen":"2024-08-29T18:11:34.86183Z","last_seen":"2026-03-10T22:58:05.617289Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2372,"timings":{"blocked":2025,"dns":0,"connect":0,"send":0,"wait":347,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/xiao.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.507Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/xiao.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-24ef\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13947\r\nContent-Length: 7193\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5002028704708870546\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":9455,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"a19b1e8df8cccf07256d2ade6c26ddf6","sha1":"3490cd33b91e3482f732dd91402503aa28353f7f","sha256":"58ffad04bcdcc35be398974450a158f46825a403aff5d329bc99b60ee36d4a2f","sha512":"ecae134ab163db7dad5aa853538acc3f26e76dc4fc259168b7cf87befc3a520a1c2d07c4e39fe8e72bfc7a7d5ec2c0acfe9d4a813faa5b4fab81da447ca5ff0f","ssdeep":"192:9Wb7xxT2v2l1CczaykZEOBEiozqLvBy50zoxmOIs6UOPLvXocXyaP1T:9c7XT6Y1ysOeiozcvY50zCPIsJIjYcXz","tlshash":"d912c0c833e3e24c7c24bd8032d9e297998882ad8d39acf7675d954cc8758b4f1311c0","first_seen":"2024-08-29T18:11:34.86183Z","last_seen":"2026-03-10T22:58:05.617289Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2365,"timings":{"blocked":2128,"dns":0,"connect":0,"send":0,"wait":237,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/floatImage/232/1709812274292.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.536Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/floatImage/232/1709812274292.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 07 Mar 2024 11:51:14 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"65e9aa32-31d1\"\r\nDate: Tue, 03 Feb 2026 09:45:41 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Feb 2026 09:45:41 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12246\r\nContent-Length: 9546\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 15081374019586784468\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":12753,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (12753), with no line terminators","md5":"10125361a47034d09d2aad80c51ffb6d","sha1":"09fa1ca65b6e934135ce94244a819c38ab0c052c","sha256":"dc82f370130534437dc993f2d56f47da6d866f7892d92db4d4c58d40b34dc98e","sha512":"d3e46153933c9f6b6d1ee1d3f206e17d3ab57a3ebe187b9775294b07558d064f1b1fcbcd9bd1eaec5eaaf386351f9aec949589e211df6f0415d44106b526d236","ssdeep":"384:IQgMg58ywVi/m91PKkH/5iNUF7Frlron0thpw60xH0YnM:QMg58RyhN6xrlrjhiLU6M","tlshash":"7542d07b0525667551c39cb42c74383e72e5abca5a9363bb8da023f7574bfb6c10c488","first_seen":"2024-08-29T18:11:34.871618Z","last_seen":"2026-03-10T22:58:05.699177Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3069,"timings":{"blocked":2817,"dns":0,"connect":0,"send":0,"wait":252,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/floatImage/233/1709812337282.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.542Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/floatImage/233/1709812337282.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 07 Mar 2024 11:52:17 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"65e9aa71-2e71\"\r\nDate: Tue, 03 Feb 2026 09:45:41 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Feb 2026 09:45:41 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13974\r\nContent-Length: 8894\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 14062254119083237976\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":11889,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (11889), with no line terminators","md5":"b4c66fe144b7021975bff666c7dd9005","sha1":"ef602951dd9ecbbcb7480d8fc6ca1db688576bc3","sha256":"ceeed9d839ae9e33fae38cdda352f33c98dd87b090ae27f0d3b3b494cf57a14e","sha512":"adbc81986881ed0addca16b78674cce1d6cc80ce621b8cf51551dbf73c66d27bb9aff0a163247de123e3d49861285a9b708d5bc5b1f0ffd5f06200b93d4b700f","ssdeep":"192:Z1Qg2guESsxnPFvvNpADTW5kDcOrHonWLtQ9UYUF/ZAOqNo7G7SKFly2X:rQg2gUsxPFvvN6MkDcHWLt4UVZXRDA4y","tlshash":"9632c096730c574dacd0c2ac1c7358963f0f9a5954093bb432e96f9b1b10ff2904b17a","first_seen":"2024-08-29T18:11:34.878978Z","last_seen":"2026-03-10T22:58:05.629705Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3451,"timings":{"blocked":3185,"dns":0,"connect":0,"send":0,"wait":266,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/chess/fg-img.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.902Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/chess/fg-img.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-d600\"\r\nDate: Tue, 03 Feb 2026 09:45:38 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:38 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12241\r\nContent-Length: 40152\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 11108859804167931283\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":54784,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"ad5c31873716357e98df24c58e55a07e","sha1":"5f890e8b822aa6c591cebb6d4f493060eaa7c755","sha256":"d5579465bc21ebd52bcb1a023cfd9d9e93e5f7d6e8e03b243904dccf729585d2","sha512":"9b56353be938d5e8711f87df99c4409223e19bdda3c57fa40ced8a8eb7ceffc3474b4f5df857a664e99eb2f1ca582132d16eaa45b181dfbc7a543ae068262841","ssdeep":"1536:hQpRokaW6tg2mwRZQGEDC48dMXsodq+vYW:Z1WOmwbQGWIMVqkz","tlshash":"8833e1b1176712ff4e2cf784c9ff7e94c9d1859b8c64d45ce2e848d046a8ae24ca13da","first_seen":"2024-08-29T18:11:34.801433Z","last_seen":"2026-03-10T22:58:05.677237Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2952,"timings":{"blocked":2639,"dns":0,"connect":0,"send":0,"wait":312,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/lives/og.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.934Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/lives/og.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-2abba\"\r\nDate: Tue, 03 Feb 2026 09:43:53 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:53 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12242\r\nContent-Length: 131951\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 11404287404173857153\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":175034,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"bdc3f604fc2e1b63812bc823d170c899","sha1":"a2da0641952661e063b09e2fea2c219405ffbae1","sha256":"565627c68d6dbb66054247b26bc985e48b4e54ca3488ef46d420885840673111","sha512":"237182439eba6841face105422c6acd5b7c334b00e8c3374534db16c3ae0778c38d6c40925862689e82e95916153588155d272edcbf29bd0152b5dd70f574d2f","ssdeep":"3072:KdlNOQBqEpWeLA/ivpqPeD1hK1wA8rEzS5AbuOn8AOsMi9kUGtLRw:KBOAl5EKOeZA128WAbIAO5LUGtNw","tlshash":"6604127855a56cf18ac840e6f28b7788afcc2e9f315829af7454f29059cc641f97bc70","first_seen":"2024-08-29T18:11:34.813718Z","last_seen":"2026-03-10T22:58:05.715382Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3812,"timings":{"blocked":3512,"dns":0,"connect":0,"send":0,"wait":265,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/lives/prg.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.943Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/lives/prg.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-11de7\"\r\nDate: Tue, 03 Feb 2026 09:45:41 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:41 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12243\r\nContent-Length: 54970\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 12877551917560270212\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":73191,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"2479fcf6a1e85eaef4b034c8fd8a2598","sha1":"35f73d60a10a630fbb2fc5c9af816fb9138f88f6","sha256":"003d8164ff3a23fd6309352c9c2a8bffeecd300f20338f6d3d6b509166264b18","sha512":"df2e4ce8097b26922803ca8ff2f508f6144b0f387c507689535b7cdb94e5d3b8249425f8f08d4fa02d9514cd58fe38aeff92cc31cb2c6e6fe251fe92736708b5","ssdeep":"1536:4sksdg95Wonnf7ojNyKfGGuHYsuImON+F9NWDLoOgzRa3IzCDO:MsAnf7ojNyKfGbH1uImS+CLBcQ30","tlshash":"a463f1b1f1b772be5125ddd4a22a1af86e320bc7e74fdb3241648633e07da51842bd06","first_seen":"2024-08-29T18:11:34.831616Z","last_seen":"2026-03-10T22:58:05.696858Z","times_seen":22,"resource_available":false,"data":null}},"time_used":4413,"timings":{"blocked":4173,"dns":0,"connect":0,"send":0,"wait":236,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/images/slider_arrow_next.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.438Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/images/slider_arrow_next.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nEtag: \"6673fb50-31b\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12244\r\nContent-Length: 795\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 16301377416048946735\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":795,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"ac0368263662af62737a5c23b8a6b790","sha1":"41001e034e2fcac24041a285f166ff7fa565e52c","sha256":"07621015e27567b43a3670911583124ea461b5f6b53ea66021a759c05e221c35","sha512":"e24c8ad58f1dff74721b6f1573ee65a15dd6f6a3980f7fec43bea75fa3563891369aa6d46f9b16bfa290cc73d532e3e4be93d46b8548ff8c430566182cf6030e","ssdeep":"","tlshash":"4201c5a83f97f06468846021862c35638d4ea4e74a74cce0248e98546c38fcbc4a726b","first_seen":"2024-08-29T18:11:34.850384Z","last_seen":"2026-03-10T22:58:05.648704Z","times_seen":22,"resource_available":false,"data":null}},"time_used":804,"timings":{"blocked":502,"dns":0,"connect":0,"send":0,"wait":302,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/images/partner/partner-hongtu-brown01.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.510Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/images/partner/partner-hongtu-brown01.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Tue, 02 Sep 2025 06:45:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"68b69275-1beff\"\r\nDate: Tue, 03 Feb 2026 09:43:51 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:51 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1266\r\nContent-Length: 86899\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 12598740796259183745\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":114431,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"13705bb454fa93a337d360fde95d32ed","sha1":"f17931976273af97665c359e14c5d7b673ded90b","sha256":"221a4adff18935e8dd8d421dd0dfb431bab972377ff4ead01e00cdc9dbf73127","sha512":"fc3c18262e7afc15b4716e6ed6869f20c27749dc181e010736e5314d0cc96d33826337eb3198e8425dbf01766d7c7cd2d85ce3cf594c4509106540464dda76a7","ssdeep":"3072:d1tyThaOfU3ozO51gip4i02XfacJ7TznFNnOOa:d1tyT8cUM5hcRnFVW","tlshash":"20b312a0dce07db423bb950ca3bc9f186243145f03a6269321b3f5430d627a4a6fd772","first_seen":"2025-09-18T16:22:49.418873Z","last_seen":"2026-04-17T04:44:35.216553Z","times_seen":1726,"resource_available":false,"data":null}},"time_used":2826,"timings":{"blocked":1999,"dns":0,"connect":0,"send":0,"wait":823,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/chess/rich88-img.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.923Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/chess/rich88-img.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-109f5\"\r\nDate: Tue, 03 Feb 2026 09:45:39 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:39 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12242\r\nContent-Length: 50523\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 8735479561285762778\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":68085,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"9224ee3c9dcce0bb0669434f8207f3de","sha1":"ceb3b4570f9c48e04bd3201c40e053b4eb534919","sha256":"d6a021553134f46c77b85f2b8f84ae88f89b0baffbfcd020f02e4f2d623e266d","sha512":"18f03abc860bddcbf9da5cc8a3433574f7ef91a860238e940b6843713ac22b916f9a4bb5db60284dde1f3e9ba241807ba5ec111f1344aa35b41bd931fdae1273","ssdeep":"1536:ClDzkMIeQYdoiJ04FKSz6X1cXxdf/hHDXDeQ2E:gYMbd5CofXxd3hHDXD2E","tlshash":"c76302b9ac9bdfd9efd1bd00350ba542082a5d9f751f9089e811c4b35e037515063afb","first_seen":"2024-08-29T18:11:34.808972Z","last_seen":"2026-03-10T22:58:05.736385Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3311,"timings":{"blocked":3017,"dns":0,"connect":0,"send":0,"wait":291,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/lives/gd.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.930Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/lives/gd.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-1115d\"\r\nDate: Tue, 03 Feb 2026 09:45:39 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:39 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12242\r\nContent-Length: 52567\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 187934182303447966\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":69981,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"225cca515bb1216abe0fd803be1fcbd3","sha1":"4d417bbb5e55ae39ca8e7b6496993f563b340acf","sha256":"cf4e68db8c3cda22e7d91061827f2f11423a219c090b306cb2ab1aa763483624","sha512":"dc114fc5009e424dd177335c13643ece20ac589f434fb8426dbfedc8e125d0a4c8aefff9f194dbf427009725b9463db2012f158818a5974109218bc69b721207","ssdeep":"1536:tsffW7llxrCdiLMajkXYlvoFj0Qn8G/S87Kw9neulzZdXTr5RAVObomM:tkezcsjoFQQ8G4mnF5ZpLAV2rM","tlshash":"d46302773d56bdd1de054032541f7f146d6a07c30fc9ef250a426890b4ad987bafa0da","first_seen":"2024-08-29T18:11:34.832749Z","last_seen":"2026-03-10T22:58:05.631347Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3629,"timings":{"blocked":3304,"dns":0,"connect":0,"send":0,"wait":303,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/link_bg.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.464Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/link_bg.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-8de\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12244\r\nContent-Length: 1678\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 12849045211232020194\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2270,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"09df976eef9c4d0a63de3c4f11127e27","sha1":"784c2f5cde954e25ae62575f2d1c306399d57f15","sha256":"e9c7d8bec0642f9dd752b77078c374c414d60855c1a244d3e00205832f384a4a","sha512":"168ea12b0d6e7657d64cdc9e5b03d91d10794676d959d576fb4ca5b852ba3984982667c4cd02b96a4296dfa6a923b026b5e40be554e4d0901a16eff822149147","ssdeep":"","tlshash":"6941f8ab895cbfbf3a8125c45b19c95019157d5c02fda393a3784deb58c067ab1d00fd","first_seen":"2024-08-29T18:11:34.858211Z","last_seen":"2026-03-10T22:58:05.67869Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1234,"timings":{"blocked":877,"dns":0,"connect":0,"send":0,"wait":357,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/floatImage/232/1709812273882.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.534Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/floatImage/232/1709812273882.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 07 Mar 2024 11:51:13 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"65e9aa31-2fc9\"\r\nDate: Tue, 03 Feb 2026 09:45:41 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Feb 2026 09:45:41 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12246\r\nContent-Length: 9153\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 10019372791979507643\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":12233,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (12233), with no line terminators","md5":"fb641f9695ff5be48b7602473f3416f1","sha1":"3e03323e9e1eb88e6dcf7784fa443bd951c3816b","sha256":"e462859b1e76b1daa837341b38ecccc144d042137d715b665adadb1b736be089","sha512":"ce294ba5d2859717f19136faad8785a1b729df91e24bd815d3c58da935ef9fd1f5094a38dbf95824907b3b652cf84171865b4ee26a1483b8a5ebf0b274fe2d3e","ssdeep":"192:Z1Qg7guPhycKNb+cxKD4RMrOKUXQhxevuGHmQRigqPAIPsGGRFxKO99:rQg7gMvUeD0gOKUwxe2GHnRgAI+xKO/","tlshash":"3942aebdbe67594cb8dc08b2dc6830353935672547aa9f37b1c3f2ed0a1cb942654ca8","first_seen":"2024-08-29T18:11:34.868954Z","last_seen":"2026-03-10T22:58:05.604518Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3122,"timings":{"blocked":2792,"dns":0,"connect":0,"send":0,"wait":329,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/jquery/jquery.nicescroll.min.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.118Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/js/jquery/jquery.nicescroll.min.js HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Fri, 20 Sep 2019 08:35:27 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"5d848f4f-fc8b\"\r\nDate: Mon, 16 Feb 2026 21:31:54 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Thu, 19 Feb 2026 21:31:54 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 254\r\nContent-Length: 17446\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 17363590150368171043\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":64651,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (64577)","md5":"b5bc8cd626b389bde727a91e6ce79436","sha1":"3df6c39300ac286cf596b3bda273cb39ff825429","sha256":"a1eb48eeb3b3f2ba41940d3041464f0b386b7a7c4a8acb42f3017e691f4b116e","sha512":"2c1dde58ce83d9b716919dfc42602aef3022be012b3f92e61b17b674303ecbf0b9d308064b6d6c2443cf3e3dfd36bfb332eab62e64b56bef0be801e6f4610f12","ssdeep":"768:CwJl9VwAdGuMbJVAOi9ee9RjOEe1sdMv5rjITry:Cxb7AdRjOEKhHay","tlshash":"9553a7cd7522346b05de5235d18b4b4a623a9857730b90e4762c8cf46d29bbaf223f7c","first_seen":"2023-03-07T01:14:38Z","last_seen":"2026-06-08T03:51:22.348002Z","times_seen":17630,"resource_available":true,"data":null}},"time_used":3606,"timings":{"blocked":3262,"dns":0,"connect":0,"send":0,"wait":343,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ong3589.com:8989/mobile-api/v5/origin/getFloat.html","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:14.747Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ong3589.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 15 Feb 2026 17:36:53 GMT","end":"Sat, 16 May 2026 17:36:52 GMT"},"fingerprint":{"sha1":"D1:0F:86:D0:08:A4:EE:0F:52:A3:3A:D7:FC:F2:E8:89:8B:5C:11:07","sha256":"96:F3:97:A9:8E:8D:98:27:50:DA:C4:B7:D6:B3:F8:FB:B6:20:E3:8C:37:23:42:97:5B:24:BB:39:D5:0B:49:BD"}}},"request":{"raw":"POST /mobile-api/v5/origin/getFloat.html HTTP/1.1\r\nHost: ong3589.com:8989\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 68\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nCookie: sticket=VPV1ExTFRZeFpEQXp\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":68,"data":"locale=zh_CN\u0026terminal=pc\u0026is_native=false\u0026version=v3055\u0026resolution=2x"}},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-headers: Content-Type,Access-Token,X-Requested-With\r\naccess-control-allow-methods: *\r\naccess-control-allow-origin: https://ong3589.com:8989\r\naccess-control-max-age: 3600\r\ncontent-disposition: inline;filename=f.txt\r\ncontent-encoding: gzip\r\ncontent-type: text/html;charset=utf-8\r\ndate: Wed, 04 Mar 2026 12:49:14 GMT\r\nout-line: gb-cdn-014\r\nset-cookie: route=c7419011ef227a9b9406a6c2cd9b5007; Path=/\r\nsub-sys: mobile\r\nuuid: 07285-01-00000000-177262855409d9\r\nvary: Accept-Encoding\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 922\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":4041,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"JSON text data","md5":"9d186359642fc48fbbf8cf1029c7d366","sha1":"68df39f09f2abfcf2d09d3de558f9ea747af957b","sha256":"88067580b064ca22e37ba41e00273de846152e58a9e71697de16330fafa3bee9","sha512":"c96134df161a2ea2e2e917da7194285a51d4dd5a9e53ed689c3ab8f20e4b3400227306eeb6f6723234443f87c46c0eeba73a9c0f035e0fa6b932d9371d8ff3be","ssdeep":"","tlshash":"cd81dd206ab00caa4bc933c66ccb3d0ef6ed0186d2d52817fd4fcd5649e777a2126352","first_seen":"2026-03-03T22:07:02.404908Z","last_seen":"2026-03-04T12:52:19.121318Z","times_seen":4,"resource_available":false,"data":null}},"time_used":238,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":237,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"ong3589.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl//commonPage/themes/images/hongbao/icon-close-1.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:14.892Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl//commonPage/themes/images/hongbao/icon-close-1.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Wed, 07 Aug 2024 04:00:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"66b2f148-2023\"\r\nDate: Tue, 03 Feb 2026 09:45:36 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:36 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12240\r\nContent-Length: 6277\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 6166142923706406224\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":8227,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"5ff41d2becd0689589fd8afb58c0913e","sha1":"9f463b57b27260b19c93d533046f893360933d76","sha256":"7f97dfd7455fb76be00f454b95e3b28c114f9164b49a504bf34200da41d9db8d","sha512":"d502dc1bf29166726ba9183c01efa1b698dcbf22d79de614a4772b4150add3f308d597732844c9febef77b1d85568604b729f2c16e4c66f2f86b0b724fdb4d72","ssdeep":"192:JkkBHNqwnjSJuxF1drKn9K79LDQXFj4NLaYQ7ar/:rBHI8BHkn9Kx4+LhQ7ar/","tlshash":"4d02bf013bd42b6a1dbb10d3f1684da88c83819232f43d99371fef7b658812c6253a68","first_seen":"2024-08-07T18:17:10Z","last_seen":"2026-06-07T07:30:11.528883Z","times_seen":9329,"resource_available":false,"data":null}},"time_used":2078,"timings":{"blocked":1814,"dns":0,"connect":0,"send":0,"wait":263,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/images/partner/partner-hongtu-goldGradient.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.508Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/images/partner/partner-hongtu-goldGradient.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Tue, 02 Sep 2025 06:45:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"68b69275-1e5af\"\r\nDate: Tue, 03 Feb 2026 09:45:37 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:37 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12241\r\nContent-Length: 94483\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 10713697645940132626\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":124335,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"ce2a68b63bdc53b665753c51c725aa67","sha1":"bf0e7f53993078efbf6fd58e0086140aa483bd0b","sha256":"1746360cb57da17f40d53702373975c6a089bdbc3b30ad614a2aee3861e6ee69","sha512":"ce5aee0c48488099c795f67dc7f68f03fdd4554a66b03ef5c259f5b7d8edaa69a2d142a898468a54e9e4795e5fea843ff5e926a06d4233b26d2561ca6efb5468","ssdeep":"3072:SlBd9XIEDaQchMCJ1v1kKAr1p7IQWvMsy:Sh9XRNcGCJtuNrv7e3y","tlshash":"f5c312445f984f9af1eee8465005ed5cbc509192efef6df027d3f4a78888c818396b29","first_seen":"2025-09-06T20:06:14.226062Z","last_seen":"2026-04-17T08:59:04.359738Z","times_seen":1771,"resource_available":false,"data":null}},"time_used":2085,"timings":{"blocked":1777,"dns":0,"connect":0,"send":0,"wait":302,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/mobile-api/v5/origin/getThirdParam.html","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.783Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ong3589.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 15 Feb 2026 17:36:53 GMT","end":"Sat, 16 May 2026 17:36:52 GMT"},"fingerprint":{"sha1":"D1:0F:86:D0:08:A4:EE:0F:52:A3:3A:D7:FC:F2:E8:89:8B:5C:11:07","sha256":"96:F3:97:A9:8E:8D:98:27:50:DA:C4:B7:D6:B3:F8:FB:B6:20:E3:8C:37:23:42:97:5B:24:BB:39:D5:0B:49:BD"}}},"request":{"raw":"GET /mobile-api/v5/origin/getThirdParam.html HTTP/1.1\r\nHost: ong3589.com:8989\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nCookie: sticket=VPV1ExTFRZeFpEQXp; route=4bf55577ceef236451cccfe77519a18d\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-headers: Content-Type,Access-Token,X-Requested-With\r\naccess-control-allow-methods: *\r\naccess-control-max-age: 3600\r\ncontent-disposition: inline;filename=f.txt\r\ncontent-encoding: br\r\ncontent-type: text/html;charset=utf-8\r\ndate: Wed, 04 Mar 2026 12:49:15 GMT\r\nout-line: gb-cdn-014\r\nsub-sys: mobile\r\nuuid: 07285-01-00000000-1772628555892c\r\nvary: Accept-Encoding\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 86\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":103,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"JSON text data","md5":"9ac55fe189e4f53f37156e563e0f542e","sha1":"18b13b1360ce9fbd973e046d2652be38d58a15e0","sha256":"d7e02321006e1520d4c3e8d26428462419388e022cc89f3c974d0b87ad83af7b","sha512":"45b140d1bb3f3f06ff883448128956edda4d8ae0820dbb6b10f13860896cd611921dadb5b11b8d1577f22a80aefdfdbf8a2d54f6076b1e05f69d262df93b94f0","ssdeep":"","tlshash":"12b012816118adb39f0317e120ec380142fc11d180d48408dc5c8e5847948d7a202933","first_seen":"2023-04-05T18:30:47Z","last_seen":"2026-06-07T07:30:11.50515Z","times_seen":15881,"resource_available":false,"data":null}},"time_used":229,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":229,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"ong3589.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/D1.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.499Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/D1.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-a686\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 7217\r\nContent-Length: 32425\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 11322163139252900143\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":42630,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"bf765d05c67b6bb0dc67487af8dfe12c","sha1":"0ec9f8af15101f64a6e86c9787e577233cd21d64","sha256":"dbf7b186b1de931784a70fac976043970d8645aa7070d02c97de489c43aec4e8","sha512":"17ec5c1f2867a3b19b900a21a2d848dd6c932387c68fe37c99733b11f39a15de359a11d76ea40307776f82a9a89aebcdaba41dc0d52e3178a8775968a0a40e6c","ssdeep":"768:JJQdRfZ7wPcivXhHVp1FVsav4pStJ4KA0DsW1KCjMJW4eOcIOMebPl4y:JydR14vh1p13P4gel0DsXCjaQ/MebPln","tlshash":"9e13f14216de283971889da4013f527382b3eb80f84e95d1ea2403ed05dbf26fa71f9d","first_seen":"2024-08-29T18:11:34.854921Z","last_seen":"2026-03-10T22:58:05.637056Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2541,"timings":{"blocked":1716,"dns":0,"connect":0,"send":0,"wait":822,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl//commonPage/commonContent/nav/images/icon-menu-api-chess.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:14.863Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl//commonPage/commonContent/nav/images/icon-menu-api-chess.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Wed, 26 Jun 2024 06:30:19 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"667bb57b-6691\"\r\nDate: Tue, 03 Feb 2026 09:43:48 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:48 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 7210\r\nContent-Length: 19784\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 12628188116307705634\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":26257,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"2b2b86e3f47aa8dc657a0739103a4c2c","sha1":"c95bd8f8f6c88ca24b6dd4cf4cb5cfe16ab026b4","sha256":"ed3501127a1c0edf05c6faaf1b98de005cd0807b3c4b3621e9785502c942e8d0","sha512":"096b862b0aee48baa5dcd58d58aceacbd7f7b011bb81ad5adec543fa007ae00f2e4f4a1996aed2992a718b40894b7996adea3f1df9272c270a0d7228972d5418","ssdeep":"384:jEGr5XxkpArm62ZT06d7FZSW9sfG2IRD//hdHmf9hYHjmHRBp/uKrKSE0VTC2bwM:jJ5XBq6LavgG/hdw/ajmHHvrtTVAM","tlshash":"37c2e1abba236eeca1d107317483de67ca5b78c3b065328451513c39efaa2530751fa8","first_seen":"2024-09-24T19:10:13Z","last_seen":"2026-06-07T07:30:11.519084Z","times_seen":8175,"resource_available":false,"data":null}},"time_used":1492,"timings":{"blocked":588,"dns":2,"connect":286,"send":0,"wait":268,"receive":41,"ssl":303},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/images/partner/partner-hongtu-gold.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.489Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/images/partner/partner-hongtu-gold.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Tue, 02 Sep 2025 06:45:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"68b69275-1ab45\"\r\nDate: Tue, 03 Feb 2026 09:45:36 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:36 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1264\r\nContent-Length: 83011\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 15637333791488309653\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":109381,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"1f1a5a7aa13ee13ebd33338b3b1b0680","sha1":"92a135287652a3582477b8fbe0420847ad4a8c6a","sha256":"1d794bb495091aa98a44b50f428eae59185a9b9c55feec3045ebcb5ec1de796f","sha512":"1d4021f01cda849ef9c12b7f9edccd441892aa8e3bd1a5bc165e88c561c24291191aeb1a3a205214505c1399012d07581bfabf4803d9509da45db81f0e101a61","ssdeep":"3072:vutRp5cNyBLZQC/brFWegWNnv7LztzwcpG1cTeJrB6:mBiNyBJ9We1R7LhD6cm6","tlshash":"eeb312117f655c20f47443b424ebfa34a4ac4cf7d854a8a287a4b1dedf88fa0955193b","first_seen":"2025-09-18T16:22:49.442313Z","last_seen":"2026-04-17T04:44:35.22244Z","times_seen":1728,"resource_available":false,"data":null}},"time_used":1908,"timings":{"blocked":1247,"dns":0,"connect":0,"send":0,"wait":323,"receive":338,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/chess/vg-img.