{"report_id":"94c3eb81-33cd-4b94-988e-39fac4d46826","version":6,"status":"done","tags":[],"date":"2025-10-19T08:00:01Z","url":{"schema":"https","addr":"kkmusic163.icu/","fqdn":"kkmusic163.icu","domain":"kkmusic163.icu","tld":"icu"},"ip":{"addr":"172.245.67.31","port":0,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"kkmusic163.icu/","fqdn":"kkmusic163.icu","domain":"kkmusic163.icu","tld":"icu"},"title":"网易云音乐客户端"},"submit":{"url":{"schema":"https","addr":"kkmusic163.icu/","fqdn":"kkmusic163.icu","domain":"kkmusic163.icu","tld":"icu"},"ip":{"addr":"172.245.67.31","port":0,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-23T08:00:01Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":0}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-19T07:59:38Z","timestamp":1760860778,"ip_dst":{"addr":"172.245.67.31","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.19","port":45250,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO Suspicious Domain (*.icu) in TLS SNI","source":"{\"timestamp\":\"2025-10-19T07:59:38.949369+0000\",\"flow_id\":1336106786916075,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.19\",\"src_port\":45250,\"dest_ip\":\"172.245.67.31\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2026889,\"rev\":4,\"signature\":\"ET INFO Suspicious Domain (*.icu) in TLS SNI\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2019_02_06\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"tls\":{\"sni\":\"kkmusic163.icu\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3478,\"start\":\"2025-10-19T07:59:38.624363+0000\"}}"}],"analyzer":null,"urlquery":null},"summary":[{"fqdn":"p0.qhimg.com","ip":{"addr":"138.113.181.188","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"domain_registered":"2011-02-17","domain_rank":478979,"first_seen":"2012-10-11T20:27:29Z","last_seen":"2025-10-15T02:08:58.308453Z","alert_count":0,"request_count":1,"received_data":15491,"sent_data":418,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"se2.360simg.com","ip":{"addr":"104.192.108.23","port":443,"asn":55992,"as":"Beijing Qihu Technology Company Limited","country":"United States","country_code":"US"},"domain_registered":"2021-08-19","domain_rank":2801600,"first_seen":"2022-07-21T08:54:21Z","last_seen":"2025-10-02T22:51:24.805969Z","alert_count":0,"request_count":1,"received_data":1631,"sent_data":455,"comment":"","tags":null,"fingerprints":null},{"fqdn":"kkmusic163.icu","ip":{"addr":"172.245.67.31","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":2,"received_data":732965,"sent_data":945,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"p4.ssl.qhimg.com","ip":{"addr":"138.113.181.188","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"domain_registered":"2011-02-17","domain_rank":798718,"first_seen":"2016-05-06T09:41:20Z","last_seen":"2025-10-17T20:17:50.668008Z","alert_count":0,"request_count":1,"received_data":967,"sent_data":456,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-19T07:59:38Z","timestamp":1760860778,"ip_dst":{"addr":"172.245.67.31","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.19","port":45250,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO Suspicious Domain (*.icu) in TLS SNI","