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.887Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/chess/vg-img.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-f3b7\"\r\nDate: Tue, 03 Feb 2026 09:43:51 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:51 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13972\r\nContent-Length: 42111\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 16336049356077201096\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":62391,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"35f9b9901a7965d99972ce6ae758599a","sha1":"c880237b1907f4be05157c468cc964053824d1a0","sha256":"9cbe4915171cbfc8c862764e7e73b50d5411064df76e4eb9fe661a87feb72f66","sha512":"30fd08ac66f88570ecb8dff553984ba357a5744bff8558aa40591c5df8995c32b2269f52970a6e18e9ae1926bb286091aad4d3b766f62232c8823e6b243f8ea4","ssdeep":"1536:82/8Zu+N5XPqyo5MsVlWAeYtF+hgqKDPscoO3TPy:VkQEFwbeYOXKAcd3TPy","tlshash":"7653e037be832d170b71451a1acdb5c26d1e2f67c36d5a90942d38e709ae3079ec84ec","first_seen":"2024-08-29T18:11:34.796726Z","last_seen":"2026-03-10T22:58:05.65398Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2625,"timings":{"blocked":2379,"dns":0,"connect":0,"send":0,"wait":239,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/xiao.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.471Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/xiao.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-24ef\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13946\r\nContent-Length: 7193\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 3895507663705150971\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":9455,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"a19b1e8df8cccf07256d2ade6c26ddf6","sha1":"3490cd33b91e3482f732dd91402503aa28353f7f","sha256":"58ffad04bcdcc35be398974450a158f46825a403aff5d329bc99b60ee36d4a2f","sha512":"ecae134ab163db7dad5aa853538acc3f26e76dc4fc259168b7cf87befc3a520a1c2d07c4e39fe8e72bfc7a7d5ec2c0acfe9d4a813faa5b4fab81da447ca5ff0f","ssdeep":"192:9Wb7xxT2v2l1CczaykZEOBEiozqLvBy50zoxmOIs6UOPLvXocXyaP1T:9c7XT6Y1ysOeiozcvY50zCPIsJIjYcXz","tlshash":"d912c0c833e3e24c7c24bd8032d9e297998882ad8d39acf7675d954cc8758b4f1311c0","first_seen":"2024-08-29T18:11:34.86183Z","last_seen":"2026-03-10T22:58:05.617289Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1234,"timings":{"blocked":982,"dns":0,"connect":0,"send":0,"wait":252,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/bottom_bg.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.511Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/bottom_bg.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nEtag: \"6673fb50-86\"\r\nDate: Tue, 03 Feb 2026 09:45:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:32 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12245\r\nContent-Length: 134\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5203112843582899695\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":134,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"5db94c05d63b9a98e992c08382a18dc2","sha1":"75bd852dc336afed34f128a9a1e949faf5890881","sha256":"408b1bb7acbe820b605907dc58ce08fb07690a8c3970bbf7dfae932c4ba91cec","sha512":"81c6e68ee8d72efc4f98eb2e9c2a9961a0f89d6a02960079f4706367744471a0824c8ae895bfacdc8c9a1bb8dc1852b7462f45300219a0f4187cb12620228da0","ssdeep":"","tlshash":"4ac02b7313024c55029201da241120344c43db0b611c3310388d0140e8c323080f0c0c","first_seen":"2024-08-29T18:11:34.863137Z","last_seen":"2026-03-10T22:58:05.706164Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2610,"timings":{"blocked":2366,"dns":0,"connect":0,"send":0,"wait":244,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/images/partner/partner-hongtu-black.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.502Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/images/partner/partner-hongtu-black.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Tue, 02 Sep 2025 06:45:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"68b69275-197dc\"\r\nDate: Tue, 03 Feb 2026 09:45:36 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:36 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1265\r\nContent-Length: 79254\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 3768060712278565550\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":104412,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"0298fe6d0aa5b489e3cda6cddcc325ee","sha1":"4f7dbdce496c21b36fdb5406592d1ec8f0219699","sha256":"98bd06ca490d5c000e797802b93323fca6de4f672c4a561099bdc6c0d7e0c093","sha512":"a110c084c85583253556ada989851ffe48a9fdfa752976ad7061b230fea6a4d685369a3303d8bea7f27512b35cae4c96d143fe61d275521a8cdcc8c4ac8f9554","ssdeep":"1536:8WIh38q9JcZYHgtwd+CJbHa835EktOC08ltxlgWIIa+uoAwQpqcZCfrW5s4h:7Ih33cyHdNzJwBmjepoAwQAcc4h","tlshash":"d8a3122dfaa06f75da22873f8255dc0481db6196dedba24a02f0ddd8cb4a7374267d20","first_seen":"2025-09-06T07:11:29.245175Z","last_seen":"2026-04-17T04:44:35.203107Z","times_seen":1734,"resource_available":false,"data":null}},"time_used":2397,"timings":{"blocked":1724,"dns":0,"connect":0,"send":0,"wait":331,"receive":342,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/themes/images/circle_dot.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:14.885Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/themes/images/circle_dot.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 27 Jun 2024 08:50:10 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"667d27c2-2023\"\r\nDate: Tue, 03 Feb 2026 09:45:36 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:36 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 7211\r\nContent-Length: 6114\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 4884534993725051214\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":8227,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"59e5e8b88b4a7523b6fbb42b1ca9eadb","sha1":"c180140ac130f800565394910b089d22121bd4d1","sha256":"0e426f1efc13fd5a4a6d62a87eac86b0ea282527b30f221dbdb1f255f83aa7c0","sha512":"37895031289d915503a955a961747fdf853dfd3dbc514ec3aab7cb928eeb4dfa5fa727709af6ec02b9242f5f74b39693b9d9e27bdb1de7f414c2f4e2886b411d","ssdeep":"192:S0W3hrLpx5Nd426p9saOARZWzJL54y9L0LNFhIQZEzRQF4vKuJLu+/Yoz:tGrLzDqdsaRAznB9GT/EzWFcKuJ1//z","tlshash":"82029f2ea271307c10decf597ca1751a1909a7662c8f6ea3e03f296766068783e81c81","first_seen":"2024-07-09T10:27:13Z","last_seen":"2026-06-06T16:12:47.976794Z","times_seen":682,"resource_available":false,"data":null}},"time_used":1557,"timings":{"blocked":1305,"dns":0,"connect":0,"send":0,"wait":252,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/themes/images/dot_normal.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:14.886Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/themes/images/dot_normal.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 27 Jun 2024 08:50:10 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"667d27c2-5a3\"\r\nDate: Tue, 03 Feb 2026 09:45:36 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:36 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12240\r\nContent-Length: 967\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 3036985860651249954\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1443,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"19d102450dd27285654b2fc8a5cd3c48","sha1":"e5ea63495ed06459404982b838d25b38ee34f91c","sha256":"3b684accbd4815d0ca0e9951edfb3b9b3568771b4cc48f12afe3f08eb148cefe","sha512":"efcf29549da51f3f7feba0002ff8f5a34c282cfa8ee6869aad9fe99a2d5333562616e62001bb55eced9ce53575a695dfa7cc248f848ece3a16e064288138ea29","ssdeep":"","tlshash":"7f218577b196791d10e899187fd194332c6ea71b2c53116b946d3513486f3240ac7e9d","first_seen":"2024-07-09T10:27:13Z","last_seen":"2026-06-06T16:12:48.034011Z","times_seen":682,"resource_available":false,"data":null}},"time_used":1850,"timings":{"blocked":1545,"dns":0,"connect":0,"send":0,"wait":304,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/xiao.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.510Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/xiao.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-24ef\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13947\r\nContent-Length: 7193\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 6018762582310304873\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":9455,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"a19b1e8df8cccf07256d2ade6c26ddf6","sha1":"3490cd33b91e3482f732dd91402503aa28353f7f","sha256":"58ffad04bcdcc35be398974450a158f46825a403aff5d329bc99b60ee36d4a2f","sha512":"ecae134ab163db7dad5aa853538acc3f26e76dc4fc259168b7cf87befc3a520a1c2d07c4e39fe8e72bfc7a7d5ec2c0acfe9d4a813faa5b4fab81da447ca5ff0f","ssdeep":"192:9Wb7xxT2v2l1CczaykZEOBEiozqLvBy50zoxmOIs6UOPLvXocXyaP1T:9c7XT6Y1ysOeiozcvY50zCPIsJIjYcXz","tlshash":"d912c0c833e3e24c7c24bd8032d9e297998882ad8d39acf7675d954cc8758b4f1311c0","first_seen":"2024-08-29T18:11:34.86183Z","last_seen":"2026-03-10T22:58:05.617289Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2629,"timings":{"blocked":2313,"dns":0,"connect":0,"send":0,"wait":316,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/carousel/10110/1715595992954.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.516Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/carousel/10110/1715595992954.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Mon, 13 May 2024 10:26:32 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6641ead8-b15cd\"\r\nDate: Tue, 03 Feb 2026 09:46:34 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Feb 2026 09:46:34 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 5195\r\nContent-Length: 548035\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 3288947184675437044\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":726477,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"a050d76731191d91c260258d37c13c8d","sha1":"33952b414cc836bc51000eaff683643b68706ae9","sha256":"7c0cc599496e0169604b87ccf7df84f12c71a05b91b96849bf0a3f68d4dfe438","sha512":"00c36c605651b5de5b1ddbeac664342eb77bcf9cdcdafdab47ae3a1037b7f35769a329bc1fd8b2612f6675a18815fda91209559bed5b276bab61732e6f40ebf5","ssdeep":"12288:Ras5js7KrrIGTWk/g7uyDyiXwNoUrg11pjSk0foNy3/9J50S5Priee6rAM4xNVPC:R/ts+UDbQF5MuPuur26cPVPC","tlshash":"d5f42374ad839e604f64c72770793f371f70cec728c85bd5879caad150c6291caa786a","first_seen":"2024-08-29T18:11:34.834774Z","last_seen":"2026-03-10T22:58:05.662302Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2940,"timings":{"blocked":2524,"dns":0,"connect":0,"send":0,"wait":283,"receive":133,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/floatImage/233/1709812337487.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.543Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/floatImage/233/1709812337487.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 07 Mar 2024 11:52:17 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"65e9aa71-33e5\"\r\nDate: Tue, 03 Feb 2026 09:45:41 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Feb 2026 09:45:41 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12246\r\nContent-Length: 9947\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 12757314614345468279\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":13285,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (13285), with no line terminators","md5":"e38ed38419451472e386892e3adfba24","sha1":"17c8569b5f4445737e40422d3a6fbf4c0945ff75","sha256":"74e2136d3b222aa450cec7b1145648005b96dafb737dd12327e3ec2f36037807","sha512":"031f04233279b1a1177ea2fd87732151362b55556dea932d9d88eec327cbf1c0d611542239fc373b461e046f84e738f3ff14459f6c0bc53392ad8e3c78db2c1c","ssdeep":"384:rQgWg9GgnAiEB4L7caUCqG4LLZ5W34Tn43Q4n92C5e:jWgbpPcdpl/T43zn9y","tlshash":"3652c0b72bdb044f96f905780fbbb02f5700925806cb67f312a62ec2069c6f3999e44d","first_seen":"2024-08-29T18:11:34.881301Z","last_seen":"2026-03-10T22:58:05.630492Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3523,"timings":{"blocked":3212,"dns":0,"connect":0,"send":0,"wait":310,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/themes/hb/css/pc.css","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.123Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/themes/hb/css/pc.css HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Fri, 20 Sep 2019 08:35:27 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"5d848f4f-b5d\"\r\nDate: Fri, 06 Feb 2026 11:53:12 GMT\r\nContent-Type: text/css\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Mon, 09 Feb 2026 11:53:12 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 3007\r\nContent-Length: 911\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 17548330935712912259\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2909,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"1da71520b7a0a61526a8fa8d0feb40d1","sha1":"ba1bf69dad8783563328054cae58ccabf1b00829","sha256":"5eb4d895bcb33061cda238c8ff4985ede69a866819b980c732cf3802ec101e8d","sha512":"d1cb92160523c231c4942f27c018bd3b30f89fc60153e23eb0a49d0696c896b0904ebe5db7cb97a0686f656d04a58f3ccf8fc0f09f2be703fa8400bd3270dfa8","ssdeep":"","tlshash":"d451dd305a02b1aaf42ffa677420874c2537004373169b3e72fd7ad1cfca9696136ad4","first_seen":"2023-04-05T18:30:47Z","last_seen":"2026-06-08T03:51:22.329757Z","times_seen":17230,"resource_available":false,"data":null}},"time_used":3724,"timings":{"blocked":3410,"dns":0,"connect":0,"send":0,"wait":313,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl//commonPage/commonContent/nav/images/navbar-sub-nav9/bg.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:14.865Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl//commonPage/commonContent/nav/images/navbar-sub-nav9/bg.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Tue, 06 Dec 2022 03:10:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"638eb290-46acc\"\r\nDate: Tue, 03 Feb 2026 09:43:48 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:48 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1263\r\nContent-Length: 220016\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 4672779706658548603\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":289484,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"0c8de76f85a5b71a96399149ea5b8f1f","sha1":"2c264b3c769e362fff3d5226f362f93a31e7d9cc","sha256":"89ffd63e91cb3ad46e60b01f75a9d10e7e0b25c22680aa882e667fc3f6b5f99e","sha512":"ef09b08561ad8c4f8d9a7684827967af9da3128b0c48c0238e50209d77a8c0d8a884112761571b5c6863fe9b43c9ab8db3f34c0c30fc1245de0d5c4043cbda2d","ssdeep":"6144:pnR/nfYzYntcQ0Gf5OtR+lacynj0xygGY/4UcXZ39jUr9NchR2CXitRi36soULJ:VKYntcQP5OtolNynAMdFFJ3mUhR2C0Py","tlshash":"06542379af00bc556388e10f74cf7f6cc3ea18d7ca6aa59158906581a7ef3903b18c32","first_seen":"2024-07-04T08:35:14Z","last_seen":"2026-06-06T23:55:15.726256Z","times_seen":788,"resource_available":false,"data":null}},"time_used":2362,"timings":{"blocked":615,"dns":1,"connect":298,"send":0,"wait":343,"receive":783,"ssl":319},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/chess/dtg-img.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.904Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/chess/dtg-img.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-186f8\"\r\nDate: Tue, 03 Feb 2026 09:43:51 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:51 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13961\r\nContent-Length: 74920\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 329915464100478287\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":100088,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"477a82bd6e0e371db40c6c4263487a91","sha1":"3d3aa6a71c27145f2d73593b5554dae867dfd26d","sha256":"ed7d3ccf2eb6e04a292bcb99952313bd74d480ab67e812a3f951de3541463807","sha512":"c057ebc1b3d0aac5fda365aa033dc60cf61b9963fc919488bbcb4e9b181f1eb1140f4ea246c4b1a84f396ade6a0c729cdd9b26599370702c844785c58a6c31fb","ssdeep":"3072:46RMII2MLBERpr3JofsOMtdZZP7WrYbyWBlpQJi:46/I2MtERpr5ofsOMtdnPKrYWWBvB","tlshash":"07a31276b7ac4ee15178e626157bb3cd8f7619c38443758ea0762ce2026c74fc02793a","first_seen":"2024-08-29T18:11:34.802799Z","last_seen":"2026-03-10T22:58:05.724054Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3035,"timings":{"blocked":2645,"dns":0,"connect":0,"send":0,"wait":336,"receive":54,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/lives/pt.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.931Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/lives/pt.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-10312\"\r\nDate: Tue, 03 Feb 2026 09:45:39 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:39 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13961\r\nContent-Length: 49661\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 522079728603134691\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":66322,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"6f5b314012fec17cb30fbca778f3ccd5","sha1":"b842ed94f6184ca830826e5c87fffbf3345d3a01","sha256":"9955ca1d110bed58cbda98eacfefdc0dd71e789e9a874f39a5b4d2e746cb1034","sha512":"c115e6ef0000290a10334683a673f910fc1fc6ee524afd0d88079c38c91160b17b0bff6a13493dc3f2e8273970991b5af41cc3d6f394bb07623e13e290d1997e","ssdeep":"1536:4DIEfHJ94jLQK8jyg1yCuqkR4wHwa25sewD4wW:Wff4jLh8jd7uqG25hbwW","tlshash":"2f53f1baaff39a3ad891586f57b634cc1e39f3208548e1719911bf93b1a0a10e533c31","first_seen":"2024-08-29T18:11:34.812536Z","last_seen":"2026-03-10T22:58:05.689283Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3708,"timings":{"blocked":3381,"dns":0,"connect":0,"send":0,"wait":325,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/favicon.ico","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:20.817Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ong3589.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 15 Feb 2026 17:36:53 GMT","end":"Sat, 16 May 2026 17:36:52 GMT"},"fingerprint":{"sha1":"D1:0F:86:D0:08:A4:EE:0F:52:A3:3A:D7:FC:F2:E8:89:8B:5C:11:07","sha256":"96:F3:97:A9:8E:8D:98:27:50:DA:C4:B7:D6:B3:F8:FB:B6:20:E3:8C:37:23:42:97:5B:24:BB:39:D5:0B:49:BD"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: ong3589.com:8989\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nCookie: sticket=VPV1ExTFRZeFpEQXp; route=4bf55577ceef236451cccfe77519a18d\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncontent-type: text/html; charset=utf-8\r\ndate: Wed, 04 Mar 2026 12:49:20 GMT\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 150\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":150,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"597ba0d4396e9c906225140ce907092c","sha1":"28ae2ba65ccdb583d79f85b8cc9509fae697493b","sha256":"ee1a27178227546d3dcc49e611a6d72e4f1c30080ee4493ae4085b58a49e28e6","sha512":"8898f14bd6cb5c72d6ee5878af3700be6d03b56a5a21a3d58ef347f008acf4ac68a46a908903e1d42999c1e259e77d7df686c94765865ae07361b2c4e04adf2c","ssdeep":"","tlshash":"18c02b2d24137c0c8663307636c37050c1978337a67e10210400805330cf1998ac33af","first_seen":"2023-04-05T14:00:46Z","last_seen":"2026-06-08T12:33:36.722289Z","times_seen":36081,"resource_available":true,"data":null}},"time_used":205,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":204,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"ong3589.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/themes/images/layer-dialog/gui-layer-close-bg.png","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.310Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/themes/images/layer-dialog/gui-layer-close-bg.png HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://jn5ec4.pham.xin/ftl/commonPage/themes/gui-layer.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Fri, 20 Sep 2019 08:35:27 GMT\r\nEtag: \"5d848f4f-529\"\r\nDate: Tue, 03 Feb 2026 09:45:54 GMT\r\nContent-Type: image/png\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:54 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13950\r\nContent-Length: 1321\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 15662336312951384028\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1321,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 34 x 34, 8-bit/color RGBA, non-interlaced","md5":"a2e938202c0287b9c82461a6fd94dee9","sha1":"b5e2adc7cb07c18a70a88af314e56b946ec1a1b6","sha256":"df9ce20db277ad8302c704a73aff5024683a0d38aff0d3e7e884a67a24439936","sha512":"2c035017e6ef6d6be24cf26972434ff7b16760ac6f5418d83652e745007a117cb79f4f9fa542cf4098b9141d4851f748c5151cb1055ea2b1f42eb70eb72a809f","ssdeep":"","tlshash":"1321830eea4368009648bdc114f3a457f7165f80acd8e2f46e8aac5d2d103f96abd6d7","first_seen":"2023-04-30T20:28:22Z","last_seen":"2026-06-07T07:30:11.522472Z","times_seen":16458,"resource_available":false,"data":null}},"time_used":289,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":289,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/images/slider_arrow_prev.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.491Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/images/slider_arrow_prev.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nEtag: \"6673fb50-35c\"\r\nDate: Tue, 03 Feb 2026 09:46:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:46:32 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12245\r\nContent-Length: 860\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5166731022009175510\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":860,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"270e8c021c6067c7cab713a75462ffce","sha1":"a8b6a7ca621622900c07802da19869fc0141ccd8","sha256":"20b176e0938e3f7ac7ab3a7e72a4871accf8c58778aff44dba5e255e7a76d8e1","sha512":"6d634b43a0e0208cd1b223310675c4826d145e7f698bc0a0ca063069ba7ee47a75dc3d4b41b3cfbf306723d202da54eeb1b2a239fd0337e0c6ff7ead4ccdfe81","ssdeep":"","tlshash":"451196842397e84c3dcd39c5c91b1fa04cd2d47005382ad61c1e24d929756d3a4d2724","first_seen":"2024-08-29T18:11:34.849268Z","last_seen":"2026-03-10T22:58:05.624922Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1749,"timings":{"blocked":1488,"dns":0,"connect":0,"send":0,"wait":261,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/she1.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.466Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/she1.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-69b0\"\r\nDate: Tue, 03 Feb 2026 09:45:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:32 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12244\r\nContent-Length: 20585\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 4642083778038565146\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":27056,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"ac64ac72b05320fc185572119151ee02","sha1":"58a68849659cce0de536643471b899070bc87ed9","sha256":"db2ba99b65b24a7b4e049609a89bee81d98494bf173e414e4eab39b427b325a1","sha512":"ce5cd808de0c44fed6ba6f17c9b2ce343bbfdb887bf001af763ea54030b7d5d9f0a4ab0b6105a92ee6a37580f0369d83e09cf9a0cf16569edce82697d5327ea0","ssdeep":"768:HqHVb1qWGOU2THNtEMS3rnmLH622YNOff:YXGORXEMSbnmLKjf","tlshash":"c0c2e11a97ba0e7f30e01f95fa6ced0aa94b0887abdf103ab60454e3d5677024f53532","first_seen":"2024-08-29T18:11:34.86083Z","last_seen":"2026-03-10T22:58:05.697509Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1129,"timings":{"blocked":882,"dns":0,"connect":0,"send":0,"wait":246,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/layer.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.113Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/js/layer.js HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Fri, 20 Sep 2019 08:35:27 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"5d848f4f-55f6\"\r\nDate: Tue, 03 Feb 2026 13:02:19 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 13:02:19 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 254\r\nContent-Length: 7599\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 8273205532374476436\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":22006,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (21910)","md5":"cb96339625e9d456e32f86cdb3c7a7a1","sha1":"1301165c58bbb13c542cba493b7ab5774e87e31f","sha256":"17fb047ba6828fcbdf2ca226fa4594cfded2b2fdfeaff89a5bd81c7cf0359919","sha512":"53083bf4d6d450b1e9402c3f3dc40fb3434a27d47fbabee51f4ce1d3577f2a0aabe90cf5f6dfc22830a3878ec7552a6bf6bff605c82a4f832c79f34f7657ccef","ssdeep":"384:r1dCih92A3DgrLXSt/SdMrXqE6tGLxzAOTElH0jjhtjfs8:r1YiV3D+WtXItqF13k8","tlshash":"6aa2b76a754034976323906ad11fba0b31f21d24d7078128f22bb4ae1dbcd95a2b7f5f","first_seen":"2023-04-05T18:30:47Z","last_seen":"2026-06-08T03:51:22.32075Z","times_seen":17442,"resource_available":true,"data":null}},"time_used":3420,"timings":{"blocked":3096,"dns":0,"connect":0,"send":0,"wait":323,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/061410/rcenter/common/static/js/gb.validation.min.js?v=1772438913332","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.234Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /061410/rcenter/common/static/js/gb.validation.min.js?v=1772438913332 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Wed, 05 Oct 2022 09:40:30 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"633d510e-7fd7\"\r\nDate: Wed, 04 Mar 2026 12:45:40 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Sat, 07 Mar 2026 12:45:40 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 213\r\nContent-Length: 5207\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 3892041296210449667\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":32727,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (801)","md5":"a55780dc13cbf1a8d375f14ebb659cf2","sha1":"9548cc269bcde0dc48e166fa6bab37af8a649e57","sha256":"35d147a863ab8828e073ca1ae89d476a9cede797c410ac555597c1f442452cc8","sha512":"3514366118d038da9131739e4557dc5fd92b8b7d3a27af00a7c2d8f4cfd49f4932991cba899fcc8171ac59eb356b25e717494225912f37d65600305ce2d3ace9","ssdeep":"768:WqBveMjZ1oE/eL8hhMjm9a1hI4vhej4pZ:Xpo5GhMjm9a1hI4vheUpZ","tlshash":"cee231166b7701e2916b71e10e4f9a083174952b5a87ce08bdac92e09f18d787373ff8","first_seen":"2023-04-05T18:30:47Z","last_seen":"2026-06-08T03:51:22.342072Z","times_seen":17750,"resource_available":true,"data":null}},"time_used":3758,"timings":{"blocked":3481,"dns":0,"connect":0,"send":0,"wait":274,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/061410/rcenter/common/static/css/gb.validation.min.css","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.236Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /061410/rcenter/common/static/css/gb.validation.min.css HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Wed, 05 Oct 2022 09:40:30 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"633d510e-2d52\"\r\nDate: Mon, 02 Mar 2026 06:16:56 GMT\r\nContent-Type: text/css\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Thu, 05 Mar 2026 06:16:56 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 255\r\nContent-Length: 3788\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 14499636235345171477\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":11602,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (2295)","md5":"12630e8fd95b53f705159b9cd1c2b372","sha1":"1be26841536b82ff280211796e9de339c642795f","sha256":"2c0c712726319f142f14ea06ccdba0ddb9f880571581ab1d0c193d4083a5baa8","sha512":"3084c7d3f917e379235e29b0f641e69f7a9a89b9c30b088292e3b3800cc67e16414b2df9aed1ed144cd2c37bbd035a8f6389d71ace13d17dd32a315c7719a88b","ssdeep":"192:zyzNcfuLLpjyFp291taF4lcrCQ4RFvVhkxP4OKyptj6ZqQ:znmdyF24F6crCQ4R4P4Dx","tlshash":"ed32a673ba220244790d9d442f46ee02bb1b40176a4f8eabff91786cdf825c9b67074c","first_seen":"2025-04-07T03:18:03.798848Z","last_seen":"2026-06-08T03:51:22.315897Z","times_seen":10772,"resource_available":false,"data":null}},"time_used":3845,"timings":{"blocked":3489,"dns":0,"connect":0,"send":0,"wait":355,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/xiao.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.476Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/xiao.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-24ef\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13946\r\nContent-Length: 7193\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 13551552239808159194\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":9455,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"a19b1e8df8cccf07256d2ade6c26ddf6","sha1":"3490cd33b91e3482f732dd91402503aa28353f7f","sha256":"58ffad04bcdcc35be398974450a158f46825a403aff5d329bc99b60ee36d4a2f","sha512":"ecae134ab163db7dad5aa853538acc3f26e76dc4fc259168b7cf87befc3a520a1c2d07c4e39fe8e72bfc7a7d5ec2c0acfe9d4a813faa5b4fab81da447ca5ff0f","ssdeep":"192:9Wb7xxT2v2l1CczaykZEOBEiozqLvBy50zoxmOIs6UOPLvXocXyaP1T:9c7XT6Y1ysOeiozcvY50zCPIsJIjYcXz","tlshash":"d912c0c833e3e24c7c24bd8032d9e297998882ad8d39acf7675d954cc8758b4f1311c0","first_seen":"2024-08-29T18:11:34.86183Z","last_seen":"2026-03-10T22:58:05.617289Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1356,"timings":{"blocked":1118,"dns":0,"connect":0,"send":0,"wait":237,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/floatImage/232/1709812274981.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.540Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/floatImage/232/1709812274981.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 07 Mar 2024 11:51:14 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"65e9aa32-4e99\"\r\nDate: Tue, 03 Feb 2026 09:45:41 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Feb 2026 09:45:41 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12246\r\nContent-Length: 15110\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5690099721921733083\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":20121,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (20121), with no line terminators","md5":"b9cd32e8c8882866fdb92420f31ea0e6","sha1":"c998da8ba5281c698e921df16c31b3a5b20b679c","sha256":"0e9c8a5db83eb993d823b868d84f86179c631ac04c099d81d082b41774820407","sha512":"40bbd3ede146366e546f160f5f1fe11c0310c8bdf3a7ebf8c4788e32d45b2a314d99399e96e0a379e2c0fefe9297f1b5fb5439bd6b274309e47f64365415114b","ssdeep":"384:lQgSgdLae8M6OVqtJXZS/UW92zEtjBGlPSv4WQkUZ9pzTfG3N0o7S:9SgdXh6OV8pSHaEtGs4gUZ/kS","tlshash":"5c92e13c1f315aaa827d8b3df3382133ba9d9f56506f16f5e2d923db584ce9000a55b8","first_seen":"2024-08-29T18:11:34.875089Z","last_seen":"2026-03-10T22:58:05.661509Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3307,"timings":{"blocked":3066,"dns":0,"connect":0,"send":0,"wait":240,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/floatImage/233/1709812337700.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.543Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/floatImage/233/1709812337700.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 07 Mar 2024 11:52:17 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"65e9aa71-3351\"\r\nDate: Tue, 03 Feb 2026 09:43:57 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Feb 2026 09:43:57 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12246\r\nContent-Length: 9835\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 1781909180030321030\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":13137,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (13137), with no line terminators","md5":"c3ea127e0198362bde2cc6bea0eaff1c","sha1":"486338e6ccca53bb8ebd0579d91542f61c566d08","sha256":"8cdc1a074285ff97aac4122ffe721b9f67e776dc3310a047065123ab746c81ce","sha512":"da0e79ed123497d6c08aa1e413b41a1cf246ec98dff435661b48164e195e274b0180f2a0101ac5a64bad8ea0c453fda56ba6ac77b7e44a1e4f7f39eba9dcc766","ssdeep":"384:IQgPgorTfarLPy7EhUB78E0VcZUR1Fum1iV/XsyRyCvJmRz:QPgMf0XqmIUDFum1iVxM","tlshash":"7c42c07de3c345d97235da1cec650aafae67a08859c37af718da2300131e0b0158af6d","first_seen":"2024-08-29T18:11:34.882257Z","last_seen":"2026-03-10T22:58:05.710893Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3540,"timings":{"blocked":3304,"dns":0,"connect":0,"send":0,"wait":235,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/commonPage/lan/i18n.js?t=1772628549.701","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.073Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ong3589.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 15 Feb 2026 17:36:53 GMT","end":"Sat, 16 May 2026 17:36:52 GMT"},"fingerprint":{"sha1":"D1:0F:86:D0:08:A4:EE:0F:52:A3:3A:D7:FC:F2:E8:89:8B:5C:11:07","sha256":"96:F3:97:A9:8E:8D:98:27:50:DA:C4:B7:D6:B3:F8:FB:B6:20:E3:8C:37:23:42:97:5B:24:BB:39:D5:0B:49:BD"}}},"request":{"raw":"GET /commonPage/lan/i18n.js?t=1772628549.701 HTTP/1.1\r\nHost: ong3589.com:8989\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Wed, 04 Mar 2026 12:49:10 GMT\r\nout-line: gb-cdn-014\r\nuuid: 07285-01-00000000-1772628550b920\r\nvary: Accept-Encoding\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 813\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1310,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (1217)","md5":"11f80cdf005847a4f4427ed515bc1395","sha1":"f38ee44ff675d260e559986f4ede4925c6865651","sha256":"f2ff6e2cd0ba9c3efebc47a104985bdaa865066ee79713e681453f8dbfa726f9","sha512":"9f97c3eba478513121bd921586358e4f51fbb3065e692dd8350cc42a3fbd1d2f548606766dbef40745f9bacd08bc148e43a9446463e6f9296a577d5734916f88","ssdeep":"","tlshash":"fd21f158f3e565e32d5e86a3ed623f6b11750abd00973407437831ce017d7979c6c408","first_seen":"2026-03-04T12:49:49.194707Z","last_seen":"2026-03-04T12:49:49.194707Z","times_seen":1,"resource_available":true,"data":null}},"time_used":347,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":205,"receive":142,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"ong3589.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/images/partner/partner-hongtu-gray.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.495Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/images/partner/partner-hongtu-gray.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Tue, 02 Sep 2025 06:45:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"68b69275-199fb\"\r\nDate: Tue, 03 Feb 2026 09:45:36 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:36 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1265\r\nContent-Length: 79652\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 7561024050879290468\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":104955,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"Apple HFS Plus version 12135 data (spared blocks) last mounted by: 'GYCw', created: Thu Nov 30 10:34:46 2084, last modified: Thu Sep  4 23:18:47 2098, block size: 1467044454, number of blocks: 729362515, free blocks: 1497459512","md5":"c74ef17cb37fbfb0a1c949597470e977","sha1":"34c6ba958b6527c7a9eb35a4d64233da66e772c7","sha256":"f3fafe4c402edc11f26d8170dd5ef6da07e1d538ce471b39fd0769803439d2db","sha512":"493dc789121a373e46f86420affcd800691d47a146c19852599e9896ca521c3fd42a89a02932fbf69d4d3040734cc0ec4f0c3afc86064ec54668397955a48bbf","ssdeep":"1536:2qC8ZeKIScoUhq8lzPJt7W54AH4XmYho/1bxXoYW5qyx+zn8tnngf:2xi0hJzRthZWT9BoKysin8","tlshash":"c9a3023ccb433a116ad267a51fb22deda740e6cb555e03e785d222c615963ceef318e0","first_seen":"2025-09-07T00:50:47.660386Z","last_seen":"2026-04-17T08:59:04.26396Z","times_seen":1764,"resource_available":false,"data":null}},"time_used":1789,"timings":{"blocked":1415,"dns":0,"connect":0,"send":0,"wait":313,"receive":61,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/lives/ag.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.934Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/lives/ag.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nEtag: \"6673fb50-2b74c\"\r\nDate: Fri, 06 Feb 2026 20:36:20 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Mon, 09 Feb 2026 20:36:20 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12242\r\nContent-Length: 177996\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 8823111791795770797\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":177996,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"44af4d866a0fc97df927ab06672d43ca","sha1":"72afde763bfcfc81d3155f34f93948e7d3750a78","sha256":"c3512f30a9c663b4c53c1a2e280d612bd72ca8fe2201b66cf25bd445ae02e05f","sha512":"92ef21e41ce11709545955d8ef671a7aa6b78af6687f41a24e53be36a14e56b0f317d415b02048ce034a51937918ec644917efd9ac38e25bc9332954481e4aed","ssdeep":"3072:uC7DBoL3z3xxsT/QEBSFpTxX7Jakq+lPCWvkhJNklx5DVufikE0u7l4:NQ3XE/QmSFpxrJa1gP1vYgjDObu7l4","tlshash":"680412a11d9dee28d3c4dd04612f6d390caf1dcddc4977efa81631c6b0e6904969a42f","first_seen":"2024-08-29T18:11:34.814853Z","last_seen":"2026-03-10T22:58:05.664274Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3854,"timings":{"blocked":3534,"dns":0,"connect":0,"send":0,"wait":315,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/lives/tp.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.941Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/lives/tp.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-10aab\"\r\nDate: Tue, 03 Feb 2026 09:43:54 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:54 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12243\r\nContent-Length: 50916\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 15647450397069684734\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":68267,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"3b9de02c8b3a29fe5d6730768eef44fd","sha1":"14a3888aaa871fc44ae8fde92ef3167fe7ca91ff","sha256":"6bc460de46beb845eb13a99865e2e1cdaef93cf67abb8b16016b7d2c94c8fb01","sha512":"3b9812ed0317cf3b109e958ff07f08810cd859cefca991d2f3f066612f306d4370f965358cf83dcabc0b51238fb0eb6c97beb3fb99378d34e7e01e7f32db0383","ssdeep":"1536:qIgmsTes5uwYP6L0TqXsADLUfxXeL26R6UEQX78sNfj/0eJ0NGE:GmsT3uv20TyUpXeLPSQXAsNfjcePE","tlshash":"4463f17679a77e78fd0d93281a37a5302cf4bda67048fef32a0d44792525216abc3c64","first_seen":"2024-08-29T18:11:34.816008Z","last_seen":"2026-03-10T22:58:05.672021Z","times_seen":22,"resource_available":false,"data":null}},"time_used":4424,"timings":{"blocked":4074,"dns":0,"connect":0,"send":0,"wait":347,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/images/zh_CN/paizhao.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.338Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/images/zh_CN/paizhao.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-c581\"\r\nDate: Tue, 03 Feb 2026 09:45:30 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:30 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12244\r\nContent-Length: 34821\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 7019700051204504166\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":50561,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"2cdf651bb235d09a90eee62c39593057","sha1":"781d2906e040ff90556b1a335934499e0010c086","sha256":"25927ceef2ebfebf3a02a1c91f8ed2a7cc53daef2a2e66b29806e9654c74e575","sha512":"be3ab76cb784ba410ee39ca92ffe6f8a18263120478c1da60d96efa343bd305386f6bc7813ffa5ba9ad68d76fd202fea8bd86a149b950b19bf56058b420361d8","ssdeep":"1536:hW6/1Pvv6caUTtGNvPZ6/72ZW/FNXo5ZcjUVawGVc/:fdPvyKTtWhG7Jtobkwac/","tlshash":"f333d1fe2a82cb6d21c0121f889394542ebdfa7b09814ee777d5768e8c91741070adf6","first_seen":"2024-08-29T18:11:34.836744Z","last_seen":"2026-03-10T22:58:05.700584Z","times_seen":22,"resource_available":false,"data":null}},"time_used":314,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":313,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/images/mail.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.380Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/images/mail.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nEtag: \"6673fb50-3a9\"\r\nDate: Tue, 03 Feb 2026 09:46:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:46:32 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12244\r\nContent-Length: 937\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 2587168254852588409\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":937,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"5411f639cc8ea60e767d98cae5248894","sha1":"42d756fbd7badd8c005275ffb6ff46d6fb11911c","sha256":"2c06aa9c44d3e1cfd8ea008f95d8b65521b26a9a1e26ed8be4cf7896fa927ed4","sha512":"c8754466775ae762db55977952eb602c6be1b52dee43b68b7a6207041f69df8307e4c4de3ead6fa4f77dd349a3e84d087a01f5b3a7f44e43aad75ab7eb27cc73","ssdeep":"","tlshash":"611154f9066b6c4055b248dc4fd6660adc613bbe922854744e10201fb13a3a2e8c70de","first_seen":"2024-08-29T18:11:34.840921Z","last_seen":"2026-03-10T22:58:05.712979Z","times_seen":22,"resource_available":false,"data":null}},"time_used":325,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":325,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/zh_CN/pubads/images/ads1.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.423Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/zh_CN/pubads/images/ads1.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Mon, 01 Jul 2024 10:00:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"66827e29-3ec9\"\r\nDate: Tue, 03 Feb 2026 09:45:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:32 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13970\r\nContent-Length: 12108\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 12374099833627548852\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":16073,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"a1ca510a947a44d3bb787550666b6b9a","sha1":"990e7b9a295642dc06be869563d7d2deb900c66c","sha256":"7653544bdb78e5272eea951760f303a64eb9caa5f8603a1467b27cda4d35896a","sha512":"3a3c5c075eb0f814c4f9366ca0367ac11fd4929bdf3a767051d9f10b7767c7e9e491ead521621e35314aa51074fb5a98f763c13e9eecd56df658b9d3cbd18465","ssdeep":"384:QGrfyK0lxmnfsgCTtPKOuWesuP/VmdIAgeZH:9f2LOsgctPKOG7m3H","tlshash":"dc72bf5124f4ba3982b1e7c83a5ddc382569272a7d1e522109ed367108e606c5fe4def","first_seen":"2024-07-09T10:27:14Z","last_seen":"2026-06-06T16:12:48.013176Z","times_seen":791,"resource_available":false,"data":null}},"time_used":511,"timings":{"blocked":252,"dns":0,"connect":0,"send":0,"wait":258,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/floatImage/232/1709812273656.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.533Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/floatImage/232/1709812273656.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 07 Mar 2024 11:51:13 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"65e9aa31-13191\"\r\nDate: Tue, 03 Mar 2026 01:07:07 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Mar 2026 01:07:07 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12246\r\nContent-Length: 59096\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 4212739838759752305\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":78225,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"5723068f8aa75a91fcb16dee4893c5bd","sha1":"383804529c400a424823aa6699554afc5996c782","sha256":"f2aca6827f9b85f4132bee27506969d92cf99ce7549dc6a41f1a4caac6ff9130","sha512":"91e0390cbd09a7410f81036daefc62bb4620411ab9f8268f94ec9c3a58d7f370656c7cdd97f3a0b704b200495f472aa6329a29dafb79b95cab0be7decfe1c46f","ssdeep":"1536:bMUpPPyGfAuB+7lWILRvEdDt3ka1+N83vGkappnHStv4HCSic4wUC:HHyGf8lWuRvouoV3vtAp0v4iHwD","tlshash":"977302a36f50a5db1494e0b068c2156f7849ed83b7cbe2a541ec29cd29b6f84183fc72","first_seen":"2024-08-29T18:11:34.865102Z","last_seen":"2026-03-10T22:58:05.74263Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2908,"timings":{"blocked":2606,"dns":0,"connect":0,"send":0,"wait":301,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/lazyload.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.110Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/js/lazyload.js HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Mon, 07 Aug 2023 03:05:10 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"64d05f66-2f79\"\r\nDate: Fri, 06 Feb 2026 23:24:53 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Mon, 09 Feb 2026 23:24:53 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13943\r\nContent-Length: 2731\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 1363354482456586492\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":12153,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"d87854586672bff7f886a47da85da5ed","sha1":"8d0537030dc7a81ade87a41a75fd5a75e4e33da1","sha256":"17859187f895c27de8869fb6bfec579fd68c4588d0af71d08d334be92d144ada","sha512":"d8c3e724f00bcf1ebfe1f8e96dda01243cf22aef18a0fc5a25a42d84458ff58a22a316dabf1d80d1b4f4c28db79edbdf9ba19df755d72f2b0b9f64497137672f","ssdeep":"192:Cdr+EgBD7NiM7B1wV20jSCQrF/bcbe7/bgdCx4RTsmS3KDsS3CggvBSChKRJ0Suk:Cdr+JBDYpV20Ez+obgdsm3ROCJIqSJvG","tlshash":"304200483deb51aba1d3b0f89a5f11447235810b160eee253d6c9395af6093932f2ff9","first_seen":"2023-08-15T12:01:05Z","last_seen":"2026-06-08T03:51:22.325701Z","times_seen":17244,"resource_available":true,"data":null}},"time_used":3270,"timings":{"blocked":2917,"dns":0,"connect":0,"send":0,"wait":352,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/jquery/jquery.super-marquee.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.117Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/js/jquery/jquery.super-marquee.js HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Fri, 20 Sep 2019 08:35:27 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"5d848f4f-1151\"\r\nDate: Sun, 01 Mar 2026 00:10:38 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Wed, 04 Mar 2026 00:10:38 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 254\r\nContent-Length: 1421\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 307181665481075598\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":4433,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (4433), with no line terminators","md5":"f77d83590bc0a69298f2fbcc5d9911cd","sha1":"1d6aa25d7052f53ad0181385e5efe72f224bbdb9","sha256":"1d042b9441e860ddcc01b9e9e5e8d354121ee0e31b47f6e18a321e2e633d22e7","sha512":"a39dc6c01df32c8f72842af346f4d67e1278d37a74a0541537b8274b421bcfbc547a2f4844f3c4b6c5cdda4c78f0a8f41171c87ffd149ab52526a95bc6c5bf61","ssdeep":"96:nwzrUsI9/8w/ISEgOGXFRNcrc8PQjc3Pb:+rUsk88OnJQA3D","tlshash":"2991252d7290f5d559cf3c3be02b0b050c785123a54e00927a65def279ba379a607e1f","first_seen":"2023-03-07T01:14:38Z","last_seen":"2026-06-08T03:51:22.3474Z","times_seen":17508,"resource_available":true,"data":null}},"time_used":3401,"timings":{"blocked":3118,"dns":0,"connect":0,"send":0,"wait":283,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/zh_CN/mobileTopic/images/special_3.jpg","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.275Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/zh_CN/mobileTopic/images/special_3.jpg HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Fri, 20 Sep 2019 08:35:27 GMT\r\nEtag: \"5d848f4f-1ad7\"\r\nDate: Tue, 03 Feb 2026 09:45:50 GMT\r\nContent-Type: image/jpeg\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:50 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 255\r\nContent-Length: 6871\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 4210831999049968213\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":6871,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 168x168, components 3","md5":"99be4bfe275809d4e436b77c991b1381","sha1":"54eadee77394eb62ccf377ae68d9f49acb5b6785","sha256":"4ca35131972acdf420b94f0d64a5a0f504eb5a7b0e6fb7b8b467916a12aae37d","sha512":"452a79b02619ed5c1e4f81fc5a4a209cb8a11d03aadb1841ae9be18fbca088652cdb54340329c1bf57771abfb02ffed4bf75b61f4df96866b7f2358c36ae75a3","ssdeep":"192:p7FikLUR+6X7MCy5nSb1jSG99DX8yclWGo2yscY8:pfA3+gSGjX25+Y8","tlshash":"4ae18e26da8bdb85c4a4f2713f7d881a5551da1a5bd3f02160f8c41b3c9327c15e7a8f","first_seen":"2023-04-30T20:28:22Z","last_seen":"2026-06-08T03:51:22.343269Z","times_seen":17419,"resource_available":false,"data":null}},"time_used":4272,"timings":{"blocked":3986,"dns":0,"connect":0,"send":0,"wait":282,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/themes/gui-layer.css","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:12.612Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/themes/gui-layer.css HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://jn5ec4.pham.xin/ftl/commonPage/themes/gui-base.css\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 17 Aug 2023 08:10:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"64ddd5e1-c760\"\r\nDate: Tue, 03 Feb 2026 09:54:27 GMT\r\nContent-Type: text/css\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:54:27 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13258\r\nContent-Length: 6923\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 13609296078935421398\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":51040,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (489)","md5":"858eefc3fa70af7d0115c901908471f5","sha1":"29c181bbbc09a424f7de7cb57629bd8a9e3c679a","sha256":"9f6a77c93f998e065f1ed52eb9943a3c560a50366bba2c8a34a4a1223c793caf","sha512":"3731234bfa0b2abf45883da0ab74960a77f167dc158f4eae4f9c58293bfe6ccf322fabdbd4100bd5fdba0f463cbf18ba44d89b0bed695b65b8edce7edc9441ec","ssdeep":"384:RCEe+wekUqKrIQycnvqP9bQmAJS0OuaIHmOKpPg+2fF93sJJ:RCf+wekUqjpqCP+OuaIHmOK6+2fFVSJ","tlshash":"67330d22a16816cd7156eac8705dbab7b7fc8c02e21717bcf8ab304fd28d5439476a47","first_seen":"2023-08-17T12:06:57Z","last_seen":"2026-06-08T11:55:33.43771Z","times_seen":16329,"resource_available":false,"data":null}},"time_used":579,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":297,"receive":282,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/images/partner/partner-hongtu-purple-02.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.509Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/images/partner/partner-hongtu-purple-02.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Tue, 02 Sep 2025 06:45:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"68b69275-1b32b\"\r\nDate: Tue, 03 Feb 2026 09:43:49 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:49 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1265\r\nContent-Length: 84586\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 17807978328010577057\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":111403,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"d043d074c686f48dfca9d02ba3e7b670","sha1":"a5fd625703018e34f86c2b4f2f487ce5beaa0903","sha256":"f06a3aa1663a356ff269f6d89768597db1834ac6cb5ab01832786de25d7f1531","sha512":"60202e2a8ab8f0a733d26c38f479c634bffe0fe89253d4aa8f6c91eba694b4c7d331d778926803cc5c65dc678e0125aa9fae04bf66dca45dbe214bb50d537db0","ssdeep":"3072:boG85QSt1cl/lHGqN5+0Ra0h3tGgWUdL3krWqM:sP5p1AV/fRaIAUdrkrWD","tlshash":"16b31240e7a0fda58dd09f4b8a673a795f3c072eb753f0ac94836170837aa9e1257748","first_seen":"2025-09-07T00:50:47.7251Z","last_seen":"2026-04-17T08:59:04.369621Z","times_seen":1763,"resource_available":false,"data":null}},"time_used":2230,"timings":{"blocked":1888,"dns":0,"connect":0,"send":0,"wait":338,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/xiao.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.508Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/xiao.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-24ef\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13947\r\nContent-Length: 7193\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 3016692200564360170\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":9455,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"a19b1e8df8cccf07256d2ade6c26ddf6","sha1":"3490cd33b91e3482f732dd91402503aa28353f7f","sha256":"58ffad04bcdcc35be398974450a158f46825a403aff5d329bc99b60ee36d4a2f","sha512":"ecae134ab163db7dad5aa853538acc3f26e76dc4fc259168b7cf87befc3a520a1c2d07c4e39fe8e72bfc7a7d5ec2c0acfe9d4a813faa5b4fab81da447ca5ff0f","ssdeep":"192:9Wb7xxT2v2l1CczaykZEOBEiozqLvBy50zoxmOIs6UOPLvXocXyaP1T:9c7XT6Y1ysOeiozcvY50zCPIsJIjYcXz","tlshash":"d912c0c833e3e24c7c24bd8032d9e297998882ad8d39acf7675d954cc8758b4f1311c0","first_seen":"2024-08-29T18:11:34.86183Z","last_seen":"2026-03-10T22:58:05.617289Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2499,"timings":{"blocked":2178,"dns":0,"connect":0,"send":0,"wait":321,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/floatImage/232/1709812273298.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.532Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/floatImage/232/1709812273298.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 07 Mar 2024 11:51:13 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"65e9aa31-12fb5\"\r\nDate: Tue, 03 Feb 2026 09:45:41 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Feb 2026 09:45:41 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12246\r\nContent-Length: 58733\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5942227674229503120\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":77749,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"224bfd20ab932fe9f0d332635bef4008","sha1":"a77953dbbb1471e441ce38a8cc547654f21574e2","sha256":"7ac63c4deb6ad784d7ffdfbc541f3ddc6dead4a4e1fa55a1beda0ce87d12f2a7","sha512":"2719d504188f8414dc86acdee9db3c0ebb2ad21921af36369d5d67fc09f60cb550ad88757a7fe0b5ad509f7e2bd50504efa720a85bb55a6f417f04bf5d727782","ssdeep":"1536:bKopPPyGfAuB+7lWILRvEdDt3ka1+N83vGkappnHStv4HL3Fs1HmHH:hHyGf8lWuRvouoV3vtAp0v4B0Hm","tlshash":"ac7302d36f5566ea4c46906079894aaa3944cd83c3d3c3f251bc368aa4b7fc1283fc63","first_seen":"2024-08-29T18:11:34.866938Z","last_seen":"2026-03-10T22:58:05.650544Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2822,"timings":{"blocked":2591,"dns":0,"connect":0,"send":0,"wait":229,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/chess/lc-img.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.922Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/chess/lc-img.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-1107e\"\r\nDate: Tue, 03 Feb 2026 09:43:52 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:52 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12242\r\nContent-Length: 51632\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 3261238104522160876\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":69758,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"5bd730a2417da88a9ce2950a9e971955","sha1":"fd62252a1b8c66f2216b18b30e3e4a41fb3d8fbe","sha256":"ad97134ed70097cf9ca8f5fb00a3e626e37cb341e51d95cca977e1ca319aaf38","sha512":"4516269a4472c2a652ce1c6f182401f7b48604227bb0165afd1d778461e218a578f69ea10b6f2dd9342ed00e0ffcfa01ef71050541c7e78523a1de27aa517371","ssdeep":"1536:SugcD9bXqFArRzO/eQv9gMySJavUAQ581AEFG1hmiSCtpD:5gGsgOmarDAYrKaD","tlshash":"7763f1b75723df254f94b3d1a90abbab0853483b6d0ce268dce55c43f960165ec7b088","first_seen":"2024-08-29T18:11:34.833687Z","last_seen":"2026-03-10T22:58:05.649612Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3250,"timings":{"blocked":2987,"dns":0,"connect":0,"send":0,"wait":255,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/theme/default/layer.css?v=3.1.0","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:14.738Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/js/theme/default/layer.css?v=3.1.0 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Fri, 03 Sep 2021 08:10:10 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6131d862-48e4\"\r\nDate: Tue, 03 Feb 2026 13:02:19 GMT\r\nContent-Type: text/css\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 13:02:19 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 254\r\nContent-Length: 3111\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5714853352308188670\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":18660,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"5cf9259b7dd27aacd46161ec23d261cf","sha1":"ba0c399616a5ae9cdd8aec5b76ba4aae4822367c","sha256":"7f73a66b3a9a38576d124b6243a8984d795028e3493b8fa3f688d8dbe10cbccc","sha512":"834ae73090b76f7dad48a5efa850a0009d5104cfcab402b7c343ceb49410584c3a60a4eea800d366f380dc8364f5f00e3d38101c379fd5fa19f9492781d9ada1","ssdeep":"192:99OUf4PBsPIOpyNYpyBVpkgdpkqg60yQG0yrGlwSlyDXLIXiYHIli5aT6XeFTfb1:C4CyFP/FgkFxUE6QS","tlshash":"b7821de599a31584751b8214dbee267232f85c83e40fcc6cf7df354f4f086a592a1a4b","first_seen":"2023-04-05T18:30:47Z","last_seen":"2026-06-07T07:30:11.53514Z","times_seen":17714,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":326,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/images/slider_arrow_prev.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.436Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/images/slider_arrow_prev.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nEtag: \"6673fb50-35c\"\r\nDate: Tue, 03 Feb 2026 09:46:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:46:32 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12244\r\nContent-Length: 860\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 11344146295463188937\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":860,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"270e8c021c6067c7cab713a75462ffce","sha1":"a8b6a7ca621622900c07802da19869fc0141ccd8","sha256":"20b176e0938e3f7ac7ab3a7e72a4871accf8c58778aff44dba5e255e7a76d8e1","sha512":"6d634b43a0e0208cd1b223310675c4826d145e7f698bc0a0ca063069ba7ee47a75dc3d4b41b3cfbf306723d202da54eeb1b2a239fd0337e0c6ff7ead4ccdfe81","ssdeep":"","tlshash":"451196842397e84c3dcd39c5c91b1fa04cd2d47005382ad61c1e24d929756d3a4d2724","first_seen":"2024-08-29T18:11:34.849268Z","last_seen":"2026-03-10T22:58:05.624922Z","times_seen":22,"resource_available":false,"data":null}},"time_used":761,"timings":{"blocked":498,"dns":0,"connect":0,"send":0,"wait":263,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/images/favicon/favicon_7285.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.513Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/images/favicon/favicon_7285.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Mon, 05 Dec 2022 08:15:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"638da88c-8c6\"\r\nDate: Tue, 03 Feb 2026 09:45:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:32 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13951\r\nContent-Length: 1599\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 1546999630813871104\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2246,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"0b6186a871ceccd47cdbbf8441a9fbe5","sha1":"9f8c0216563cd8a8a03413b847ebfbe8399f61b6","sha256":"3164d57e02536811b06d8c5a59ae2908c3fbb222cbe3f9fad237e2bc642c620d","sha512":"c6a20fdbab15cab3f4aaf6506decbf1b49cb6da756aa98b20e8dcb76c2ea5a1f2bef7c2adb8d037ca27d6d681bac0e46829c7baf28bc49a963c38d2c48efc734","ssdeep":"","tlshash":"a3411b7a5a6eed0e8c28955edcb730063e394a2f4e67121be46837726de777804407c9","first_seen":"2024-08-29T18:11:34.864127Z","last_seen":"2026-03-10T22:58:05.619434Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2812,"timings":{"blocked":2494,"dns":0,"connect":0,"send":0,"wait":318,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/lives/aes.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.946Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/lives/aes.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-117a6\"\r\nDate: Tue, 03 Feb 2026 09:45:41 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:41 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12243\r\nContent-Length: 53586\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 1320050024786004580\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":71590,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"1808f99290cffe7ef694546886885102","sha1":"cfb12f6b5b53c351a8a4cabe129e0d29abea3501","sha256":"729b4000ddb2b87910da8e6424f11697f32b2e9128d8d86831dca4015b17ace3","sha512":"543618d58880db00dd5b45dccaf73bcf77b009da46e5bdde14867b10159ec36085b454d2f49b5901b8138e1fbf15311d06eeb4d12049557d37910804d341a036","ssdeep":"1536:4D4zHrNe0UHJ7uh551mvscGQtNGEO+drOmFMOR2qJIOvIev:xzx3qJ7y551mpdOmiOr29C","tlshash":"f063f1a1d9d24c7241d8aa131632a2c97879b925c5cf81fbf29d59d3d8327d2ca3fc10","first_seen":"2024-08-29T18:11:34.830681Z","last_seen":"2026-03-10T22:58:05.680793Z","times_seen":22,"resource_available":false,"data":null}},"time_used":4525,"timings":{"blocked":4231,"dns":0,"connect":0,"send":0,"wait":290,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/moment.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.122Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/js/moment.js HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Tue, 18 Jul 2023 06:40:10 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"64b633ca-1cab9\"\r\nDate: Tue, 17 Feb 2026 18:01:44 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 20 Feb 2026 18:01:44 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13943\r\nContent-Length: 26968\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5287396258816474228\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":117433,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"36c8f828395a9395549bd6e7307cb7e9","sha1":"f30a4961558e2d3d4405e7d93aa28fdb63245e78","sha256":"5d5e32fa1e06a0bc9396f349d142ad248e82086543e438c890e43f41e692db33","sha512":"40c24a9011e1bbdd98bd95b341c400bdaf48fefd953fcb407368fe3c685ac09196b55e230c03ca9890c35fe9acef2c916bed52423dc1a7b532a1db9817c03a8e","ssdeep":"1536:qOL1yBkBeb9wNoHpH7tjl2Ulwjwaj2BH3fMobEKeYEoZYiMirUw0:qOCWeH70R2BkobE+cw0","tlshash":"aeb35f5a59e31023496362294fdf2011ba388123590dee487d8da3d49f9ed7c47bafec","first_seen":"2023-07-29T10:21:40Z","last_seen":"2026-06-08T03:51:22.348552Z","times_seen":17488,"resource_available":true,"data":null}},"time_used":3685,"timings":{"blocked":3396,"dns":0,"connect":0,"send":0,"wait":288,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/themes/images/ads1-img.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:14.880Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/themes/images/ads1-img.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 27 Jun 2024 08:50:10 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"667d27c2-8297\"\r\nDate: Tue, 03 Feb 2026 09:45:35 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:35 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1264\r\nContent-Length: 25297\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 14468603800397707623\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":33431,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"78bde81257b51df053d266d4b658b76c","sha1":"5ad351ce32f85b1f92b4e3bafcef479d6c64b26f","sha256":"250b9d39c66c0b5f5f0fc451489b08aa5e2134931f01571ea39bc2b78ab24ebe","sha512":"4120dd2813824d3d7c13d5ceda47299f863347bcadd2fb6625c30788bf7df690df2792870b4a68efdfe18f9f60b09c4f4fe1d749d197e734a85f8e0f14cc3955","ssdeep":"768:lsM9s2yQdHoed+tb7TmwQHIh12xcPUvjN5BGC1JY0YSXE:l7ByQn+5/QoP0vjNj7ISXE","tlshash":"6ae2e1dede417cb708788aaa559fbe50e2b2484cbf0d889ed45720029d4f641fd9dce2","first_seen":"2024-07-09T10:27:13Z","last_seen":"2026-06-06T16:12:47.975613Z","times_seen":821,"resource_available":false,"data":null}},"time_used":1411,"timings":{"blocked":652,"dns":0,"connect":0,"send":0,"wait":315,"receive":112,"ssl":332},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/language/language-zh_TW.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.848Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/language/language-zh_TW.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-875\"\r\nDate: Tue, 03 Feb 2026 09:45:37 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:37 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12239\r\nContent-Length: 1538\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 4257034352489280768\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2165,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"0bc3faf9dc56b9c615978bbbff022943","sha1":"156e43b744cef1306c454506e61452f4ef7314f3","sha256":"e29763707ae9170bbd9f278651689771fd39cdd073662eb4a2371bc8184a36ce","sha512":"61e93d6043fe968b1f07c115a53a67cfbe9901bb5b0e773b4f4fcb21efa74f7f92dcb3f106677d56ff5427cd4cd0c66f75328ccfe7673a74645a1cc32209d261","ssdeep":"","tlshash":"bc41093fb389fd1f65228a78997372872d39adab0cbb513984853b45de36be44040ce4","first_seen":"2023-04-16T16:45:37Z","last_seen":"2026-06-07T07:30:11.562684Z","times_seen":5820,"resource_available":false,"data":null}},"time_used":366,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":366,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/chess/leg-img.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.924Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/chess/leg-img.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-12fdf\"\r\nDate: Tue, 03 Feb 2026 09:45:39 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:39 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13962\r\nContent-Length: 57707\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 15176469996610781831\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":77791,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"e54ba963665d4a26d1b2f00301573a39","sha1":"06ac37b1e2ebd5d4b7eb36e57a0b0d1dc0c25070","sha256":"4b28db8d70235694a301e7eea6ad093c047cdc5d16e6723130683ba6af2db193","sha512":"cc8bba1a46682d10b476f1eac254f796848b35b1b1d75a38b2cc526c2af8a25c7246e8c9b699825112479070380f06bde578b73924a258df9f6d8f30834313d5","ssdeep":"1536:XFJDHrNb5HnNuKGC3fY+K2yGikNRrjI9HJ89KuBftKmFzDkSQSGDOplcS:TLJuKGC/pfNRr09HadBVKmKSoOncS","tlshash":"82730262631bbd3209e1a61fe13fdb3adae128d86ccf801fc666b1c22115085bac7855","first_seen":"2024-08-29T18:11:34.810042Z","last_seen":"2026-03-10T22:58:05.622545Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3388,"timings":{"blocked":3083,"dns":0,"connect":0,"send":0,"wait":303,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/lives/ebet.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.942Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/lives/ebet.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-c038\"\r\nDate: Tue, 03 Feb 2026 09:45:40 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:40 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13961\r\nContent-Length: 36920\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 8665320269325744176\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":49208,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"a1b77348da5f9ef7177717ac87dcbd8a","sha1":"763bb6fbb933c85667a5918a29baa12079bac423","sha256":"712487d389024c62175885083afaea341de320b83fa25ab98ab945828a7b0958","sha512":"39655bd5c9b0687466517f134c42da2c094b0cf9a0f12801a84638cd1c247054d90c076ad064dd4e34e30c358f20845f3ff4dbd01f95af081e49a875f6bf3e30","ssdeep":"768:dCp163wWF1U2LWQdJ06f1/XkECPwmAVNnbHiZI9ncf8u/nf55PPw+2o3A2pO:UN+fWQdJ7xXkEC4tiZI9a7VL3K","tlshash":"9123f1b96001bb4daee1a65dd01e23e43eb8e71be34452e6b6cfe4518640e769f01c3d","first_seen":"2024-08-29T18:11:34.819233Z","last_seen":"2026-03-10T22:58:05.690076Z","times_seen":22,"resource_available":false,"data":null}},"time_used":4337,"timings":{"blocked":4074,"dns":0,"connect":0,"send":0,"wait":262,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/lives/shenbo.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.942Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/lives/shenbo.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-bbc5\"\r\nDate: Tue, 03 Feb 2026 09:45:41 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:41 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12243\r\nContent-Length: 36030\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 4086571271345956955\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48069,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"27392ea024620cccf577846a47de3a12","sha1":"09e4ba7c144ca298b46f47d0d7d920a51d9c4f3b","sha256":"19f91b7c24e1bc0ffb0f99c16078602a36156796ac50e0b242672db18d717067","sha512":"5ce0dc9f5d28e6bd410aaa9d1c2568ae9ffe55d0c4dce0b25fc3e90bced4f11e218969543554891680a17f249605e8ce0cc33555315fc1cd3a571939c52cc9b9","ssdeep":"768:7yx6J41uSp8auH6argFZtZkHfbohAR6Z/5vnE1dOL89woF11OyovwHVa6A2k:7a6J48SpB86jFZEKAR6B5vnE1dXwOrF6","tlshash":"3723f1b049074b32ad62c128916dd7737f86494f1be78497395eec1e00ede138b2b69d","first_seen":"2024-08-29T18:11:34.818157Z","last_seen":"2026-03-10T22:58:05.725539Z","times_seen":22,"resource_available":false,"data":null}},"time_used":4460,"timings":{"blocked":4156,"dns":0,"connect":0,"send":0,"wait":303,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/xiao.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.472Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/xiao.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-24ef\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13946\r\nContent-Length: 7193\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 3093593906408589905\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":9455,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"a19b1e8df8cccf07256d2ade6c26ddf6","sha1":"3490cd33b91e3482f732dd91402503aa28353f7f","sha256":"58ffad04bcdcc35be398974450a158f46825a403aff5d329bc99b60ee36d4a2f","sha512":"ecae134ab163db7dad5aa853538acc3f26e76dc4fc259168b7cf87befc3a520a1c2d07c4e39fe8e72bfc7a7d5ec2c0acfe9d4a813faa5b4fab81da447ca5ff0f","ssdeep":"192:9Wb7xxT2v2l1CczaykZEOBEiozqLvBy50zoxmOIs6UOPLvXocXyaP1T:9c7XT6Y1ysOeiozcvY50zCPIsJIjYcXz","tlshash":"d912c0c833e3e24c7c24bd8032d9e297998882ad8d39acf7675d954cc8758b4f1311c0","first_seen":"2024-08-29T18:11:34.86183Z","last_seen":"2026-03-10T22:58:05.617289Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1422,"timings":{"blocked":1101,"dns":0,"connect":0,"send":0,"wait":321,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/headerInfo.html?t=mmc19uv8","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.163Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ong3589.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 15 Feb 2026 17:36:53 GMT","end":"Sat, 16 May 2026 17:36:52 GMT"},"fingerprint":{"sha1":"D1:0F:86:D0:08:A4:EE:0F:52:A3:3A:D7:FC:F2:E8:89:8B:5C:11:07","sha256":"96:F3:97:A9:8E:8D:98:27:50:DA:C4:B7:D6:B3:F8:FB:B6:20:E3:8C:37:23:42:97:5B:24:BB:39:D5:0B:49:BD"}}},"request":{"raw":"GET /headerInfo.html?t=mmc19uv8 HTTP/1.1\r\nHost: ong3589.com:8989\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nCookie: sticket=VPV1ExTFRZeFpEQXp; route=44d17259ab44b1b54887077d522d7137\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-disposition: inline;filename=f.txt\r\ncontent-encoding: gzip\r\ncontent-type: text/html;charset=utf-8\r\ndate: Wed, 04 Mar 2026 12:49:15 GMT\r\nout-line: gb-cdn-014\r\nsub-sys: msite\r\nuuid: 07285-01-00000000-17726285552e1f\r\nvary: Accept-Encoding\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 118\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":127,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"JSON text data","md5":"5c754c1373c4080b5a8e950ef47dc1e0","sha1":"0bca4a86cfe96482e47b907fe725466d80f89281","sha256":"371c23c7a93c320786e52715e6feb5a4567d5786bab22824f971abb2b42b7201","sha512":"0835a13d37aa8fc1ef53830cbaedd16ab5168ec923b000ebd4c2d5624b67baed691230fb30128fab566b7e15e5b4be7389b74fb0b75253d828920373734fbaa6","ssdeep":"","tlshash":"16b09b24161bdd7d98875521c240055045550416f5c5790dd17c9a0d31ca1e65125617","first_seen":"2026-03-04T12:49:49.211181Z","last_seen":"2026-03-04T12:49:49.211181Z","times_seen":1,"resource_available":false,"data":null}},"time_used":230,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"ong3589.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/dian.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.790Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/dian.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-7443\"\r\nDate: Tue, 03 Feb 2026 09:45:37 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:37 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13949\r\nContent-Length: 21794\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5363192258341955198\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":29763,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"a25d1e7197084931fbe124bead9d51c0","sha1":"f294978face22af14fbf75669d466c2a2de004bc","sha256":"daca060d9d80e6b3bd65f7dc69b5c46a416f5c299428ab7ae2987a1aa101dc88","sha512":"131e03af09e1aaaee7bf6e5d488473cb624a99dc5533df6c651c5ea7919d6115bb84761e9c34efdfec6b26514b2cc860deb73623ef1d6c526f798ce935d3cfaf","ssdeep":"768:TIQDklFcVoLOtmtgTPsJ9W+jOf7avVZIxmRCd0:sggcuLO4tOsJ00/APy","tlshash":"bfd2e0396da13b302549153e850dfa2efff314a38e1722b2b2eb62355d21546e33c49d","first_seen":"2024-08-29T18:11:34.780368Z","last_seen":"2026-03-10T22:58:05.60789Z","times_seen":22,"resource_available":false,"data":null}},"time_used":322,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":303,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/language/language-ja_JP.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.866Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/language/language-ja_JP.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-65e\"\r\nDate: Tue, 03 Feb 2026 09:43:50 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:50 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1264\r\nContent-Length: 1147\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 16917448103057245959\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1630,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"ebfafa7812ff5a166c3a5651264fac64","sha1":"e3ba15c69c4b52125aa6c24fadced84ea20f9266","sha256":"e59169dff05de423209ce0204c75ef5670b8c5234bf7e60bcf607e83872e7cfc","sha512":"b8a0c7440d3a268f08a77e6e8d91392eaf0f49942017989f016fb18dcbd659d46ffec5ce1191ee6539045d2ee41b9b36e2ed5576e3656818455f77674c0794f1","ssdeep":"","tlshash":"5431f83f7a86fc0e2432812cb671222a3d254eef4e9a575e0846329b4a567bc1a509c8","first_seen":"2023-04-16T16:45:37Z","last_seen":"2026-06-07T07:30:11.550531Z","times_seen":5819,"resource_available":false,"data":null}},"time_used":2158,"timings":{"blocked":1930,"dns":0,"connect":0,"send":0,"wait":228,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/lives/hot_game.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.948Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/lives/hot_game.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-974\"\r\nDate: Tue, 03 Feb 2026 09:45:41 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:41 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1266\r\nContent-Length: 1811\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 16736075508179900698\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2420,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"6f6090b094cf64a371476fd7c8808cf2","sha1":"073cb52982f6f2c6d640ea3c12329ae1318d09b7","sha256":"4eac6996a45eb7a501ced8463970b904915a143319cfeb61aeb1f087538a377f","sha512":"4bf1473d0d74770a8b3386b118f8c2f70fd15d925a5d1af857a5fdc66af338eace3a51c73034c487cb6fd957fd499a773d1ba7be842dcf5068fc949bff0c41e3","ssdeep":"","tlshash":"2b41d72ac5756e1e8043289b0387046bee6b977386a4120ba1b14ad34b93d5782737e7","first_seen":"2024-08-29T18:11:34.820337Z","last_seen":"2026-03-10T22:58:05.737211Z","times_seen":22,"resource_available":false,"data":null}},"time_used":4666,"timings":{"blocked":4332,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/carousel/10100/1724235528645.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:20.929Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/carousel/10100/1724235528645.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Wed, 21 Aug 2024 10:18:48 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"66c5bf08-219a9\"\r\nDate: Tue, 03 Feb 2026 09:43:50 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Feb 2026 09:43:50 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12244\r\nContent-Length: 104234\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 3414115379395138291\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":137641,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"f4fe98cdb81debd36c8401ac6b28646f","sha1":"d3a95bac23c93d8c5bc9b4cb54094d338be26a2c","sha256":"ebe97dfcde9b102b2ea3640c7b0321a030275abbdeafcb2f712ccae4b7bf8218","sha512":"10ef4a6374ac57ca0d1409401cdfa596a57a8886ab5f2cb2c5de377630d62a64d8096674c0fbee40e0c7a8867efb3b7a003f29fce2a7db68f60eafeef81813e4","ssdeep":"3072:R9KGKqUoSIuinF9FX8XjpSYVZ80gFJDcj5dc3A7R0W028:6GKbAuSDl8tSYR6Jqdc+0WR8","tlshash":"56d31330260b68a653a02716627d848e4be9896f9b9d58448d703fe31735bd3cdf3ad8","first_seen":"2024-08-29T18:11:34.821431Z","last_seen":"2026-03-10T22:58:05.730147Z","times_seen":18,"resource_available":false,"data":null}},"time_used":306,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":303,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/D2.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.461Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/D2.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-1ea0a\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12244\r\nContent-Length: 95241\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 3642243148487983185\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":125450,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"e3fcc54a1d0b7b55c19f5d69b565c4a5","sha1":"fc450f0bc1022cb5bde7c7a35e8bc76995dbddd7","sha256":"9a545d8267334ce7d236ecabd666b2efd9dcc05d782bc259acbcfa0ae5d7c185","sha512":"336480c251c500e7e21baed4864c2a72412c046fcf5ff420aa94e0b6a248ebc8b9aaa7c79d73e05b6f51b9e4cc6d38c71a1960de3ed9ae33aefeef660b56005c","ssdeep":"3072:8E+cX4ifQFdLHkd4oTtChEDXAeheDti8NDjZ:v+M4CQFdLEGoTt8yAeheD97","tlshash":"4ac31274c89659fd466a19ca86ed2c15af70791a41773e7d0c3824c23e47eee73e0827","first_seen":"2024-08-29T18:11:34.859435Z","last_seen":"2026-03-10T22:58:05.625657Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1124,"timings":{"blocked":821,"dns":0,"connect":0,"send":0,"wait":301,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/xiao.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.474Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/xiao.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-24ef\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13946\r\nContent-Length: 7193\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 3110852199007780225\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":9455,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"a19b1e8df8cccf07256d2ade6c26ddf6","sha1":"3490cd33b91e3482f732dd91402503aa28353f7f","sha256":"58ffad04bcdcc35be398974450a158f46825a403aff5d329bc99b60ee36d4a2f","sha512":"ecae134ab163db7dad5aa853538acc3f26e76dc4fc259168b7cf87befc3a520a1c2d07c4e39fe8e72bfc7a7d5ec2c0acfe9d4a813faa5b4fab81da447ca5ff0f","ssdeep":"192:9Wb7xxT2v2l1CczaykZEOBEiozqLvBy50zoxmOIs6UOPLvXocXyaP1T:9c7XT6Y1ysOeiozcvY50zCPIsJIjYcXz","tlshash":"d912c0c833e3e24c7c24bd8032d9e297998882ad8d39acf7675d954cc8758b4f1311c0","first_seen":"2024-08-29T18:11:34.86183Z","last_seen":"2026-03-10T22:58:05.617289Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1422,"timings":{"blocked":1111,"dns":0,"connect":0,"send":0,"wait":311,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/B1.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.498Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/B1.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-9ce2\"\r\nDate: Tue, 03 Feb 2026 09:46:33 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:46:33 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 7217\r\nContent-Length: 30553\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 8366623386457694501\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40162,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"9d0d82d35159da46e0b6d6e17f69ea84","sha1":"947260d4e51e52eba52f6810bbe18dd592a0ddb0","sha256":"95fff414172b08503c7d2bb7b660b7dc904d8e0897eaed76d4ccd13c14abc2f9","sha512":"a3182c605d1ebdad67c7c771e27f1be0ed5c04be7297813d0138d615bb8cbf50927859590ba35a378ca2dea1496e25ddd0e9bcad807ab03410a0697e058db744","ssdeep":"768:pNXDnYSBobf2VK05V9wqupS+KYECSWJ+ytzuMO0UQLvTh4BeY:pNXDnXS2VjzXuFKYNSWJ+ytK9Ebh4Z","tlshash":"bd03f2a747968d529cdcb9c1947d83b9071360e41b662d8c692625f1cb0b328fbcc77b","first_seen":"2024-08-29T18:11:34.853592Z","last_seen":"2026-03-10T22:58:05.674976Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2012,"timings":{"blocked":1710,"dns":0,"connect":0,"send":0,"wait":301,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/images/partner/partner-hongtu-blueGrey.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.501Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/images/partner/partner-hongtu-blueGrey.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Tue, 02 Sep 2025 06:45:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"68b69275-19f49\"\r\nDate: Tue, 03 Feb 2026 09:43:49 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:49 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1265\r\nContent-Length: 80698\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 17648448745303457383\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":106313,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"37075466e8ede9937505a62ba591f77c","sha1":"46052e5f69ce3e53d15108e272c2a76dbfd02217","sha256":"3ff5df0b6596fa59aeeedd78fa1586a1ecd3749e70cd3e294c20888bca51851d","sha512":"ec78c9a7b8c0c6a83178da914e6dbf5fec3d6ed3dac5519385845a9b23d21027af90d0cd86ed2a3f337effcf09fbac31baaabe48696d0746e3e919342f7828e1","ssdeep":"1536:WWW522aOYO4kezvJYez8ZJ073qeCzSyqmxHW6iP2nPjm:WWW522dYnkeO08ZJ09eSHmx2TPOPjm","tlshash":"1da312581fb326ed956e424c4df9e5f1d42e60c291e2a2050fa0a3e2fc3c04785e6ee7","first_seen":"2025-09-05T06:26:06.67207Z","last_seen":"2026-04-17T04:44:35.189692Z","times_seen":1747,"resource_available":false,"data":null}},"time_used":1780,"timings":{"blocked":1496,"dns":0,"connect":0,"send":0,"wait":281,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/themes/images/ads1-txt.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:14.868Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/themes/images/ads1-txt.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 27 Jun 2024 08:50:10 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"667d27c2-328c\"\r\nDate: Tue, 03 Feb 2026 09:45:35 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:35 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12239\r\nContent-Length: 9744\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 226556271118640898\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":12940,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"0927f80f835ffa39248d5ada2fd6d2e9","sha1":"4cfbd1973ab6e6601aed8f0d254cc74be315588a","sha256":"8852008403313848f1a1c456b698150a0805b91d4b8e1708b6a6eb79cc85e2b1","sha512":"a7209628918cda5a7c9447e89db054509ddb86d91933965fdfa78ad825e757cb326eb760d37b9278e04fb80090ce5134b3501e395756917431061c5b3359da0f","ssdeep":"192:K0W3hrZYCp64+nbjf27qTZ7RUWK3JuhG0IjOydactFfdQnoVqEreMYwjuDYsD0yn:lGrZYCsXn+YE2D4BtFfSEWDYsYyX3","tlshash":"1b42cf2b7177bfb94befca28639ed47401baa9069c5440b4003f2d71ce9e114a468746","first_seen":"2024-07-09T10:27:16Z","last_seen":"2026-06-06T16:12:47.959946Z","times_seen":823,"resource_available":false,"data":null}},"time_used":1588,"timings":{"blocked":631,"dns":1,"connect":306,"send":0,"wait":313,"receive":2,"ssl":332},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/themes/images/icon_close.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:14.890Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/themes/images/icon_close.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 27 Jun 2024 08:50:10 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"667d27c2-add\"\r\nDate: Tue, 03 Feb 2026 09:43:48 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:48 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1265\r\nContent-Length: 2035\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 9192886875330445112\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2781,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"8595783c344b293c8f8693f497574216","sha1":"2cbb5d71832bfbe4e15150fb4aa5ec48a54f8f4e","sha256":"0caf174bd478ca1e77ec1e1590b767898150f559013194d95e9578b53eda8c7b","sha512":"5ed61afc368cf7527e0e91933569f38d4ef4a24cf4c2625e06d7aec5e2ae1e7e702b46d7d7ad56354fc8175bef7d1bd4f9cbcb842b3d95047c63b610043ffc02","ssdeep":"","tlshash":"f451483e6b7b6c0c80714a642da737393946853fa526284b9c1d1b0391a2fb6ab00ed4","first_seen":"2024-07-09T10:27:13Z","last_seen":"2026-06-06T16:12:48.047584Z","times_seen":684,"resource_available":false,"data":null}},"time_used":2018,"timings":{"blocked":1717,"dns":0,"connect":0,"send":0,"wait":301,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/zh_CN/pubads/images/ads1.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.405Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/zh_CN/pubads/images/ads1.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Mon, 01 Jul 2024 10:00:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"66827e29-3ec9\"\r\nDate: Tue, 03 Feb 2026 09:45:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:32 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13970\r\nContent-Length: 12108\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5176040721437678995\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":16073,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"a1ca510a947a44d3bb787550666b6b9a","sha1":"990e7b9a295642dc06be869563d7d2deb900c66c","sha256":"7653544bdb78e5272eea951760f303a64eb9caa5f8603a1467b27cda4d35896a","sha512":"3a3c5c075eb0f814c4f9366ca0367ac11fd4929bdf3a767051d9f10b7767c7e9e491ead521621e35314aa51074fb5a98f763c13e9eecd56df658b9d3cbd18465","ssdeep":"384:QGrfyK0lxmnfsgCTtPKOuWesuP/VmdIAgeZH:9f2LOsgctPKOG7m3H","tlshash":"dc72bf5124f4ba3982b1e7c83a5ddc382569272a7d1e522109ed367108e606c5fe4def","first_seen":"2024-07-09T10:27:14Z","last_seen":"2026-06-06T16:12:48.013176Z","times_seen":791,"resource_available":false,"data":null}},"time_used":535,"timings":{"blocked":237,"dns":0,"connect":0,"send":0,"wait":297,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/D1.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.451Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/D1.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-a686\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 7216\r\nContent-Length: 32425\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 17535085547861013014\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":42630,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"bf765d05c67b6bb0dc67487af8dfe12c","sha1":"0ec9f8af15101f64a6e86c9787e577233cd21d64","sha256":"dbf7b186b1de931784a70fac976043970d8645aa7070d02c97de489c43aec4e8","sha512":"17ec5c1f2867a3b19b900a21a2d848dd6c932387c68fe37c99733b11f39a15de359a11d76ea40307776f82a9a89aebcdaba41dc0d52e3178a8775968a0a40e6c","ssdeep":"768:JJQdRfZ7wPcivXhHVp1FVsav4pStJ4KA0DsW1KCjMJW4eOcIOMebPl4y:JydR14vh1p13P4gel0DsXCjaQ/MebPln","tlshash":"9e13f14216de283971889da4013f527382b3eb80f84e95d1ea2403ed05dbf26fa71f9d","first_seen":"2024-08-29T18:11:34.854921Z","last_seen":"2026-03-10T22:58:05.637056Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1002,"timings":{"blocked":746,"dns":0,"connect":0,"send":0,"wait":255,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/images/favicon/favicon_7285.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.481Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/images/favicon/favicon_7285.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Mon, 05 Dec 2022 08:15:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"638da88c-8c6\"\r\nDate: Tue, 03 Feb 2026 09:45:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:32 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13949\r\nContent-Length: 1599\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 13811488359365046833\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2246,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"0b6186a871ceccd47cdbbf8441a9fbe5","sha1":"9f8c0216563cd8a8a03413b847ebfbe8399f61b6","sha256":"3164d57e02536811b06d8c5a59ae2908c3fbb222cbe3f9fad237e2bc642c620d","sha512":"c6a20fdbab15cab3f4aaf6506decbf1b49cb6da756aa98b20e8dcb76c2ea5a1f2bef7c2adb8d037ca27d6d681bac0e46829c7baf28bc49a963c38d2c48efc734","ssdeep":"","tlshash":"a3411b7a5a6eed0e8c28955edcb730063e394a2f4e67121be46837726de777804407c9","first_seen":"2024-08-29T18:11:34.864127Z","last_seen":"2026-03-10T22:58:05.619434Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1591,"timings":{"blocked":1352,"dns":0,"connect":0,"send":0,"wait":239,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/idangerous.swiper.min.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.100Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/js/idangerous.swiper.min.js HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Fri, 11 Aug 2023 04:30:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"64d5b951-b083\"\r\nDate: Tue, 03 Feb 2026 10:26:44 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 10:26:44 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 253\r\nContent-Length: 11957\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 13396532615592339106\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":45187,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (32034)","md5":"f15409fb02c527ce1f66a2fd3c4aa0e9","sha1":"1e1e1bcc0f49e99e14ba34991cffe0745178d302","sha256":"1a1b5d3d6fbfc28abe37a668abd59494208c63c5f0b5d040cf4bbbd137f87c27","sha512":"66a384d6ad5fba862e778e24c43326a718328b6f860469fb5eb69c2687b0bbdc3c2dfa9049b0e3d5509214db1dbec4477f5c3654dc04446a505379a4300d4908","ssdeep":"768:oTFZ8CkWyYzh9MTvl7prcAgQW5ppZ+rPPWRqKDyBuq0t:cZiY9uTJuAgQW5LZ+rPPWRLt","tlshash":"5613f8c1b32031a741f3626e91fecb4271f54966aa05d4dcb5ed84c41ab489a03beff9","first_seen":"2023-08-15T12:01:05Z","last_seen":"2026-06-07T07:30:11.533498Z","times_seen":17303,"resource_available":true,"data":null}},"time_used":2857,"timings":{"blocked":2531,"dns":0,"connect":0,"send":0,"wait":325,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/images/partner/partner-hongtu-brown01.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.511Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/images/partner/partner-hongtu-brown01.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Tue, 02 Sep 2025 06:45:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"68b69275-1beff\"\r\nDate: Tue, 03 Feb 2026 09:43:51 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:51 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1265\r\nContent-Length: 86899\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 8273657676153338373\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":114431,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"13705bb454fa93a337d360fde95d32ed","sha1":"f17931976273af97665c359e14c5d7b673ded90b","sha256":"221a4adff18935e8dd8d421dd0dfb431bab972377ff4ead01e00cdc9dbf73127","sha512":"fc3c18262e7afc15b4716e6ed6869f20c27749dc181e010736e5314d0cc96d33826337eb3198e8425dbf01766d7c7cd2d85ce3cf594c4509106540464dda76a7","ssdeep":"3072:d1tyThaOfU3ozO51gip4i02XfacJ7TznFNnOOa:d1tyT8cUM5hcRnFVW","tlshash":"20b312a0dce07db423bb950ca3bc9f186243145f03a6269321b3f5430d627a4a6fd772","first_seen":"2025-09-18T16:22:49.418873Z","last_seen":"2026-04-17T04:44:35.216553Z","times_seen":1726,"resource_available":false,"data":null}},"time_used":2285,"timings":{"blocked":2034,"dns":0,"connect":0,"send":0,"wait":247,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/language/language-in_ID.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.877Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/language/language-in_ID.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-5f0\"\r\nDate: Tue, 03 Feb 2026 09:45:38 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:38 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12241\r\nContent-Length: 1009\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5207983700086273528\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1520,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"f290bf969c50387c3e1f05a5e9ecfa71","sha1":"497beb2c1f6f1851785070b95d86b54a17a20df9","sha256":"cff07b4f6c975d981e02a521d63d31f3cd99a2d8bae77b8d471d12faa034f916","sha512":"2c76d3f76d61b1ce3588836830b1d4723136512057533c1326b6d1fccffa6e3f65abbec20579d6ec1a9d785e4081d7311bc67a1dd6149ff9d533ef14ae787f16","ssdeep":"","tlshash":"2831e72fbd5a725a64b78a14b7c742093d25056b6ca1149e1846321b857e36007c15e9","first_seen":"2023-05-06T23:50:24Z","last_seen":"2026-06-07T07:30:11.506487Z","times_seen":5821,"resource_available":false,"data":null}},"time_used":2389,"timings":{"blocked":2149,"dns":0,"connect":0,"send":0,"wait":240,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/images/zh_CN/header_img3.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.349Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/images/zh_CN/header_img3.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Wed, 14 Jan 2026 02:25:23 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6966fe93-74d\"\r\nDate: Tue, 03 Feb 2026 09:45:30 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:30 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12244\r\nContent-Length: 1456\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5583112024016284403\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1869,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"535013d69ca460359a38d0273be57d86","sha1":"b978b6ff14a1f0964275d76d5255f7bbd3744b31","sha256":"cdb0960412c659358055f6c21821225ad88eadb9df3eab22821aeb034eeeb45f","sha512":"cadc3a3cb9ace1135f122e3255a05716aee43b54ba918cafb31bd7c89ed81f95e1bf1e6f20de8b7bf0cb7745806891e9ed13859bc3d6d5fd5eb75f4a65ed28c9","ssdeep":"","tlshash":"7c31f72428705a974dbddc8871299a58ae1f76f3fa2667e7b3c4581694637404813e0f","first_seen":"2026-03-03T22:07:02.38473Z","last_seen":"2026-03-10T22:58:05.692937Z","times_seen":9,"resource_available":false,"data":null}},"time_used":309,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":309,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/zh_CN/pubads/images/ads2.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.416Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/zh_CN/pubads/images/ads2.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Mon, 01 Jul 2024 10:00:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"66827e29-6655\"\r\nDate: Tue, 03 Feb 2026 09:45:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:32 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12244\r\nContent-Length: 19812\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 13807043691459880720\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":26197,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"134cab569b32d8e806132a4a16de2f4f","sha1":"84bf6e92d2d6d7c9d280e251095589bddbff41ad","sha256":"a1f9fa4a21d84a44696634d64020a8517e2f63858fd460e4717aa9a54acbb410","sha512":"4f0b40c8c6affef43e31772d681245ee4862ac5efd86f12eb89272ceee764ab9cbb7a09e42903df1a9d0abf67298e9fbaebbeb86e2cece25eeb22f7c3c1237b8","ssdeep":"768:Wyek0+Drh5jUQpp6u3i7F6Jc68hTzT42Nda:WyekN5vY9UJcrTz02e","tlshash":"51c2e15f778922be3b0e0523bd51bd2682995f2370a218a5a4df623545b283081ef8e5","first_seen":"2024-07-09T10:27:14Z","last_seen":"2026-06-06T16:12:48.004579Z","times_seen":792,"resource_available":false,"data":null}},"time_used":575,"timings":{"blocked":253,"dns":0,"connect":0,"send":0,"wait":321,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/notice.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.435Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/notice.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-67a\"\r\nDate: Tue, 03 Feb 2026 09:45:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:32 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 9224\r\nContent-Length: 1317\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 2363454109361849588\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1658,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"73fbb03fc6b86699390e28e6ad0e53ef","sha1":"b0830d6c6eab2e68e1bbc9e6e0c40303080fbfd5","sha256":"e9d058ddca1a970860baa3e247e6a60e042950a8a7c8c78da4c12b08735e4c12","sha512":"3f5ca97dc92bf4dfcf1fc10b45879b0273fbc489fe7e2895ed6a81febc66aba2b2e1ff47f3fee46d5b2a1116732dc0423bf1e3a2a0bc48db7ff95aa79e51a5d0","ssdeep":"","tlshash":"1e31ea750ca1ddf24e95e8cde0a73fdecdf924aa39c2b25d05fa8801a359a258112402","first_seen":"2024-08-29T18:11:34.848193Z","last_seen":"2026-03-10T22:58:05.618347Z","times_seen":22,"resource_available":false,"data":null}},"time_used":670,"timings":{"blocked":434,"dns":0,"connect":0,"send":0,"wait":236,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/E2.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.500Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/E2.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-1a32e\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12245\r\nContent-Length: 81469\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 15428675013853228150\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":107310,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"80759e249da5c14b91fa7f0c67564cef","sha1":"fcd788c2427aac9fb9cb04be47a3d80f96358a2a","sha256":"cb1fd8ae5a37098b56918fd32f3432d72f12b9dc2ad41b6163f39ec8eef77147","sha512":"54f6c49767adce29a4d0de1c5d9fa4174b8990f91fa6c67408c188b96e9d0f646e1780b3ce68f8f66a407d160bd3bfce0cd19a6b5f09f8c407cd164ccfb71723","ssdeep":"3072:WUTLrxo4qtrnELkG1jYBx7yixJiy+DL72+8VTrSBde2U:WKVdqt7ELkoj4wixJit7QVfiMH","tlshash":"5ea312b5bc13a5d20a4bf793340ff8549e6711bb913505ba07499accdeb271a338930b","first_seen":"2024-08-29T18:11:34.855962Z","last_seen":"2026-03-10T22:58:05.701271Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2000,"timings":{"blocked":1741,"dns":0,"connect":0,"send":0,"wait":252,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/images/partner/partner-hongtu-silver.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.506Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/images/partner/partner-hongtu-silver.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Tue, 02 Sep 2025 06:45:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"68b69275-1eb1d\"\r\nDate: Tue, 03 Feb 2026 09:45:37 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:37 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1265\r\nContent-Length: 95601\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 10661674551614965079\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":125725,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"5f6980b5f154060a1d83407f4c95b0a6","sha1":"62e410c7edcbbdcb24a07444f9ebaa79a4047f92","sha256":"522e1c9e3407783f021aa3d7b4c19179ee6d2784358e8dc3960fdd93e996f720","sha512":"ffee4c4b7962e3b1ab48896394cc18e7ed3eb1d199a56e4bed2c29934b20ee1706619969ac82a3c6840cb1b617f90d7c16a9c7080b2d8c1a905be0f5ca922206","ssdeep":"3072:uVcAUgIZn4dMj6qCKK2si2pXQ5kbTSfE2BBsUdSTIC4RvJ:uSAUnmD2AgObTEE27fdR","tlshash":"20c313e136ecbc5cee44d632a5ca9960c250abde89f1c48bc6da50ca141335c9dceedd","first_seen":"2025-09-06T20:06:14.266784Z","last_seen":"2026-04-17T08:59:04.285034Z","times_seen":1773,"resource_available":false,"data":null}},"time_used":2038,"timings":{"blocked":1774,"dns":0,"connect":0,"send":0,"wait":240,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/style/bootstrap-dialog.min.css","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.072Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/style/bootstrap-dialog.min.css HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Wed, 29 Sep 2021 08:29:10 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"615423d6-adc\"\r\nDate: Tue, 03 Feb 2026 12:08:56 GMT\r\nContent-Type: text/css\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 12:08:56 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 254\r\nContent-Length: 625\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 7249279546731558369\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2780,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"633098d68444fae4feec36e757a6498c","sha1":"83244d45a17b6ba8fbf67c41b2ce4e2322db8421","sha256":"7fd1c34d205f2165ee1b3cc3c2fe54af6f115c58bbd849907c3cf2be6814b159","sha512":"f1aebd6f3446c67bc9e11f0e3c95549431c9dd009cb2ab8ec1c95eddafa46ae946134ca50b9b1973a4875048c8d78a3682386cdff8335a689daef27dbc61b299","ssdeep":"","tlshash":"2751791c0eaa0895e15f45c877ee6f2164b83093444eae9937ef332c8f85466b9f6b14","first_seen":"2023-07-23T08:02:00Z","last_seen":"2026-06-04T13:13:28.825134Z","times_seen":1228,"resource_available":false,"data":null}},"time_used":4768,"timings":{"blocked":2215,"dns":1559,"connect":318,"send":0,"wait":325,"receive":1,"ssl":347},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/float.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.098Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/js/float.js HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 26 Aug 2021 07:50:18 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"612747ba-1b2f\"\r\nDate: Sat, 14 Feb 2026 06:07:25 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Tue, 17 Feb 2026 06:07:25 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 253\r\nContent-Length: 1929\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 11694661037152322532\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":6959,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"829af863b0cdc4a603919824ae046299","sha1":"1d417b1553e4ecb7125ebf2005b74255291fbf73","sha256":"1dbe4afbc9ed220c08b9e95577b56f83e2e8e0f7620c5dc18266bb325e5bb271","sha512":"e1202fa26fd353dfb2f989d3d45512e0691c062076297399f5fe62f63e7f5b194fec4a3d7fe2f09be1a6a945e197e7d68445d33dcc6f80b23a315112d9ae5b6c","ssdeep":"96:G4SXFXVXDL+R5NxuHie/moRUgIm/Kv3RKXg+Iw3qCNv5IC80b7Yr+HpH:G7xhDL+jNxzeBVLKJ1LeqCwCxb7YspH","tlshash":"04e1506e03b1212195aff1beaf1e424c6631905b2507dd057e0c87c46fa493c4636fee","first_seen":"2023-03-07T01:14:38Z","last_seen":"2026-06-07T07:30:11.51234Z","times_seen":17483,"resource_available":true,"data":null}},"time_used":4742,"timings":{"blocked":2191,"dns":1529,"connect":362,"send":0,"wait":351,"receive":0,"ssl":306},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/jquery/jquery-1.11.3.min.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:14.375Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/js/jquery/jquery-1.11.3.min.js HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Fri, 20 Sep 2019 08:35:27 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"5d848f4f-176d4\"\r\nDate: Tue, 03 Feb 2026 21:42:27 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 21:42:27 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 255\r\nContent-Length: 33545\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 14272990510935066997\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":95956,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (32038)","md5":"b091a47f6b91e26c93a848092c6f3788","sha1":"52918af2d431e73464060b35d364640c8db75606","sha256":"329ab92b9276ef4e3148f69be6b208969bebdf2db3121a589caa172453fd9f10","sha512":"ab444102be476f0104eeff79c9b596174852b4fe8cbd0b5a0279d56f106a166ec39304636e09326213de000b102ce8f517bb268a9abb2955c56ee4f18b464ea8","ssdeep":"1536:OP10iSi65U/dXXeyhzeBuG+HYE0WEeLDFoNqLTW8+S5VRZIVI6xSb8xh2ZbQnRmS:R+41ZqLTW8xRrqSb8qGH77da98Hr3","tlshash":"6893d8d9b7d67162977730b850bf510bb13a98eab80c4ca0f0a4d8e47d74a89507bf2d","first_seen":"2023-03-07T01:10:10Z","last_seen":"2026-06-07T07:30:11.536389Z","times_seen":18326,"resource_available":true,"data":null}},"time_used":288,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":286,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/list_arrow.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.805Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/list_arrow.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-5c4\"\r\nDate: Tue, 03 Feb 2026 09:45:37 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:37 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12239\r\nContent-Length: 907\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 15651985768495303744\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1476,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"c3e338273415fe4408f07930df76cbb6","sha1":"558ad3246dee36fcd8da6370914c4df52c6740cb","sha256":"af109f128ef0967f4e2955b851b255703bf63b37b985ee43522db634bd5e45f6","sha512":"1c304dc0a6a5773fc42f201956f17580c3b6bf821df1fc31afc92d7f9b0c0c2b2d1a8f8b11486dfcda6918209691411b1168b70b24fa126b4a43b7def8f7c1d3","ssdeep":"","tlshash":"3631b5be6a37b34e40b5c40eebd5d536dd195c4a74282e73a171342208983006a926bb","first_seen":"2024-08-29T18:11:34.778187Z","last_seen":"2026-03-10T22:58:05.609182Z","times_seen":22,"resource_available":false,"data":null}},"time_used":227,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":227,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/language/language-en_US.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.856Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/language/language-en_US.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-858\"\r\nDate: Tue, 03 Feb 2026 09:45:38 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:38 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13951\r\nContent-Length: 1509\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 6516583630743554950\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2136,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"a44e99626d1ffdebc9145d5eeb7a515a","sha1":"6d31235bdcbe6772c40af2ead4f4a07f0f1701fe","sha256":"a0f96f7f43630d5c12ff62c0124384305898121b9f57a29bcaf9024bd72e80f0","sha512":"b97f9d3163aa5923600ce2dae40463de68b2c1a04cb73710facf7f7af853081bcdef4ddbc1ba0bf2061f78e27462215019af4179513ced4660dac6ff01bca972","ssdeep":"","tlshash":"92411a3e5be6711f4861cc54f1e531c63e28496f2a1577f9446232c95b45b3c4282fcc","first_seen":"2023-04-16T16:45:37Z","last_seen":"2026-06-07T07:30:11.505904Z","times_seen":5822,"resource_available":false,"data":null}},"time_used":2229,"timings":{"blocked":1883,"dns":0,"connect":0,"send":0,"wait":345,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/E1.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.444Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/E1.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-85fa\"\r\nDate: Tue, 03 Feb 2026 09:46:33 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:46:33 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12239\r\nContent-Length: 26111\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 1582283265294323720\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":34298,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"630e6b0182e68b8ff397e15b66ae3e5e","sha1":"5130135783ce8ecf1a48efa711bb2b47aeb15968","sha256":"d9ff115f6fbe156e26f8405fa840e5db191ffa884e038f9c28d5179de0174953","sha512":"c9f8c70eb8af346699e9251cfcbd2487a639c72486c951b579fbda42bcaa9bcb610f07e32b35eea4b700bb001f9c6778ccc28f6517c841ea8eaaee79413ffbed","ssdeep":"768:jwp+8hiToaPJUwzqMen0XuJhmINuVT51AE:I+8oE2UwzqMg0+LpHE","tlshash":"39f2e180188739b7de1dce00cf6bdba4e9d1a7882d4ffd5b651e5aa50644c2d460ba8c","first_seen":"2024-08-29T18:11:34.852454Z","last_seen":"2026-03-10T22:58:05.655728Z","times_seen":22,"resource_available":false,"data":null}},"time_used":896,"timings":{"blocked":547,"dns":0,"connect":0,"send":0,"wait":348,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/E2.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.452Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/E2.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-1a32e\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12245\r\nContent-Length: 81469\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 17185979133808032917\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":107310,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"80759e249da5c14b91fa7f0c67564cef","sha1":"fcd788c2427aac9fb9cb04be47a3d80f96358a2a","sha256":"cb1fd8ae5a37098b56918fd32f3432d72f12b9dc2ad41b6163f39ec8eef77147","sha512":"54f6c49767adce29a4d0de1c5d9fa4174b8990f91fa6c67408c188b96e9d0f646e1780b3ce68f8f66a407d160bd3bfce0cd19a6b5f09f8c407cd164ccfb71723","ssdeep":"3072:WUTLrxo4qtrnELkG1jYBx7yixJiy+DL72+8VTrSBde2U:WKVdqt7ELkoj4wixJit7QVfiMH","tlshash":"5ea312b5bc13a5d20a4bf793340ff8549e6711bb913505ba07499accdeb271a338930b","first_seen":"2024-08-29T18:11:34.855962Z","last_seen":"2026-03-10T22:58:05.701271Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1752,"timings":{"blocked":773,"dns":0,"connect":0,"send":0,"wait":976,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-04T12:49:08.507Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ong3589.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 15 Feb 2026 17:36:53 GMT","end":"Sat, 16 May 2026 17:36:52 GMT"},"fingerprint":{"sha1":"D1:0F:86:D0:08:A4:EE:0F:52:A3:3A:D7:FC:F2:E8:89:8B:5C:11:07","sha256":"96:F3:97:A9:8E:8D:98:27:50:DA:C4:B7:D6:B3:F8:FB:B6:20:E3:8C:37:23:42:97:5B:24:BB:39:D5:0B:49:BD"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ong3589.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ncontent-type: text/html; charset=utf-8\r\nlocation: https://ong3589.com:8989/\r\ncontent-length: 60\r\ndate: Wed, 04 Mar 2026 12:49:09 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":640667,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T12:34:25.437902Z","times_seen":16239334,"resource_available":true,"data":null}},"time_used":1131,"timings":{"blocked":454,"dns":14,"connect":218,"send":0,"wait":218,"receive":0,"ssl":224},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"ong3589.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/websocket/CometMarathon.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.105Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/js/websocket/CometMarathon.js HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 21 Apr 2022 04:30:12 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6260ddd4-2f13\"\r\nDate: Tue, 03 Feb 2026 10:27:31 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 10:27:31 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 253\r\nContent-Length: 3316\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 11502492262856836633\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":12051,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"466a7ed7d00986d45375c0cbffb5233c","sha1":"68845ead668e9abd29c24b491dbf97b219226c08","sha256":"7ddafae5a0a552d2d56101cdc8306403e8fb9570759d66c48b25893b409f0123","sha512":"752801557c12ee7830f1f2e55352ab9c033aff01ff79abdffaee1601c54cdfc85a2041facfc5a7e180706812be5ad08668eada116544197fd2a784bac1903ea0","ssdeep":"192:0Pf+0Sn4NyRSTTPhvygOdWuTdC3d7QPXLHOm8cSCl1Ej3m7YAPzhsoqFncJ0j:0Pf+fnwfcXSaGLj","tlshash":"9e32314b6cf75085592b32b50f9f24447239d8572605e81c7dccaae48f98b6c0b6bfb8","first_seen":"2023-04-05T18:30:47Z","last_seen":"2026-06-08T03:51:22.324795Z","times_seen":17453,"resource_available":true,"data":null}},"time_used":2994,"timings":{"blocked":2684,"dns":0,"connect":0,"send":0,"wait":309,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/mobile-api/v5/chess/getActivityMsg.html?function=sign","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.409Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ong3589.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 15 Feb 2026 17:36:53 GMT","end":"Sat, 16 May 2026 17:36:52 GMT"},"fingerprint":{"sha1":"D1:0F:86:D0:08:A4:EE:0F:52:A3:3A:D7:FC:F2:E8:89:8B:5C:11:07","sha256":"96:F3:97:A9:8E:8D:98:27:50:DA:C4:B7:D6:B3:F8:FB:B6:20:E3:8C:37:23:42:97:5B:24:BB:39:D5:0B:49:BD"}}},"request":{"raw":"GET /mobile-api/v5/chess/getActivityMsg.html?function=sign HTTP/1.1\r\nHost: ong3589.com:8989\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nCookie: sticket=VPV1ExTFRZeFpEQXp; route=44d17259ab44b1b54887077d522d7137\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-headers: Content-Type,Access-Token,X-Requested-With\r\naccess-control-allow-methods: *\r\naccess-control-max-age: 3600\r\ncontent-disposition: inline;filename=f.txt\r\ncontent-encoding: br\r\ncontent-type: text/html;charset=utf-8\r\ndate: Wed, 04 Mar 2026 12:49:15 GMT\r\nout-line: gb-cdn-014\r\nset-cookie: route=251410696cadec6a5b6c74aa4706df12; Path=/\r\nsub-sys: mobile\r\nuuid: 07285-01-00000000-1772628555afc2\r\nvary: Accept-Encoding\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 112\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":140,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"JSON text data","md5":"5d062bc93ef9d75b27e852ed745d170f","sha1":"1ecf82a0589608b26ee6a29b2cc3229916596626","sha256":"26e77aa8c61c230db13c8fd74d4ab3adf8be54c3192c4e16f94e633a71efc2e1","sha512":"44400ff6867b380b16fdfda60ff144dfcc9bc4d7adc38c84a98f20d2a8911304f694eca3afe2cf9ce9538a7c49b1fb471694b4b68215c6ccc6027571b8b5ac34","ssdeep":"","tlshash":"f2c02b86f21818b38b030bd010e83d41c3fd11b2c0c84848dc4c8e4802b48ffd301837","first_seen":"2023-04-05T18:30:47Z","last_seen":"2026-06-06T23:51:10.815511Z","times_seen":7427,"resource_available":false,"data":null}},"time_used":237,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":236,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"ong3589.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/chess/p-ky-img.jpg.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.926Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/chess/p-ky-img.jpg.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Wed, 04 Mar 2026 12:49:19 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nX-Frame-Options: SAMEORIGIN\r\nServer: SLT-MID\r\nContent-Length: 150\r\nX-NWS-LOG-UUID: 16631008388125163274\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":150,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"597ba0d4396e9c906225140ce907092c","sha1":"28ae2ba65ccdb583d79f85b8cc9509fae697493b","sha256":"ee1a27178227546d3dcc49e611a6d72e4f1c30080ee4493ae4085b58a49e28e6","sha512":"8898f14bd6cb5c72d6ee5878af3700be6d03b56a5a21a3d58ef347f008acf4ac68a46a908903e1d42999c1e259e77d7df686c94765865ae07361b2c4e04adf2c","ssdeep":"","tlshash":"18c02b2d24137c0c8663307636c37050c1978337a67e10210400805330cf1998ac33af","first_seen":"2023-04-05T14:00:46Z","last_seen":"2026-06-08T12:33:36.722289Z","times_seen":36081,"resource_available":true,"data":null}},"time_used":3941,"timings":{"blocked":3098,"dns":0,"connect":0,"send":0,"wait":827,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/xiao.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.478Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/xiao.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-24ef\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13946\r\nContent-Length: 7193\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 12078356053695440514\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":9455,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"a19b1e8df8cccf07256d2ade6c26ddf6","sha1":"3490cd33b91e3482f732dd91402503aa28353f7f","sha256":"58ffad04bcdcc35be398974450a158f46825a403aff5d329bc99b60ee36d4a2f","sha512":"ecae134ab163db7dad5aa853538acc3f26e76dc4fc259168b7cf87befc3a520a1c2d07c4e39fe8e72bfc7a7d5ec2c0acfe9d4a813faa5b4fab81da447ca5ff0f","ssdeep":"192:9Wb7xxT2v2l1CczaykZEOBEiozqLvBy50zoxmOIs6UOPLvXocXyaP1T:9c7XT6Y1ysOeiozcvY50zCPIsJIjYcXz","tlshash":"d912c0c833e3e24c7c24bd8032d9e297998882ad8d39acf7675d954cc8758b4f1311c0","first_seen":"2024-08-29T18:11:34.86183Z","last_seen":"2026-03-10T22:58:05.617289Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1561,"timings":{"blocked":1220,"dns":0,"connect":0,"send":0,"wait":339,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/notice.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.483Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/notice.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-67a\"\r\nDate: Tue, 03 Feb 2026 09:45:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:32 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 9226\r\nContent-Length: 1317\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 2444004301110902881\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1658,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"73fbb03fc6b86699390e28e6ad0e53ef","sha1":"b0830d6c6eab2e68e1bbc9e6e0c40303080fbfd5","sha256":"e9d058ddca1a970860baa3e247e6a60e042950a8a7c8c78da4c12b08735e4c12","sha512":"3f5ca97dc92bf4dfcf1fc10b45879b0273fbc489fe7e2895ed6a81febc66aba2b2e1ff47f3fee46d5b2a1116732dc0423bf1e3a2a0bc48db7ff95aa79e51a5d0","ssdeep":"","tlshash":"1e31ea750ca1ddf24e95e8cde0a73fdecdf924aa39c2b25d05fa8801a359a258112402","first_seen":"2024-08-29T18:11:34.848193Z","last_seen":"2026-03-10T22:58:05.618347Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1724,"timings":{"blocked":1414,"dns":0,"connect":0,"send":0,"wait":310,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/contact_bg.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.495Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/contact_bg.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-912bf\"\r\nDate: Tue, 03 Feb 2026 09:46:33 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:46:33 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12245\r\nContent-Length: 452164\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 17142404206322163344\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":594623,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"b363cbc664708370a7e09b72c84a04fa","sha1":"c10de0654eb1dc7cb92bfb5c59ee151667e61c68","sha256":"5e1ad33973b57d09e2fa222806d6464507f14b3458afe4257813e86ea1a463fd","sha512":"28a66627e77c86ba6c5a7a1a5a5040716ba176b27fa9675f61bdd44b2547aecc41e54f15a3b53a51103c39b828969c541a01939972e0631823ecfc6abc3ed611","ssdeep":"12288:EzqOSmha58mpRQ7zvhGBQIQuBx0XjzgMi3PgW479nGNzTEzrz8UR:TmAjQ7SGQ0XQN34WO9GJC","tlshash":"70c4239aadf8bcbdc13cd15db2693f2413b52f550dca35ee3ba631831b128604072967","first_seen":"2024-08-29T18:11:34.851292Z","last_seen":"2026-03-10T22:58:05.603242Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1906,"timings":{"blocked":1578,"dns":0,"connect":0,"send":0,"wait":239,"receive":89,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/floatImage/233/1709812337930.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.544Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/floatImage/233/1709812337930.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 07 Mar 2024 11:52:17 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"65e9aa71-3869\"\r\nDate: Tue, 03 Feb 2026 09:45:42 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Feb 2026 09:45:42 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12247\r\nContent-Length: 10816\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 8561228833630980432\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":14441,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (14441), with no line terminators","md5":"fd7725dadf04a889b94561fd5a437f20","sha1":"31ecc4dcef6600ed4e2954d5fff230841453d7e4","sha256":"421c3c5e5deee0010ddb66eb7bb0c085857ed3466bd91f7f080b67f2c18d32c0","sha512":"5c8bad813f7ce0a4c97d26d64861006e9cc9b0dda78caaad04f82963f123a4ad27658fe508848886f84b082896034d669c61599cbab6aba2a9ffe769a384379c","ssdeep":"384:IQg0gkSPaNT+4pOWfFzLVdiuMkvZBwHcjFGJhfjyKqd1BnjH0y:Q0gkSCNy6FldiuTZG8hGTuKU1Bnr0y","tlshash":"7552cfabbf1f080c604b4128a41eb55e2ce4904a6be533b7f4fc32ce2a65772195541b","first_seen":"2024-08-29T18:11:34.884515Z","last_seen":"2026-03-10T22:58:05.694631Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3768,"timings":{"blocked":3437,"dns":0,"connect":0,"send":0,"wait":330,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl//commonPage/commonContent/nav/images/icon-menu-api.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:14.857Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl//commonPage/commonContent/nav/images/icon-menu-api.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Tue, 02 Sep 2025 06:45:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"68b69275-40dfb\"\r\nDate: Tue, 03 Feb 2026 09:45:35 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:35 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1265\r\nContent-Length: 201871\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 6135273783061708598\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":265723,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"76d497e86a00b805a70ff97bdb743d78","sha1":"b6be1d2c17da2c76b00096a042de2e480a28efbd","sha256":"a568e7d2dbcf32cb781dd6d99a047cc36553d3df1e7d728170f3dff4d6235ce6","sha512":"144b081f7143a469e086d57b9822ee39e971bfea9a511734163475dcf42207feca2bd90546f08d97086438bd368b5355abe4db98f4a0adb57c010dffd6282a64","ssdeep":"6144:dsESHvc42SEl34G48NAcpznkqbvq0To5Qw0uq4+:dsa42SEC8yU4qbvq0U50uf+","tlshash":"f44423d4cf736d7001aae326a41dfe5c06a6a64b0c70359f626d43db1739a835a0bf78","first_seen":"2025-09-05T06:26:06.673661Z","last_seen":"2026-04-18T11:26:56.647725Z","times_seen":1600,"resource_available":false,"data":null}},"time_used":1875,"timings":{"blocked":214,"dns":0,"connect":0,"send":0,"wait":1160,"receive":501,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/chess/gpi-img.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.910Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/chess/gpi-img.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-f62b\"\r\nDate: Tue, 03 Feb 2026 09:45:39 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:39 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12241\r\nContent-Length: 46519\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 10148066249965857628\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":63019,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"f841f46c3d2e345948670b3af99b6d05","sha1":"356646a76574e024a0ca81bfd1b9edbf4522de24","sha256":"164041d5cd71ac787f253406439390d051f76ff349f82e709a8675268c4f87e8","sha512":"18538250c22606ed69f1fef275d323d0160d76c6ccb645281b2ee00d24cf62c7b70c868e79a2d1e7f55d97e109b50d2d2a37648402fcae60adc29f4415c0c531","ssdeep":"1536:S7DwRTc62jfGrZWrKzsBq2CGgmmaHZXCQ+ub:ywtKjbmzsBqagmvH59","tlshash":"a5530271ab600358fdb0fbfd9aa61d1c69a452d36462ebf744bf4e4858240c04d4b9df","first_seen":"2024-08-29T18:11:34.805196Z","last_seen":"2026-03-10T22:58:05.699904Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3097,"timings":{"blocked":2808,"dns":0,"connect":0,"send":0,"wait":288,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/lives/wm.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.940Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/lives/wm.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-101a1\"\r\nDate: Tue, 03 Feb 2026 09:45:40 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:40 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12242\r\nContent-Length: 49352\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 17495376547954640380\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":65953,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"031ce1bbb647825010f9d3b57fe43ae7","sha1":"e326a0c41fa8a956ac2c7bb54acc6ae3ca37937b","sha256":"dd579ed8b664494b0ca208ac6cf664621a7670e63bf4d2a6278f97c91120a46e","sha512":"0d592a69d7bd452ed235c85d192622e04a03176409d721a0ddb2edbc18efe67bcbb158c4ef5d1285bd82ba5f0322db084f28179751967a5fdd68a240a87dc9cc","ssdeep":"1536:4mB8oGu32HS5tcoSCOCCZ3w8TsHiQJcanLmKj5tPKylNoCS:gpu3b56BLCE3PsHtf5pKy4CS","tlshash":"d5530101c1b18ebdc6cd875a2d7b74a17e3cf2fb2cad24a7c5d34f9290266a505b2c11","first_seen":"2024-08-29T18:11:34.816959Z","last_seen":"2026-03-10T22:58:05.667982Z","times_seen":22,"resource_available":false,"data":null}},"time_used":4176,"timings":{"blocked":3927,"dns":0,"connect":0,"send":0,"wait":243,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/sports/btm_img.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.838Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/sports/btm_img.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-5078\"\r\nDate: Tue, 03 Feb 2026 09:45:37 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:37 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12239\r\nContent-Length: 15689\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 1685897000916913485\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":20600,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"e423f1c1a8a28e73f06ad6e459973d23","sha1":"f5f4fbad7a2f4dda470844ee697c98ec9af66512","sha256":"5d103d2aed7a924228ca15131221e5319c18331c681b33d6d7e7e66dc4a8f979","sha512":"bd19deb25ad83daa9a245f1b2aff913e641765c8df9254918de256fb46477731c582fcba6880b950da3ed19529bdd16592cedc841b3db18a56744cea493967b0","ssdeep":"384:ts5R7hJzve8yKGgOzCrRU0lwgv1LQv3eERpUFxxuouY1kDXQrrF2vGu6nUNZVwLp:ts5RlJz1JOz8pdkvuEcFujXQYvgEZVmp","tlshash":"8e92e1b6539d3e184709e4bebbb07d5c16e3bf41412112ff356ce8c242eb17a48854ae","first_seen":"2024-08-29T18:11:34.781783Z","last_seen":"2026-03-10T22:58:05.71958Z","times_seen":22,"resource_available":false,"data":null}},"time_used":317,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":316,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/lives/bb.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.935Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/lives/bb.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-2ecff\"\r\nDate: Tue, 03 Feb 2026 09:43:53 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:53 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12242\r\nContent-Length: 144852\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 3028821549661796023\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":191743,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"d4e484949291c817bd9141d2a8a97bcf","sha1":"b6870e87799fac094cc6a962ff590825cd37be15","sha256":"f7e4857b2a720418a21e916cf1f19dbb0799146f1e80e4e91b77867842011e82","sha512":"b0e2a61502d4abeef859a9abbe7e1317db746b8c5c2b311e55ecc63da094d517ba087bc4554813819b41b0a4b27584cfcb222ea23996f20b4e13086eef004b28","ssdeep":"3072:OB5e+gEO/BqhMyodL2mXA8TN6Z6tHpJVkseMU8zo8jYLV+mtyyaJH6lvGpwdxHfg:25PgEOpYMyuL2mw8cZ6tHpV4eZ4faJHN","tlshash":"0f1413b03b171b5586d8cba8c8a72aca2fda2cfb5f4626c1050d55cb08b3f67163f465","first_seen":"2024-08-29T18:11:34.82371Z","last_seen":"2026-03-10T22:58:05.601888Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3947,"timings":{"blocked":3625,"dns":0,"connect":0,"send":0,"wait":314,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/B1.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.448Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/B1.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-9ce2\"\r\nDate: Tue, 03 Feb 2026 09:46:33 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:46:33 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 7216\r\nContent-Length: 30553\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 17049025653100430648\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40162,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"9d0d82d35159da46e0b6d6e17f69ea84","sha1":"947260d4e51e52eba52f6810bbe18dd592a0ddb0","sha256":"95fff414172b08503c7d2bb7b660b7dc904d8e0897eaed76d4ccd13c14abc2f9","sha512":"a3182c605d1ebdad67c7c771e27f1be0ed5c04be7297813d0138d615bb8cbf50927859590ba35a378ca2dea1496e25ddd0e9bcad807ab03410a0697e058db744","ssdeep":"768:pNXDnYSBobf2VK05V9wqupS+KYECSWJ+ytzuMO0UQLvTh4BeY:pNXDnXS2VjzXuFKYNSWJ+ytK9Ebh4Z","tlshash":"bd03f2a747968d529cdcb9c1947d83b9071360e41b662d8c692625f1cb0b328fbcc77b","first_seen":"2024-08-29T18:11:34.853592Z","last_seen":"2026-03-10T22:58:05.674976Z","times_seen":22,"resource_available":false,"data":null}},"time_used":899,"timings":{"blocked":657,"dns":0,"connect":0,"send":0,"wait":241,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/D2.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.502Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/D2.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-1ea0a\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12245\r\nContent-Length: 95241\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 2958064624633329789\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":125450,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"e3fcc54a1d0b7b55c19f5d69b565c4a5","sha1":"fc450f0bc1022cb5bde7c7a35e8bc76995dbddd7","sha256":"9a545d8267334ce7d236ecabd666b2efd9dcc05d782bc259acbcfa0ae5d7c185","sha512":"336480c251c500e7e21baed4864c2a72412c046fcf5ff420aa94e0b6a248ebc8b9aaa7c79d73e05b6f51b9e4cc6d38c71a1960de3ed9ae33aefeef660b56005c","ssdeep":"3072:8E+cX4ifQFdLHkd4oTtChEDXAeheDti8NDjZ:v+M4CQFdLEGoTt8yAeheD97","tlshash":"4ac31274c89659fd466a19ca86ed2c15af70791a41773e7d0c3824c23e47eee73e0827","first_seen":"2024-08-29T18:11:34.859435Z","last_seen":"2026-03-10T22:58:05.625657Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2132,"timings":{"blocked":1898,"dns":0,"connect":0,"send":0,"wait":231,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/floatImage/232/1709812274093.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.535Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/floatImage/232/1709812274093.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 07 Mar 2024 11:51:14 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"65e9aa32-348d\"\r\nDate: Tue, 03 Feb 2026 09:45:41 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Feb 2026 09:45:41 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12246\r\nContent-Length: 10074\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 16244067646288561120\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":13453,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (13453), with no line terminators","md5":"113420aab504930d33860ebd505da4bc","sha1":"c6171d606a59d11d997fa57697b48da3bd395003","sha256":"ebff755c96459ef2aacefd9de7947f8c881a31305263aac95481c10f313f99e6","sha512":"200439eb0428a31b91209c89058803b04c79db75e288dbb937929cde8c238280fbf906ef044430c5f7f0407fb70e6cfad539f4771c03e41825233f6bfb1a8ebe","ssdeep":"384:rQgeg+IqDFxp9x4TS801PFdh0bcdCVxv/q+:jegfExU+80bdhdKx3B","tlshash":"1a52c0351a4e7b2f486c00127f3518347ef9816962f79b551ee612e6112df4b80feaec","first_seen":"2024-08-29T18:11:34.870336Z","last_seen":"2026-03-10T22:58:05.682453Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3150,"timings":{"blocked":2815,"dns":0,"connect":0,"send":0,"wait":335,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/themes/gui-base.css","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.065Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/themes/gui-base.css HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Wed, 25 Feb 2026 06:51:20 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"699e9be8-146ad\"\r\nDate: Mon, 02 Mar 2026 10:27:04 GMT\r\nContent-Type: text/css\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Thu, 05 Mar 2026 10:27:04 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12991\r\nContent-Length: 17173\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 9364955535730218549\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":83629,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (12023)","md5":"ae436617c02061eb715fce1f6e4d84ba","sha1":"d29e23c56a6972ed8c139be8fd55022e8dc79dc2","sha256":"95be5699e27ae8ba00031ebaad84c414dbe6ab48f6445007513e072c9243eaae","sha512":"614e0041902efc437f9ef9ab63f0ee9e7d1236e0a5d811013dc75509c0669ef44b24ffefec0cf367ed241b6615b506b27a951cc17f168e7ff97f09b9564c4137","ssdeep":"1536:hh/EEJVfpLdXYSN4H1Y7B/Daf4ZxnVXCg9bI:VXYSNE+RVXW","tlshash":"0a8385b2e15824e63373c856a381fbda2554b122c5134efdf89f655c8bc738612a2f6c","first_seen":"2026-03-02T15:35:34.435383Z","last_seen":"2026-04-17T08:01:36.591141Z","times_seen":1009,"resource_available":false,"data":null}},"time_used":4727,"timings":{"blocked":2217,"dns":1562,"connect":258,"send":0,"wait":275,"receive":10,"ssl":402},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/bootstrap-dialog.min.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.112Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/js/bootstrap-dialog.min.js HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Fri, 20 Sep 2019 08:35:27 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"5d848f4f-4ea4\"\r\nDate: Mon, 02 Mar 2026 23:04:51 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Thu, 05 Mar 2026 23:04:51 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12991\r\nContent-Length: 5007\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 8406847080983825006\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":20132,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (20132), with no line terminators","md5":"5ce8851dc823429a42ab6147554403cc","sha1":"28f381f0e0aa4f5d56690e65723bd97fb59a38e6","sha256":"dd1edf5e54071903c4c1e81e33636444899d645df6b18bad22249da07f91c811","sha512":"f42a4d48c666d9c78fcb6c6061141452899085c504bf15e23749611dda00b6913e75ebbe47ca436a2ed016175d0918f193e474f13974a2f6a5304e18909a87ee","ssdeep":"384:3ai3F3N3VKUINthDa7Vnq86z3JCDKSz1m0hMtkJI2Cg0WEUOv5Dq:T3l3INthDu1YCDKS5flC9m1","tlshash":"6a9261ccb2d9b54c47abe072143f200df03a996951496119bc79e9ebecf060aa077f79","first_seen":"2023-03-07T01:14:38Z","last_seen":"2026-06-08T03:51:22.346942Z","times_seen":17554,"resource_available":true,"data":null}},"time_used":3351,"timings":{"blocked":3076,"dns":0,"connect":0,"send":0,"wait":274,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/themes/images/dot_active.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:14.889Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/themes/images/dot_active.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 27 Jun 2024 08:50:10 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"667d27c2-63d\"\r\nDate: Tue, 03 Feb 2026 09:43:48 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:48 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1265\r\nContent-Length: 1109\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 9510855313640451495\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1597,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"2acae64911889837654c9b1cef525742","sha1":"fca5651bfe700ce408760e3e0e062b400b8b269f","sha256":"297d8ffcace87b75e0dfedc86c0b4246374e90369353ae622a55b722f9cb79e1","sha512":"cfa3be20eae5f68e406868da2d4a8fb60331220c4a2fecd4009a1925d9631f65e3926c23b3e67226ffd885e3d87858befbbe638254475a1c3863cfcc8c9a82be","ssdeep":"","tlshash":"46318637b6bb3a0820e8c62cab8291322c6d6a0f6c520156642d3527485f31416c6edd","first_seen":"2024-07-09T10:27:13Z","last_seen":"2026-06-06T16:12:48.021349Z","times_seen":682,"resource_available":false,"data":null}},"time_used":1817,"timings":{"blocked":1553,"dns":0,"connect":0,"send":0,"wait":263,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/images/partner/partner-hongtu-white.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.479Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/images/partner/partner-hongtu-white.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Tue, 02 Sep 2025 06:45:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"68b69275-1aab7\"\r\nDate: Tue, 03 Feb 2026 09:43:48 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:48 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1265\r\nContent-Length: 82844\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 11850525739783936502\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":109239,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"050b6873c440d2c512d27f83bd536ba3","sha1":"3f1ef3c0eb4037170fa7dc0fa5f6f8b667eef5e9","sha256":"cab2392ea2953b735b5410022f07d4590018ca546e1fe21b2feab5db0a4e69ad","sha512":"562cc6092d643d8b5487bb406860661b215d8c94d4a51c63aa9a6823fbe6533acbf95133d385781c9ea5f8913adfd26810e6903296b2106ebed51c4c4ccf2331","ssdeep":"3072:InJWQnDraF6gDT3Kxms0QQ9OPMGJrcPaF:9SDu3DMmTrQgPaF","tlshash":"50b31216b50e3e0f2b55dc0f514ee9f6cb920786850deece4768348462c9e85c3df999","first_seen":"2025-09-06T20:06:14.275441Z","last_seen":"2026-04-17T08:59:04.373557Z","times_seen":1773,"resource_available":false,"data":null}},"time_used":1517,"timings":{"blocked":1253,"dns":0,"connect":0,"send":0,"wait":240,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/she2.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.828Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/she2.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-68bd\"\r\nDate: Tue, 03 Feb 2026 09:45:37 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:37 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12239\r\nContent-Length: 20402\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 1530097657226391488\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":26813,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"606e6c263d2f4b62e07118fbc32bff14","sha1":"1a80c54f17d0472fa305dc5ebbbfe0814d6d513e","sha256":"988c3817c00f26198d4f9eeeae16371627b12da29b6d0db424abbb47f2c51f47","sha512":"c5428d0ecdf48125b3a884ef59ec6da5e7fc0ead39ec3f114c224921433f624836eaa4d4e6b7c8c3502921402383e56f9bb7e8e7c3485d0018957ef43b2cc519","ssdeep":"768:CJSLIXuWFhK3/9LVltONgemZFwRIt/GWKcF5zN0pPPZ:PEXuOhc/dDtOyeIcIscF5oPB","tlshash":"dbc2e154179e240f226711c9abe8241ad6b32af2c6d9537737b3c7ca270c870973998b","first_seen":"2024-08-29T18:11:34.779305Z","last_seen":"2026-03-10T22:58:05.733673Z","times_seen":22,"resource_available":false,"data":null}},"time_used":330,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":263,"receive":67,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/en_US/hot.gif.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.882Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/en_US/hot.gif.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-759\"\r\nDate: Tue, 03 Feb 2026 09:45:38 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:38 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12241\r\nContent-Length: 1269\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 1747921136795872918\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1881,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"51f75edecbfa3c8682b0ac727ea4602d","sha1":"1f0b22b068fda6a0c2ee2a08cb7d081d0048e7fd","sha256":"5cf107f61227d7ef030e6ee0533aee68f2d65091c9b5b6387dcdfa31c1d3e973","sha512":"b2f8d6a1543b79c87a7c45f4d9beb43ded9c9456ebe864d3ef5ac70dcef7c00fe1cefae5e8f3c16ef5574b379243f03c4d6d170b71838c15dfd4530235fadffa","ssdeep":"","tlshash":"2041e63326a7792e0468ad2c3fbe78171ce9c6874c631ba9903a335e181f73456c9d65","first_seen":"2023-05-29T05:49:22Z","last_seen":"2026-06-01T23:54:58.401889Z","times_seen":340,"resource_available":false,"data":null}},"time_used":2667,"timings":{"blocked":2330,"dns":0,"connect":0,"send":0,"wait":337,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/lives/sa.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.940Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/lives/sa.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-bbed\"\r\nDate: Tue, 03 Feb 2026 09:45:40 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:40 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12243\r\nContent-Length: 36162\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 15957343599090414008\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48109,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"98b5643268c2b10fa260a9ba1323126e","sha1":"483f4a74da4c581ce791c6c5937d566f5ba1a2f2","sha256":"a3577b2c170da58990481a78070629691b590854968e15c1c56ecbccac0ed160","sha512":"b513b2e891b51cfa97a6992ff0c278b4c69015ef0c2c8c8ab52612fe199f6b19860f3b4249c24bcf6a0a1a4025ac3456a8d77061c4b6ea94a22fa5c9e4da2624","ssdeep":"768:AomwlVa4Y0HoAX6Uj/RjRSZneWE4vZrW2TLSu/la7TNE3p/UL2q3ULAx/hM9eToW:1BpY0HoAttROciCu9a7TNEeLXULIJMMZ","tlshash":"7623f172981bee2cbb8781034b8753c43ede569fc0ad0092ab49f0f6ad01d149edb15e","first_seen":"2024-08-29T18:11:34.829686Z","last_seen":"2026-03-10T22:58:05.647072Z","times_seen":22,"resource_available":false,"data":null}},"time_used":4237,"timings":{"blocked":3942,"dns":0,"connect":0,"send":0,"wait":293,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/carousel/10143/1747673814861.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:20.611Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/carousel/10143/1747673814861.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Mon, 19 May 2025 16:56:54 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"682b62d6-24a8d\"\r\nDate: Tue, 03 Feb 2026 09:46:24 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Feb 2026 09:46:24 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 5194\r\nContent-Length: 113711\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5640574962924596071\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":150157,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"6ccf4ba4093c29010ea4ab6873f8a025","sha1":"e5b128dbd090c47759de143bfc3dc3d44b4d8c9a","sha256":"48637aafb846be5f770dd833083ffa2df99a40cd1565bcba898b1ced6c4ef231","sha512":"8fc98491078ce49663e461e8f0d8a1fd3447d9b399dadd7eebfe257afd146dfa326e1bddad91d3f59651593adff2d2db532e398cc85adcabe17d1d34e443ae1c","ssdeep":"3072:JbDQu741eREnlm+FRLEwfDh9D976R1N8JtfRprdKPClGA8W:JbDQM8eq3FBRDX97npps+GA8W","tlshash":"b5e312701fa63c3f823dcb19d3ff3d0cc7a48a45250150aa95767982acb579884339bd","first_seen":"2025-06-13T23:48:06.334673Z","last_seen":"2026-03-10T22:58:05.690726Z","times_seen":12,"resource_available":false,"data":null}},"time_used":310,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":307,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/061410/rcenter/common/js/jquery/plugins/jquery.validate/jquery.validate.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.120Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /061410/rcenter/common/js/jquery/plugins/jquery.validate/jquery.validate.js HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Tue, 27 Aug 2024 03:30:00 GMT\r\nEtag: \"66cd4838-6caf\"\r\nDate: Fri, 20 Feb 2026 22:01:37 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nVary: Accept-Encoding, Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Mon, 23 Feb 2026 22:01:37 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 254\r\nContent-Length: 27823\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 13193778311543861182\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":27823,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (27668)","md5":"9c41709c2b64126b909c101a27f39153","sha1":"4ab666b36c092577acb41390ad90e96d5fea7711","sha256":"c1963697eeafb63b6c29e95da2d38d91dd907ab656e130e6e1c34d1dcd149f60","sha512":"f235dccead15199e58495c6faee849c50252b9beed29a04ae46a7a9bdbccfd569a8ab452e7fcf923b7048dfda0c3d7bd51261874642d40e994d1640ca89e330e","ssdeep":"768:u4ygd0iB6d9zYDO5qYT8fwTW3Jny+XiKZNtrt2tG:NB0iB6d9zYDO5qYTMwTW3Jny+jrP","tlshash":"e6c2b7093585102f4ecf30fbb897524f72ba95a45019a069b5fca4d1bef9f8530a6f38","first_seen":"2023-04-05T18:30:47Z","last_seen":"2026-06-08T03:51:22.340504Z","times_seen":17430,"resource_available":true,"data":null}},"time_used":3594,"timings":{"blocked":3301,"dns":0,"connect":0,"send":0,"wait":292,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/language/language-ko_KR.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.870Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/language/language-ko_KR.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-84c\"\r\nDate: Tue, 03 Feb 2026 09:43:51 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:51 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1265\r\nContent-Length: 1455\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 6054228832986239383\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2124,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"619c9fe5c99c3393465ce822532a4952","sha1":"cd28e39bcec6782ef8491cd92cb042795e034fc7","sha256":"8eaeb1934910c8b46646455ca7fc7a59fcb9490481a13c4238b33e6b21ab6987","sha512":"d60b6d23c9d8bc9d73eef3c0b211c01a5c50caea075bc66c2eb19305c1f5158e136cf6700e21056a40cfa0040f707abc507e50c64ab88967d834415fe8d331ae","ssdeep":"","tlshash":"d141193fac2a794e29a1ca05abe9641b7c652f5f558721f7385a31170a9e3340283cfc","first_seen":"2023-04-16T16:45:37Z","last_seen":"2026-06-07T07:30:11.545534Z","times_seen":5821,"resource_available":false,"data":null}},"time_used":2342,"timings":{"blocked":2029,"dns":0,"connect":0,"send":0,"wait":312,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/images/phone.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.374Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/images/phone.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nEtag: \"6673fb50-3a9\"\r\nDate: Tue, 03 Feb 2026 09:46:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:46:32 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 7216\r\nContent-Length: 937\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 16040242917640379744\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":937,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"72950c4721c628dd289423be90a308c4","sha1":"35c393921f141f25c6725a7619f97597fa8ef2ef","sha256":"bfa7b66f904f5b965b7e1c345f509030d14754c334172a0610843be4c6c3b373","sha512":"7c5e66059bf1bb652a0e63d396a35215e02f7f4911f426dda835b9fdebb3197c3a54e54914a829fbff7b7bccdfc31783ce577f82b085eed4247e2a7756d64b2b","ssdeep":"","tlshash":"411110ba5b43b1849587ca4ecf3690204cea7fff9a31754d0cd07949b0ba3e945d864a","first_seen":"2024-08-29T18:11:34.839746Z","last_seen":"2026-03-10T22:58:05.677998Z","times_seen":22,"resource_available":false,"data":null}},"time_used":256,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/images/rewarding.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.391Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/images/rewarding.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-8fe\"\r\nDate: Tue, 03 Feb 2026 09:45:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:32 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13959\r\nContent-Length: 1789\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 8185578586709040113\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2302,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"bf7665d9fbeef4cdb68e317d80132572","sha1":"4031dfefb9c77ed6f162da75d531927564f8f99b","sha256":"8fa3e62602e5abc4953a0cd9b76b29f5ff46c1fa35da4cebb5910673666ca16f","sha512":"f9c42b0a978b91ae5f0ae8b3f83d48f3441a449c4a0f1e8faf336673335f55f815c04df29c0c374a4e1d2306a674bedf13905e9dc8d567ebbcf7c699be996b65","ssdeep":"","tlshash":"36410a1dc71766a08f8c0a0591900a6c8f16a94e16bbe4b0576dec078383e151f9ec9c","first_seen":"2024-08-29T18:11:34.844544Z","last_seen":"2026-03-10T22:58:05.641227Z","times_seen":22,"resource_available":false,"data":null}},"time_used":477,"timings":{"blocked":246,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/contact_bg.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.440Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/contact_bg.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-912bf\"\r\nDate: Tue, 03 Feb 2026 09:46:33 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:46:33 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12244\r\nContent-Length: 452164\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 13947116782053779458\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":594623,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"b363cbc664708370a7e09b72c84a04fa","sha1":"c10de0654eb1dc7cb92bfb5c59ee151667e61c68","sha256":"5e1ad33973b57d09e2fa222806d6464507f14b3458afe4257813e86ea1a463fd","sha512":"28a66627e77c86ba6c5a7a1a5a5040716ba176b27fa9675f61bdd44b2547aecc41e54f15a3b53a51103c39b828969c541a01939972e0631823ecfc6abc3ed611","ssdeep":"12288:EzqOSmha58mpRQ7zvhGBQIQuBx0XjzgMi3PgW479nGNzTEzrz8UR:TmAjQ7SGQ0XQN34WO9GJC","tlshash":"70c4239aadf8bcbdc13cd15db2693f2413b52f550dca35ee3ba631831b128604072967","first_seen":"2024-08-29T18:11:34.851292Z","last_seen":"2026-03-10T22:58:05.603242Z","times_seen":22,"resource_available":false,"data":null}},"time_used":841,"timings":{"blocked":504,"dns":0,"connect":0,"send":0,"wait":325,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/images/slider_arrow_next.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.493Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/images/slider_arrow_next.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nEtag: \"6673fb50-31b\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12245\r\nContent-Length: 795\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 2679222850880803069\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":795,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"ac0368263662af62737a5c23b8a6b790","sha1":"41001e034e2fcac24041a285f166ff7fa565e52c","sha256":"07621015e27567b43a3670911583124ea461b5f6b53ea66021a759c05e221c35","sha512":"e24c8ad58f1dff74721b6f1573ee65a15dd6f6a3980f7fec43bea75fa3563891369aa6d46f9b16bfa290cc73d532e3e4be93d46b8548ff8c430566182cf6030e","ssdeep":"","tlshash":"4201c5a83f97f06468846021862c35638d4ea4e74a74cce0248e98546c38fcbc4a726b","first_seen":"2024-08-29T18:11:34.850384Z","last_seen":"2026-03-10T22:58:05.648704Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1860,"timings":{"blocked":1547,"dns":0,"connect":0,"send":0,"wait":312,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/E1.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.496Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/E1.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-85fa\"\r\nDate: Tue, 03 Feb 2026 09:46:33 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:46:33 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12240\r\nContent-Length: 26111\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 4713197028806727363\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":34298,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"630e6b0182e68b8ff397e15b66ae3e5e","sha1":"5130135783ce8ecf1a48efa711bb2b47aeb15968","sha256":"d9ff115f6fbe156e26f8405fa840e5db191ffa884e038f9c28d5179de0174953","sha512":"c9f8c70eb8af346699e9251cfcbd2487a639c72486c951b579fbda42bcaa9bcb610f07e32b35eea4b700bb001f9c6778ccc28f6517c841ea8eaaee79413ffbed","ssdeep":"768:jwp+8hiToaPJUwzqMen0XuJhmINuVT51AE:I+8oE2UwzqMg0+LpHE","tlshash":"39f2e180188739b7de1dce00cf6bdba4e9d1a7882d4ffd5b651e5aa50644c2d460ba8c","first_seen":"2024-08-29T18:11:34.852454Z","last_seen":"2026-03-10T22:58:05.655728Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2034,"timings":{"blocked":1708,"dns":0,"connect":0,"send":0,"wait":325,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/she1.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.505Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/she1.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-69b0\"\r\nDate: Tue, 03 Feb 2026 09:45:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:32 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12245\r\nContent-Length: 20585\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 2772608114054680015\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":27056,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"ac64ac72b05320fc185572119151ee02","sha1":"58a68849659cce0de536643471b899070bc87ed9","sha256":"db2ba99b65b24a7b4e049609a89bee81d98494bf173e414e4eab39b427b325a1","sha512":"ce5cd808de0c44fed6ba6f17c9b2ce343bbfdb887bf001af763ea54030b7d5d9f0a4ab0b6105a92ee6a37580f0369d83e09cf9a0cf16569edce82697d5327ea0","ssdeep":"768:HqHVb1qWGOU2THNtEMS3rnmLH622YNOff:YXGORXEMSbnmLKjf","tlshash":"c0c2e11a97ba0e7f30e01f95fa6ced0aa94b0887abdf103ab60454e3d5677024f53532","first_seen":"2024-08-29T18:11:34.86083Z","last_seen":"2026-03-10T22:58:05.697509Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2319,"timings":{"blocked":2006,"dns":0,"connect":0,"send":0,"wait":312,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-04T12:49:09.184Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ong3589.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 15 Feb 2026 17:36:53 GMT","end":"Sat, 16 May 2026 17:36:52 GMT"},"fingerprint":{"sha1":"D1:0F:86:D0:08:A4:EE:0F:52:A3:3A:D7:FC:F2:E8:89:8B:5C:11:07","sha256":"96:F3:97:A9:8E:8D:98:27:50:DA:C4:B7:D6:B3:F8:FB:B6:20:E3:8C:37:23:42:97:5B:24:BB:39:D5:0B:49:BD"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ong3589.com:8989\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=utf-8\r\ndate: Wed, 04 Mar 2026 12:49:09 GMT\r\nout-line: gb-cdn-014\r\nuuid: -\r\nvary: Accept-Encoding\r\nx-frame-options: SAMEORIGIN\r\nx-html-cache: HIT-3600\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Moment.js","description":"Moment.js is a free and open-source JavaScript library that removes the need to use the native JavaScript Date object directly.","website":"https://momentjs.com","common_platform_enumeration":"cpe:2.3:a:momentjs:moment:*:*:*:*:*:*:*:*","icon":"Moment.js.svg","categories":["JavaScript libraries"]},{"name":"jQuery:1.11.3","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Swiper","description":"Swiper is a JavaScript library that creates modern touch sliders with hardware-accelerated transitions.","website":"https://swiperjs.com","common_platform_enumeration":"","icon":"Swiper.svg","categories":["JavaScript libraries"]}],"data":{"size":640667,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"50af89b95a7a12c99e2ba8d6bcde42dd","sha1":"789b64ab7ef0c481a40473a5a721dcbf2b5150cb","sha256":"4b2ba5b8a8a0a9d6edf7a81f0deaeb1d0ee242052a04fdf3a45bf963cf2777bb","sha512":"3ce98c936026b0ff773e0d0b0c55710e04a3637c5cf6a1a06127506023e0408a7c92bb8333f185511b2892cdd2baa0d36463e6c268a2d30b2c71a061bade8b24","ssdeep":"6144:vSvOo7vGwzd/bdNGwsYaY0vsD4M4ACh0ruJaM:v+Oo9bdynY0vshChB","tlshash":"a7d4f74477f3106225b3a0ba52ab370435f5e407ed49cc187cae6a985fd2e9131e3ead","first_seen":"2026-03-04T12:49:49.242022Z","last_seen":"2026-03-04T12:49:49.242022Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1047,"timings":{"blocked":414,"dns":1,"connect":203,"send":0,"wait":219,"receive":0,"ssl":208},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"ong3589.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/gui-base.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.111Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/js/gui-base.js HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 17 Aug 2023 06:15:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"64ddbaed-ee5c\"\r\nDate: Sun, 22 Feb 2026 01:20:33 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nVary: Accept-Encoding, Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Wed, 25 Feb 2026 01:20:33 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 254\r\nContent-Length: 15779\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 11835332590771947070\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":61020,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (11056)","md5":"e6ce47d880d7a50ddf91b074c8572edf","sha1":"6a3657c67209136e5b544859daecf16f2d153b72","sha256":"c49e04c7ecfd07c74b58cf161ef2b58f2bc837a9091ed1ae090a33734cdaa734","sha512":"0946a1cb9d048b485dadf4056a4aa7be685a8906240a828a5ac776a4e1eae2ed5ef238bd0724da41cce33324357ba44704d34a6766430f1552630f9a17b664f4","ssdeep":"768:+lkflKVlvREcS38xHmuqrRO/5IS3oFaJX+mQdudqD9jAXImsUh8H3yALdODRG4eK:6ClKVlvREcYoHz0PszIfoALkMEY16pB","tlshash":"4353c80a72b130a106efb1b6515f460d323a6927d44ac458b97c9ae43f74f28316bf7e","first_seen":"2023-08-26T00:19:56Z","last_seen":"2026-06-08T03:51:22.34618Z","times_seen":16698,"resource_available":true,"data":null}},"time_used":3310,"timings":{"blocked":2989,"dns":0,"connect":0,"send":0,"wait":320,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/themes/hongbao.css","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:12.609Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/themes/hongbao.css HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://jn5ec4.pham.xin/ftl/commonPage/themes/gui-base.css\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 30 Mar 2023 06:38:07 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"64252e4f-d530\"\r\nDate: Wed, 04 Feb 2026 03:47:57 GMT\r\nContent-Type: text/css\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Sat, 07 Feb 2026 03:47:57 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 253\r\nContent-Length: 5666\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 8134804125512841796\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":54576,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (336), with LF, NEL line terminators","md5":"a212ec8d2af1172e5fe97229a8cdd470","sha1":"676b870b21e2b4f18dd23dd24baa8a30955b8362","sha256":"910aca19fa0a1df0c76607fdde36968687403343a50022bed3693011abee9fc8","sha512":"6f8ef1e9c22978fe39412ca413b132e9ae54d5b84c1b95b6f40b5c7bd44e726212ca20b731de29294e77fadf0651f3cbc8bfad1d6a4ec6b808064faa4aa3811b","ssdeep":"1536:qsgR4FlccsG7TCbzG3ArEDTgkvudNssvmp13ZUcPGZ10iS9EvlBcovGF5XAso/GQ:qiu","tlshash":"78336d05e241abab21dad174230bca3bcdd81485fea4dfb7223971f4cba55e5b03625c","first_seen":"2025-04-07T03:18:03.889172Z","last_seen":"2026-06-07T07:30:11.560478Z","times_seen":10722,"resource_available":false,"data":null}},"time_used":1653,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":310,"receive":1343,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/images/zh_CN/header_img2.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.345Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/images/zh_CN/header_img2.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Wed, 14 Jan 2026 02:25:23 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6966fe93-6e7\"\r\nDate: Tue, 03 Feb 2026 09:43:54 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:54 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12244\r\nContent-Length: 1409\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 10288902159406616374\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1767,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"aea8d6207ac3a39ba811f57b7d7eeb55","sha1":"4c6bf2b9173fcb7562329254ff70592ea4dd5149","sha256":"6ecc6cd1e5b92af893ad16cf61c7b0874071fa0222ae2c5186505717e2d238cb","sha512":"4fc8cfae9876c1730cdf97434ff5d35a48bc3cdfe7f5af0c1b656df5371bffb77ac158e7b3d7792fad3700c088a187055f1a1056287ce82a4dccac30248ab956","ssdeep":"","tlshash":"71312d71d63c33f21a7907ec631a92270e31ebd59677863d32d84a47721e3870429e53","first_seen":"2026-03-03T22:07:02.342652Z","last_seen":"2026-03-10T22:58:05.628825Z","times_seen":9,"resource_available":false,"data":null}},"time_used":238,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":238,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/floatImage/233/1709812338371.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.546Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/floatImage/233/1709812338371.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 07 Mar 2024 11:52:18 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"65e9aa72-4d05\"\r\nDate: Tue, 03 Feb 2026 09:45:42 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Feb 2026 09:45:42 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13974\r\nContent-Length: 14809\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 2641986494625784534\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":19717,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (19717), with no line terminators","md5":"6165d7612a2d7e156308c5e736545eab","sha1":"e3b1d272aecf952eb447bbae69995f7655b2fe9c","sha256":"79763da6e3e903fe7b9e38233e03d10a795c6fcd988dfd73a64d1d6ddf990637","sha512":"366747ee73636a0b754bb72c9da8738d45b1ed4a298f936ebaac7d6d98c47c27a7ce78606c5c94141a2e8cb00da457f9b08825752cd07a5549647c959f14d12d","ssdeep":"384:lQgwg+GcqP3z0qHMtBj/wBdFrEvnGFBVJK6pFPWtaPo7J6D0YCTF7i3:9wg+G5LlsvYnFrC0V3LXo7TY3","tlshash":"e892d1fece722203531f193a14352e052a3b3a3fdd98f5ef209759a6485fb910c5546a","first_seen":"2024-08-29T18:11:34.88589Z","last_seen":"2026-03-10T22:58:05.695318Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3803,"timings":{"blocked":3473,"dns":0,"connect":0,"send":0,"wait":329,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/themes/images/ads2-img.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:14.883Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/themes/images/ads2-img.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 27 Jun 2024 08:50:10 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"667d27c2-7d9e\"\r\nDate: Tue, 03 Feb 2026 09:45:36 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:36 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1266\r\nContent-Length: 24332\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 12647706181567746009\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":32158,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"3f902ff9701781101020977fbb82e8fb","sha1":"c13aa0343b9e31bafb52be78543576e3d330b568","sha256":"0d613ef133e2d8a031f71c94fee68228cbb015e7cc0d974481e178f238a36c41","sha512":"f0d6720d7fc0fd68d1520e8b5421d0583f2d8134597df42ac1a0993183e99748e90e73842cb938eeb296a7758c91436943276e4597026b7fffa5cdc06a913ba9","ssdeep":"768:aFWbbDJmO5tmUoeXIV+gRd8geLRBygDXeUIdF:aF2mV5Fdobb0F","tlshash":"c9e2e183c9a2ba1b37fcbc290e3f69208d0b1025025c77bb753662ac57ab7011dadd47","first_seen":"2024-07-09T10:27:13Z","last_seen":"2026-06-06T16:12:48.028738Z","times_seen":821,"resource_available":false,"data":null}},"time_used":2342,"timings":{"blocked":1255,"dns":0,"connect":0,"send":0,"wait":1085,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/xiao.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.509Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/xiao.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-24ef\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13947\r\nContent-Length: 7193\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 14430318058299713949\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":9455,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"a19b1e8df8cccf07256d2ade6c26ddf6","sha1":"3490cd33b91e3482f732dd91402503aa28353f7f","sha256":"58ffad04bcdcc35be398974450a158f46825a403aff5d329bc99b60ee36d4a2f","sha512":"ecae134ab163db7dad5aa853538acc3f26e76dc4fc259168b7cf87befc3a520a1c2d07c4e39fe8e72bfc7a7d5ec2c0acfe9d4a813faa5b4fab81da447ca5ff0f","ssdeep":"192:9Wb7xxT2v2l1CczaykZEOBEiozqLvBy50zoxmOIs6UOPLvXocXyaP1T:9c7XT6Y1ysOeiozcvY50zCPIsJIjYcXz","tlshash":"d912c0c833e3e24c7c24bd8032d9e297998882ad8d39acf7675d954cc8758b4f1311c0","first_seen":"2024-08-29T18:11:34.86183Z","last_seen":"2026-03-10T22:58:05.617289Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2522,"timings":{"blocked":2260,"dns":0,"connect":0,"send":0,"wait":262,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/floatImage/232/1709812274504.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.537Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/floatImage/232/1709812274504.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 07 Mar 2024 11:51:14 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"65e9aa32-36f1\"\r\nDate: Tue, 03 Feb 2026 09:43:56 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Feb 2026 09:43:56 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12246\r\nContent-Length: 10534\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5016358752241605856\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":14065,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (14065), with no line terminators","md5":"b336f89b6255d36a6cf33055464d7399","sha1":"a4bdfd20d4d2835cda0986ea4a5bf029eca9bf2a","sha256":"640c8e27383f819e4b842d33d1f04586e280fc3c87073884103b41828e8b735a","sha512":"09670c76fc266791f6fdc39d1585ffb1b02ad47fe7669a6df07a2e8a4ac94a07eb3089527cfedaf5324f2691c167271f1e1f67373033de1b1f9591d09a35bad6","ssdeep":"192:W1Qgigu+lzIMnAM9MIjFKSUmCF89tq7j1YDqw0TAnyTRJqlYcCBC/rq4Yx2GmVf+:IQgigXpNUKtqt6qqyTOl3CB8u4Tf2BrX","tlshash":"3b52cf1dc75e195c11834335e4bc287a32b325473b88e2261dfa1d4d2c26eaa8e4ded6","first_seen":"2024-08-29T18:11:34.872761Z","last_seen":"2026-03-10T22:58:05.642225Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3217,"timings":{"blocked":2904,"dns":0,"connect":0,"send":0,"wait":313,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/floatImage/232/1709812274754.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.539Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/floatImage/232/1709812274754.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 07 Mar 2024 11:51:14 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"65e9aa32-4995\"\r\nDate: Tue, 03 Feb 2026 09:43:56 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Feb 2026 09:43:56 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12246\r\nContent-Length: 14143\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 7673687218572915134\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":18837,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (18837), with no line terminators","md5":"4bae1e37a7ffbdf8ac287186345c1f79","sha1":"6a303d4558e71c1b58cafffdf604e535e8e1f651","sha256":"7d1cc8d5b73b883116b52b3d03c05135b8f3f0755ca05415f21c5632bed7e647","sha512":"a2810e8127eeb9362d6facc36973dc4641f0ff22730512cc2ae2b3365d0211b8d263cc7a3891cbdc77fc630bfc7b35ca013be309433ef2f47624fa38991d6e59","ssdeep":"384:lQgagMt8e8mfTx+OkMGcHs8apT62tmkKK2rITf4WOVn:9agvE7xK/cGljBUsf4WOF","tlshash":"9a82cf3a450f976ea8c8a7058d9746835ccbd80c9e5832ef7cbf3c910685afc691e45d","first_seen":"2024-08-29T18:11:34.873933Z","last_seen":"2026-03-10T22:58:05.71015Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3188,"timings":{"blocked":2917,"dns":0,"connect":0,"send":0,"wait":270,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ong3589.com:8989/index/getUserTimeZoneDate.html?t=mmc19v4w","fqdn":"ong3589.com","domain":"ong3589.com","tld":"com"},"ip":{"addr":"20.255.200.238","port":8989,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.545Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ong3589.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 15 Feb 2026 17:36:53 GMT","end":"Sat, 16 May 2026 17:36:52 GMT"},"fingerprint":{"sha1":"D1:0F:86:D0:08:A4:EE:0F:52:A3:3A:D7:FC:F2:E8:89:8B:5C:11:07","sha256":"96:F3:97:A9:8E:8D:98:27:50:DA:C4:B7:D6:B3:F8:FB:B6:20:E3:8C:37:23:42:97:5B:24:BB:39:D5:0B:49:BD"}}},"request":{"raw":"GET /index/getUserTimeZoneDate.html?t=mmc19v4w HTTP/1.1\r\nHost: ong3589.com:8989\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nCookie: sticket=VPV1ExTFRZeFpEQXp; route=44d17259ab44b1b54887077d522d7137\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncachettl: 3\r\ncontent-disposition: inline;filename=f.txt\r\ncontent-encoding: br\r\ncontent-type: text/html;charset=utf-8\r\ndate: Wed, 04 Mar 2026 12:49:15 GMT\r\nout-line: gb-cdn-014\r\nsub-sys: msite\r\nuuid: 07285-01-00000000-17726285553e53\r\nvary: Accept-Encoding\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 99\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":119,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"JSON text data","md5":"dbe0262ea2b22abbc2d6e04113387911","sha1":"69ba9c9fac74d6a15cfe5fef1ad45750f44d6222","sha256":"5f40aa144b66911103cfc341b2e7f78668b791b1131583df1d80f181033c3c5a","sha512":"747ac98c590f418f4cec412e3abbcba0ef0f08e56b51b12611451c801b8bb589a3996243584b3e4b850c97fc3063504a18311538acf36b118366961f723e3dac","ssdeep":"","tlshash":"24b0926442e2ae5e0b2040e1ca85f5d90da6a15b88d3c5102aa7ae1ca89da995808623","first_seen":"2026-03-04T12:49:49.247886Z","last_seen":"2026-03-04T12:49:49.247886Z","times_seen":1,"resource_available":false,"data":null}},"time_used":231,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"ong3589.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/chess/km-img.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.916Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/chess/km-img.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-32118\"\r\nDate: Tue, 03 Feb 2026 09:45:38 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:38 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1263\r\nContent-Length: 146095\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 7742483588756719470\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":205080,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"25c035098ceb646d0e750f6ced6fb581","sha1":"737ef23cf9e41161f2c6dc3ce5609b01c8a26df0","sha256":"fea3693d5fd42694951ac76852e16308c023d199fd645037acc39841249a1828","sha512":"5f301cae7f9aa4e6b48696f74a2d2dca94bf1ee87aa04602e122580febd0ac84cf168f1676cdd48b332413ed28e894f71f041d9ec4abf3a88d17e1784ff47a46","ssdeep":"3072:1hZLwLmanyzuP9egoVdvFVKiu/v6fsfHxl3JwYJgAb3sqMQKd:Z8mbzuE1dTKiuYsvxwYJgE89","tlshash":"231401752d41eeb56f68854260de7ee11f2e2feb02157ce9506c38c120ea7e0a7d9c39","first_seen":"2024-08-29T18:11:34.806489Z","last_seen":"2026-03-10T22:58:05.660707Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3107,"timings":{"blocked":2841,"dns":0,"connect":0,"send":0,"wait":233,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/lives/ab.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.938Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/lives/ab.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-125e1\"\r\nDate: Tue, 03 Feb 2026 09:45:40 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:40 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13950\r\nContent-Length: 56386\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 1391266858804031569\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":75233,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"3177ea4ac306dcac25495bd22f563adf","sha1":"482b0682a3cd92f8ebc7b4c9d435351e00a568c8","sha256":"71fc37e3e1d4696870b10ba5477fadc560f38fb2e0b0e26309dee7ddbf92772a","sha512":"2ca8d34cf0d346277041f17747324d51a6a62592b760a11ff4f2d23697cb876c85da19b20d734828dbf1a866a7da371a40d7b878a0be4db125093e4a2e4b5e59","ssdeep":"1536:Y+e+Lg5c0mldWjbBQuFHqHDbYdu+tIyT9rmXfwPF6Ig6KhKB:I+LMml2bFcjEuQNl6fwN6Ig622","tlshash":"427302f5461e5cba039c181dfb31ec532f64119ed616f972949cb3f6d860389b20b8ac","first_seen":"2024-08-29T18:11:34.828506Z","last_seen":"2026-03-10T22:58:05.667165Z","times_seen":22,"resource_available":false,"data":null}},"time_used":4160,"timings":{"blocked":3851,"dns":0,"connect":0,"send":0,"wait":307,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/images/zh_CN/mobile_bet.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.388Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/images/zh_CN/mobile_bet.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-e9d\"\r\nDate: Tue, 03 Feb 2026 09:45:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:32 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12244\r\nContent-Length: 2833\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 4835100574783522002\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3741,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"dd0d964e2578ed4db3ee3804358ca8bc","sha1":"63c22d7b100fa1669a9e5721cf2a9da6c79674bb","sha256":"5650f57344c52cfa0eced2583cd97318c2a0860b9bc38b82ba39e2a061114bac","sha512":"c17daa984edfa66d7ffb5643a1a14a1a906eaf99246cc78d4ad59e99cb90c4b8e66503eddedb0cb8814a5748a7bc01e98ea34aac9f0c0fe72d63571d12921e24","ssdeep":"","tlshash":"ff715c5b72c5b770735a21b14a3875bfd942612b55364d6d811c2f5f078b82f8c0ae8f","first_seen":"2024-08-29T18:11:34.843281Z","last_seen":"2026-03-10T22:58:05.613264Z","times_seen":22,"resource_available":false,"data":null}},"time_used":238,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":238,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/B2.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.459Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/B2.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-1ef3b\"\r\nDate: Tue, 03 Feb 2026 09:46:33 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:46:33 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12244\r\nContent-Length: 96278\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 17305113609389731888\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":126779,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"cdbf5266bfff2ce31c45a517bbc89cc8","sha1":"231b21f8696d74bdbc01aded8f48b0b124ee93d8","sha256":"7b4ce08da797f90e7667980cff5a3ba6d58d30a56b43db9eed8b7a49ed0790c8","sha512":"b94d43aff11901d8b412b4851c36d8711b5d7bdd734fd5a319682263dc08d0f547e96172ddfc9af72b6fca3306a45df2e79c240917717bac716565705d82c76d","ssdeep":"3072:+7qS6WUFFz8HUlFTirX3tVuWoGiqpGm2hr4G0uGu1kVFk/Y:+2dFF2H3tzGqpt7sAf","tlshash":"0fc312b03fd1a17953bc1623922be59e1eb73e19a3980cac159026515cffbb92dc163c","first_seen":"2024-08-29T18:11:34.85704Z","last_seen":"2026-03-10T22:58:05.675744Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1114,"timings":{"blocked":783,"dns":0,"connect":0,"send":0,"wait":328,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/images/favicon/favicon_7285.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.513Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/images/favicon/favicon_7285.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Mon, 05 Dec 2022 08:15:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"638da88c-8c6\"\r\nDate: Tue, 03 Feb 2026 09:45:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:32 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13951\r\nContent-Length: 1599\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 11623652061370319431\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2246,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"0b6186a871ceccd47cdbbf8441a9fbe5","sha1":"9f8c0216563cd8a8a03413b847ebfbe8399f61b6","sha256":"3164d57e02536811b06d8c5a59ae2908c3fbb222cbe3f9fad237e2bc642c620d","sha512":"c6a20fdbab15cab3f4aaf6506decbf1b49cb6da756aa98b20e8dcb76c2ea5a1f2bef7c2adb8d037ca27d6d681bac0e46829c7baf28bc49a963c38d2c48efc734","ssdeep":"","tlshash":"a3411b7a5a6eed0e8c28955edcb730063e394a2f4e67121be46837726de777804407c9","first_seen":"2024-08-29T18:11:34.864127Z","last_seen":"2026-03-10T22:58:05.619434Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2836,"timings":{"blocked":2518,"dns":0,"connect":0,"send":0,"wait":318,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/language/language-th_TH.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.875Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/language/language-th_TH.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nEtag: \"6673fb50-6fc\"\r\nDate: Sun, 08 Feb 2026 01:08:43 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Wed, 11 Feb 2026 01:08:43 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12241\r\nContent-Length: 1788\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 11536161707569209514\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1788,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"7f73aaf76bcd269061c3063976330794","sha1":"1f85fc29389cd16d931aab2a3dfda16a8d78662c","sha256":"91cbc274b6516bed37e7e00ed4e3ca8728d8df824e55bc0d2fd191329cea39cf","sha512":"ca2b507e8a0bcfe233bbc209109e5475efecd3b043e80cf288ea149b2330d3b7c874832f182f268b08bce0f4bb3aeb48b0c2ff51067c4d93b21cc67d2391966c","ssdeep":"","tlshash":"4231093b7d06774d1960cb78bef681262c210b2b5c25266eac4671268f55b3418818ec","first_seen":"2023-04-16T16:45:37Z","last_seen":"2026-06-07T07:30:11.498317Z","times_seen":5819,"resource_available":false,"data":null}},"time_used":2340,"timings":{"blocked":2033,"dns":0,"connect":0,"send":0,"wait":307,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/Logo/1/1586597597595.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.355Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/Logo/1/1586597597595.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Fri, 18 Nov 2022 06:05:10 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"63772096-71a3\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1268\r\nContent-Length: 21010\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 15965047872994230790\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":29091,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (29090)","md5":"94885351a4736b9d9868b50ccf6a7a33","sha1":"304eeb9f13c7d1bab7f578d47b1ba6274c180f5e","sha256":"df7144b29cf3eb57bcf311803e28c97e51001d5f581f0215dc09890be30377ef","sha512":"ad97492cfe15df632c0bd3718befef6b3996b18497c424fc2cb349d97074da0b3aad255de9d9f6cc4bb94677328d90fedb1a3514c6eba0243066fe3eb7876674","ssdeep":"768:JPei4mEATxwYcqXJWenLFqoaiROGVw+FBsioA:J2i4mxTGYrAeRq/iJLFBsioA","tlshash":"25d2e1d7746779221c2ec3686d4e5178bc1c3cbe1d4b9a98683a2e0707dc72d8884be7","first_seen":"2024-08-29T18:11:34.838885Z","last_seen":"2026-03-10T22:58:05.681608Z","times_seen":22,"resource_available":false,"data":null}},"time_used":888,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":887,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/link_bg.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.503Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/link_bg.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-8de\"\r\nDate: Tue, 03 Feb 2026 09:43:55 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:55 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12245\r\nContent-Length: 1678\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 10608489835664750602\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2270,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"09df976eef9c4d0a63de3c4f11127e27","sha1":"784c2f5cde954e25ae62575f2d1c306399d57f15","sha256":"e9c7d8bec0642f9dd752b77078c374c414d60855c1a244d3e00205832f384a4a","sha512":"168ea12b0d6e7657d64cdc9e5b03d91d10794676d959d576fb4ca5b852ba3984982667c4cd02b96a4296dfa6a923b026b5e40be554e4d0901a16eff822149147","ssdeep":"","tlshash":"6941f8ab895cbfbf3a8125c45b19c95019157d5c02fda393a3784deb58c067ab1d00fd","first_seen":"2024-08-29T18:11:34.858211Z","last_seen":"2026-03-10T22:58:05.67869Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2265,"timings":{"blocked":1997,"dns":0,"connect":0,"send":0,"wait":268,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/floatImage/233/1709812338149.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.545Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/floatImage/233/1709812338149.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 07 Mar 2024 11:52:18 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"65e9aa72-4765\"\r\nDate: Mon, 09 Feb 2026 00:40:40 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Thu, 12 Feb 2026 00:40:40 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12247\r\nContent-Length: 13723\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 8316940277706314951\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":18277,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (18277), with no line terminators","md5":"ece03f7547853b35434c67c17e64886e","sha1":"2122401a75508dea6b752206c95cd682f2c292a8","sha256":"3523125322389a914e62d43df4ef0005b606f508b341a6955d6fa4ab25bd69f2","sha512":"dc21e3ac187ad561e6c43137e7e44c09a56da7361f2294806b93d2d7175e3a0570e43ed42b17d0c9c1d611f683def7dd1723ee91c89f4545b90d8e3616abf020","ssdeep":"384:lQgagQmNIcG2AMtO8mZKNl/AHeSK29g6p1V+y3K4DiJEDMffhXyGGEx5R09:9agQmN6zMtO5ZKf/A+SK2N1sjSCEofoV","tlshash":"7082d13aeb57956fd15c10097a791b0e74208aeb52794392f1bd35f81d77abf110038e","first_seen":"2024-08-29T18:11:34.883327Z","last_seen":"2026-03-10T22:58:05.735554Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3746,"timings":{"blocked":3448,"dns":0,"connect":0,"send":0,"wait":297,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/themes/fonts/gui-fonts/gui.ttf","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:14.349Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/themes/fonts/gui-fonts/gui.ttf HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://jn5ec4.pham.xin/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 04 Sep 2025 09:10:07 GMT\r\nEtag: \"68b9576f-68cc4\"\r\nDate: Tue, 03 Feb 2026 09:45:30 GMT\r\nContent-Type: application/octet-stream\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:30 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12229\r\nContent-Length: 429252\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 2242144871935247165\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":429252,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 11 tables, 1st \"OS/2\", 14 names, Macintosh, type 1 string, icomoon    ","md5":"791bc072a3e361510b60c0994a742bf3","sha1":"f08c63ea64126c0f3b24c67fd0e0c5ae5df1b08e","sha256":"7a8e26265738d3cb0f201a53fb168cd59bb721cf0407f00bf25f720cfdcd760e","sha512":"d5548476dd786b5d0d77b02d36199c32d7895e0be8084be18a682f02303971b4c85f6d48e1faa94f51b2eb5ebe61cf91f97299515bcde23fb654a94cbd445509","ssdeep":"12288:pI/XwKnKzir7YTsVYzb/nb/X3M1MP2EF9PpKHQ:pIjnvrsoVK/nbPOAlvP","tlshash":"0e947d07936def8e9451a2e24845d0235ce2e104df3ed366eece7c5cd0258e88d79b9a","first_seen":"2025-09-06T05:10:02.121568Z","last_seen":"2026-04-17T08:01:36.639999Z","times_seen":1267,"resource_available":false,"data":null}},"time_used":7929,"timings":{"blocked":608,"dns":1,"connect":298,"send":5324,"wait":369,"receive":1020,"ssl":306},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/chess/tp-img.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.918Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/chess/tp-img.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-31518\"\r\nDate: Tue, 03 Feb 2026 09:43:52 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:52 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12241\r\nContent-Length: 146952\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 12927359132101600148\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":202008,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"0019c07a05655d6e936a28da0d88d175","sha1":"85737768191852600669a3ce686e3a60870f8528","sha256":"7c6e2112946f7064fbb9f4519c1617ca251a9fe7ef993f1596af471a21765c56","sha512":"c127166563ee9994e0230d7301dee883318ed44709ad2195171deeb8ae4c90b18c73a9f6b891e8b88c5df11f626ddccf0117dab97f622778eba0bc402f4de464","ssdeep":"6144:b2YjcJ/O2a0Gbvsawo8yzaonJo8nfYbyqdmY:b2Yo/8vsBoDrof2WmY","tlshash":"8c14127bad4bbe694face75951ce75d9ae9e1fe315448cc1e48236ea00d132a80cdc70","first_seen":"2024-08-29T18:11:34.807881Z","last_seen":"2026-03-10T22:58:05.600239Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3244,"timings":{"blocked":2936,"dns":0,"connect":0,"send":0,"wait":304,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/lives/bg.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.936Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/lives/bg.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-2c162\"\r\nDate: Tue, 03 Feb 2026 09:45:40 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:40 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13961\r\nContent-Length: 136075\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5248876155245696405\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":180578,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"2f38e65e5a96051f368490184deb36fa","sha1":"264c243acc74aee45b37abbb2586eca3c051f052","sha256":"32d3bd47f54d926bb742d918dd654e93817d224667f5e3c41b6b314bf383ef7e","sha512":"cb62df2f46d493ee3675ec805e0da8a0b3aaa30a8736eb46a2bfdb003a8160f52fa75e03229de0f3f18f669a2b86ab374bd838785c1256448257dd89aa3cf5e1","ssdeep":"3072:5ubmrIDxDac3TOghU91U5eeBms0lEQnv106yM+JR8Mr/wy+n:5nrItDV37QmeeB7+Vnv1/+RLwl","tlshash":"3e0412784e0c3db4ae3cee6c941f7aa9ffa95d9be958554733c61283d1c6e00860e523","first_seen":"2024-08-29T18:11:34.827513Z","last_seen":"2026-03-10T22:58:05.72477Z","times_seen":22,"resource_available":false,"data":null}},"time_used":4079,"timings":{"blocked":3704,"dns":0,"connect":0,"send":0,"wait":371,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/images/favicon/favicon_7285.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.482Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/images/favicon/favicon_7285.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Mon, 05 Dec 2022 08:15:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"638da88c-8c6\"\r\nDate: Tue, 03 Feb 2026 09:45:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:32 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13950\r\nContent-Length: 1599\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 6576969610993551098\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2246,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"0b6186a871ceccd47cdbbf8441a9fbe5","sha1":"9f8c0216563cd8a8a03413b847ebfbe8399f61b6","sha256":"3164d57e02536811b06d8c5a59ae2908c3fbb222cbe3f9fad237e2bc642c620d","sha512":"c6a20fdbab15cab3f4aaf6506decbf1b49cb6da756aa98b20e8dcb76c2ea5a1f2bef7c2adb8d037ca27d6d681bac0e46829c7baf28bc49a963c38d2c48efc734","ssdeep":"","tlshash":"a3411b7a5a6eed0e8c28955edcb730063e394a2f4e67121be46837726de777804407c9","first_seen":"2024-08-29T18:11:34.864127Z","last_seen":"2026-03-10T22:58:05.619434Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1733,"timings":{"blocked":1414,"dns":0,"connect":0,"send":0,"wait":319,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/fserver/files/gb/7285/floatImage/233/1709812336774.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.540Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /fserver/files/gb/7285/floatImage/233/1709812336774.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 07 Mar 2024 11:52:16 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"65e9aa70-12e55\"\r\nDate: Tue, 03 Feb 2026 09:45:41 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nExpires: Fri, 06 Feb 2026 09:45:41 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12246\r\nContent-Length: 58470\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 15218488734126123841\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":77397,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"df4c1280b4beff26b604093bbbd840c6","sha1":"f0d189932661b3a5d0c390f1aba8c6929f605517","sha256":"2f090a6fa6475b27cca94a39af80a1748f19304833fc8ffb5ead5f3c70e34b45","sha512":"e803133c38053bfe8821c9fc361130648a5835438af7d1faca6b2c639faf1166054fa13ccea497baa27a6c747b7fac4f130a55ed9ec787da98a38620555ccf55","ssdeep":"1536:biypPPyGfAuB+7lWILRvEdDBQ9epX274ldhmfWcDVl0LWS8:LHyGf8lWuRvoBVm74Vmf6W9","tlshash":"557302febf052f7f1c68c1303f4508391a464d2cd6c4bae3c49e559ca9c56c26ab7a16","first_seen":"2024-08-29T18:11:34.876828Z","last_seen":"2026-03-10T22:58:05.679769Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3441,"timings":{"blocked":3115,"dns":0,"connect":0,"send":0,"wait":324,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/style/common.css","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.068Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/style/common.css HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Fri, 04 Nov 2022 02:55:38 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"63647f2a-5616\"\r\nDate: Mon, 02 Mar 2026 01:17:00 GMT\r\nContent-Type: text/css\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Thu, 05 Mar 2026 01:17:00 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 254\r\nContent-Length: 5059\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5732718164449832494\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":22038,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (357)","md5":"5d87a7f0b88db54b89bb123f0660dec6","sha1":"c634f55959390cc3b748e488e05e4f6ad1aec2ac","sha256":"42a64d661de9aee64dce6c9a7d2a32ddf9a7b15e734b816d8e8537cfe26c05b7","sha512":"d7c3e6b1188220d8723a3451c2b02a25f799d82ad70bdb569771fb53e3fbd6980bad969c0aa56180c884b8f11725e863b64e6d28c4527be8c8b89be7be79f128","ssdeep":"192:/cBvd+qChbWRpCelhuX/YBM+QB9snbKbctRyFKLqG2IttLtkQ9QmYkMXInutCPmQ:/cBV+qCJWRxhuX/YK+OU3yF0taui4ao","tlshash":"75a2a535c1503109f137d2d9f8a56ba9231e5043970626bafef6356be68b31c2632fc6","first_seen":"2025-06-13T23:48:06.247186Z","last_seen":"2026-03-10T22:58:05.605704Z","times_seen":14,"resource_available":false,"data":null}},"time_used":4773,"timings":{"blocked":2200,"dns":1560,"connect":275,"send":0,"wait":353,"receive":10,"ssl":370},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/jquery/jquery-1.11.3.min.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.075Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/js/jquery/jquery-1.11.3.min.js HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Fri, 20 Sep 2019 08:35:27 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"5d848f4f-176d4\"\r\nDate: Tue, 03 Feb 2026 21:42:27 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 21:42:27 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 253\r\nContent-Length: 33545\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 11815334620796660751\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":95956,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (32038)","md5":"b091a47f6b91e26c93a848092c6f3788","sha1":"52918af2d431e73464060b35d364640c8db75606","sha256":"329ab92b9276ef4e3148f69be6b208969bebdf2db3121a589caa172453fd9f10","sha512":"ab444102be476f0104eeff79c9b596174852b4fe8cbd0b5a0279d56f106a166ec39304636e09326213de000b102ce8f517bb268a9abb2955c56ee4f18b464ea8","ssdeep":"1536:OP10iSi65U/dXXeyhzeBuG+HYE0WEeLDFoNqLTW8+S5VRZIVI6xSb8xh2ZbQnRmS:R+41ZqLTW8xRrqSb8qGH77da98Hr3","tlshash":"6893d8d9b7d67162977730b850bf510bb13a98eab80c4ca0f0a4d8e47d74a89507bf2d","first_seen":"2023-03-07T01:10:10Z","last_seen":"2026-06-07T07:30:11.536389Z","times_seen":18326,"resource_available":true,"data":null}},"time_used":4939,"timings":{"blocked":2212,"dns":1557,"connect":335,"send":0,"wait":340,"receive":162,"ssl":330},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/themes/images/ads2-txt.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:14.882Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/themes/images/ads2-txt.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 27 Jun 2024 08:50:10 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"667d27c2-2bd6\"\r\nDate: Tue, 03 Feb 2026 09:43:48 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:48 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1265\r\nContent-Length: 8440\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 6861601368166361393\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":11222,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"4176f55e1af108a8d52fe192dbc2451b","sha1":"ff2694629bb7cd9b5fa9d250e4e247e52ec89339","sha256":"9fd4840649c7e5746c3c21c02ae9f91359d133ddc349f60466d8411221bfc37c","sha512":"955e5c2353543237c9280df2150bf3a9c9c351cb6e825fc3f350164a2a849f74a522018c87b55e6a312244539cb95abeec1ad6b712381b8f33c730d08aae69e6","ssdeep":"192:V0W3hrXhpP6hz4icqwhuE9x0Jd6AA98SfaDE4DuhXtxZzHy9mtF8sQNgyBE94rAY:eGrx04icFx8q98pDE4DuhFL+mtF1CEur","tlshash":"7432d067fb9df01e24d4e1746ac28a3d5e1d7a1a8dcb814d0388d5072763b01ece889e","first_seen":"2024-07-09T10:27:13Z","last_seen":"2026-06-06T16:12:47.970939Z","times_seen":823,"resource_available":false,"data":null}},"time_used":1549,"timings":{"blocked":1252,"dns":0,"connect":0,"send":0,"wait":296,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/chess/bl-img.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.927Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/chess/bl-img.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-11e58\"\r\nDate: Tue, 03 Feb 2026 09:45:39 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:39 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1266\r\nContent-Length: 54397\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5673223158017505747\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":73304,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"1bb3ffc5c34ba079b036952c8b0d3d9f","sha1":"ee33193db54d520b834196a6da0c8de7718c0a8e","sha256":"5c696378a5967e044d659c3f0a8a20105bfab313805e63ab048d1ede8fdebf06","sha512":"7dbbb5a45cee8bdab69f654950ac01e85d9b01667d66bd826ed2834fa0f206b76b6fac117cff9852522926667a3b1e33c039088fdf6e52ae2b712d304b98b085","ssdeep":"1536:Hx/JbxPsdFkJo2L2pCmPTpM3JMczQagaOPOg8SKSAvId6oOWCYYkyTNBIiHb8:HygJDQThq5G71Oc6oOBdkyTN2","tlshash":"a96302721cce2e108b036d77e037f6416caa56b3c8fb99748742301d36e40de5e66a2b","first_seen":"2024-08-29T18:11:34.824924Z","last_seen":"2026-03-10T22:58:05.627962Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3541,"timings":{"blocked":3236,"dns":0,"connect":0,"send":0,"wait":303,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/lives/ds.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.929Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/lives/ds.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-2b306\"\r\nDate: Tue, 03 Feb 2026 09:45:39 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:39 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12242\r\nContent-Length: 133604\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 4423848094414772393\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":176902,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"3f84872597276694f743f1ff4456e6fd","sha1":"c317f6d513941207476cc392c456f2ddfe74c21d","sha256":"28239bee5f76bf75e03eb4abb9aa4544d69a7ab74ce80118900a21961137345b","sha512":"e67f5a3f20ec6d9bc1ca62760256cd61dd6fecccd765577ee3ddb890c8e4bdf2bb9fa3c5ee025e4c8767748411acfee96dd113b5cc220d955b0a61340f3b08f6","ssdeep":"3072:UekKB8ZizEf/9GqO3ollsIrR2dlhJtjPPtJer76oAG+uN7l4q4388zRuofdErxm0:UekM8pH9GBolludlNjPlJ6bmq438Bb40","tlshash":"980412f2fa494b0543ba4a70c19b53a82fbfb8d718029499236d70d09ef8757c3e6952","first_seen":"2024-08-29T18:11:34.811255Z","last_seen":"2026-03-10T22:58:05.728834Z","times_seen":22,"resource_available":false,"data":null}},"time_used":3517,"timings":{"blocked":3243,"dns":0,"connect":0,"send":0,"wait":269,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/bottom_bg.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.479Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/bottom_bg.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nEtag: \"6673fb50-86\"\r\nDate: Tue, 03 Feb 2026 09:45:32 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:32 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12244\r\nContent-Length: 134\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 3392913986099854853\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":134,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"5db94c05d63b9a98e992c08382a18dc2","sha1":"75bd852dc336afed34f128a9a1e949faf5890881","sha256":"408b1bb7acbe820b605907dc58ce08fb07690a8c3970bbf7dfae932c4ba91cec","sha512":"81c6e68ee8d72efc4f98eb2e9c2a9961a0f89d6a02960079f4706367744471a0824c8ae895bfacdc8c9a1bb8dc1852b7462f45300219a0f4187cb12620228da0","ssdeep":"","tlshash":"4ac02b7313024c55029201da241120344c43db0b611c3310388d0140e8c323080f0c0c","first_seen":"2024-08-29T18:11:34.863137Z","last_seen":"2026-03-10T22:58:05.706164Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1500,"timings":{"blocked":1227,"dns":0,"connect":0,"send":0,"wait":273,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/B2.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:21.501Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/B2.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-1ef3b\"\r\nDate: Tue, 03 Feb 2026 09:46:33 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:46:33 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 12245\r\nContent-Length: 96278\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 4879635180579177835\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":126779,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"cdbf5266bfff2ce31c45a517bbc89cc8","sha1":"231b21f8696d74bdbc01aded8f48b0b124ee93d8","sha256":"7b4ce08da797f90e7667980cff5a3ba6d58d30a56b43db9eed8b7a49ed0790c8","sha512":"b94d43aff11901d8b412b4851c36d8711b5d7bdd734fd5a319682263dc08d0f547e96172ddfc9af72b6fca3306a45df2e79c240917717bac716565705d82c76d","ssdeep":"3072:+7qS6WUFFz8HUlFTirX3tVuWoGiqpGm2hr4G0uGu1kVFk/Y:+2dFF2H3tzGqpt7sAf","tlshash":"0fc312b03fd1a17953bc1623922be59e1eb73e19a3980cac159026515cffbb92dc163c","first_seen":"2024-08-29T18:11:34.85704Z","last_seen":"2026-03-10T22:58:05.675744Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2184,"timings":{"blocked":1850,"dns":0,"connect":0,"send":0,"wait":330,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/js/websocket/Comet.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.102Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/js/websocket/Comet.js HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Mon, 19 Jul 2021 23:50:13 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"60f60fb5-43bc\"\r\nDate: Wed, 11 Feb 2026 01:13:10 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Sat, 14 Feb 2026 01:13:10 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 3006\r\nContent-Length: 4031\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 12712210756993604574\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":17340,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"1008fe6a5e1a182d7775963b85405bb2","sha1":"e174a7b08cc3cb5545af1cd33d2814e604119392","sha256":"7479f6f22194ac37dd6d3f5a579b4682ac8dcb6389fb961cf4140f3fcc707a20","sha512":"26e07821ee1e8e94c4bada028e049df7572cac06f2e8dae958baa7a011eb201a6a1d4ed0cfa15017a3f52a0cb949343de0b33ca6da7c245f763c86d5adfb0223","ssdeep":"192:4Pf+aTbLSru4NyRs8VDv1KygOdWuTyVC3d7QPXLHOm8cSCl1Ej7bY8l7YJIJvO5N:4Pf+aTbe4M2cXzsjDUfj","tlshash":"ab721e4a2cf76086552732b90f5f64543235a8172605e91c7dcca6e08f98b7c1babff8","first_seen":"2023-04-05T18:30:47Z","last_seen":"2026-06-07T07:30:11.494719Z","times_seen":17452,"resource_available":true,"data":null}},"time_used":2926,"timings":{"blocked":2539,"dns":0,"connect":0,"send":0,"wait":386,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/061410/rcenter/common/js/gamebox/common/jquery.validate.extend.msites.js","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"211.95.142.138","port":443,"asn":135061,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:10.121Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /061410/rcenter/common/js/gamebox/common/jquery.validate.extend.msites.js HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Tue, 27 Aug 2024 03:30:00 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"66cd4838-3a09\"\r\nDate: Tue, 03 Mar 2026 02:26:12 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Mar 2026 02:26:12 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 254\r\nContent-Length: 4126\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 6455378185918327477\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":14857,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (14855), with no line terminators","md5":"4fe7dadf050dad2dcfd386d21b880281","sha1":"07e7feb8dc9309fe66d86d7a9e27f8efd32ab0bd","sha256":"aa891aafe8e98e1e15d81b2b116e6c3808d0bbbec56cd24818e2e7ac911877c9","sha512":"9da40e5132ece9fe346f27aa467b2496545c84197131c633e5b1ff1f641ece723440ec0289e82d7948b85bcd901b9e3eb6e36f8e0339ae05e4a32621e895accf","ssdeep":"384:yC+tJn9Dbvbf1P3QSBxDrdiewZnnoTW39if+04xSlR4nbiamdrjNfrzInGINYlor:NWJnlN3QSBxDMewZnnoTW39L0MSR4biK","tlshash":"a762954d3a9514bb4adf31b770ab204f767e8800852c91c4bdbca0d166b5ee072e7e6d","first_seen":"2023-03-07T01:14:38Z","last_seen":"2026-06-08T03:51:22.328454Z","times_seen":17500,"resource_available":true,"data":null}},"time_used":3621,"timings":{"blocked":3343,"dns":0,"connect":0,"send":0,"wait":277,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bet365","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bet365 phishing","tags":["bet365","gambling","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/commonPage/images/partner/partner-hongtu-gray01.png.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.499Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/commonPage/images/partner/partner-hongtu-gray01.png.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Tue, 02 Sep 2025 06:45:09 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"68b69275-1a1f6\"\r\nDate: Tue, 03 Feb 2026 09:45:36 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:45:36 GMT\r\nX-Cache: HIT\r\nuuid: -\r\nout-line: gb-cdn-212\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 13963\r\nContent-Length: 81241\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 6794051329223638404\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":106998,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"0d835d7c8082eee7f89f0b1b2e62f4e4","sha1":"0faf9149c454be0261eea8b14afaabb70a6bddca","sha256":"a5f8a8d222b97704ebb832a6c68228b835c7d40fabd508de50d662e8f1add6ce","sha512":"c3a9d53a1cd3b51fa7b5af588085dc2ce8de1d0ebd7a86b151f90564dfc120b31be5a5519950265b4b511b7e1b80e5d5e3938104a8cdccfcfce626e5de27f372","ssdeep":"1536:AxJxL2StOAnubXwaS8BIunTHYHwpjLao55e39o8/mamUX1eYPo6uXyQenBV7/XAd:kKuqnbnbKwBw68+amI1eYg6fBVjg","tlshash":"daa30234d3a4f6d50ead035ee525f92c9e4182a74024edc9742b2cd382fd1786e10bde","first_seen":"2025-09-07T00:50:47.554845Z","last_seen":"2026-04-17T08:59:04.344356Z","times_seen":1764,"resource_available":false,"data":null}},"time_used":2011,"timings":{"blocked":1471,"dns":0,"connect":0,"send":0,"wait":260,"receive":280,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jn5ec4.pham.xin/ftl/xpjchess_7285/themes/images/zh_CN/lives/ea.jpg.base64","fqdn":"jn5ec4.pham.xin","domain":"pham.xin","tld":"xin"},"ip":{"addr":"116.131.57.65","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ong3589.com:8989/","date":"2026-03-04T12:49:15.937Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pham.xin","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 02 Feb 2026 00:00:00 GMT","end":"Tue, 02 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"8D:E1:DB:0C:6A:1E:A1:35:4C:A9:36:95:EB:81:E2:4F:E3:B4:B0:F4","sha256":"17:C8:21:E9:B5:4D:A2:16:1A:91:DD:6B:E8:57:BB:1B:57:64:E3:89:CA:6F:EB:3B:04:1B:7A:5E:19:36:49:7D"}}},"request":{"raw":"GET /ftl/xpjchess_7285/themes/images/zh_CN/lives/ea.jpg.base64 HTTP/1.1\r\nHost: jn5ec4.pham.xin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ong3589.com:8989\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ong3589.com:8989/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Thu, 20 Jun 2024 09:50:08 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"6673fb50-1080e\"\r\nDate: Tue, 03 Feb 2026 09:43:53 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nExpires: Fri, 06 Feb 2026 09:43:53 GMT\r\nX-Cache: MISS\r\nuuid: -\r\nout-line: gb-cdn-211\r\nServer: SLT-MID\r\nCache-Control: max-age=259200\r\nAge: 1266\r\nContent-Length: 50905\r\nAccept-Ranges: bytes\r\nX-NWS-LOG-UUID: 5289636158356917308\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Hit\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":67598,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"f877b92b65adc657ffe1cb43c818d791","sha1":"432610c74062cfbd244a1911da1c61f9962ec60f","sha256":"b45ee8ce3a3a0cff91b69163c87df7d42d9aaeef21319f57d294391f4a9d2be2","sha512":"3421bdc6b94fd296784691511722420127668347eb1fa3211b9d58c0f0e1d5be0eddff5c0b329f22d8e9393fc7374e9c7a02b2d18ccd760d360a1aa01b5aa12e","ssdeep":"1536:dh7DGsmij8cgFXblujDIK9IjFhqz4N8mE+JwXCjtZ+gdIA:asmij8PFXpSIIWUHxdCjtZ+w","tlshash":"466301384ee63465bb598937ccb27b18fc424abb87c9391d19c06a8255d33847f2bd93","first_seen":"2024-08-29T18:11:34.826317Z","last_seen":"2026-03-10T22:58:05.623467Z","times_seen":22,"resource_available":false,"data":null}},"time_used":4078,"timings":{"blocked":3809,"dns":0,"connect":0,"send":0,"wait":265,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}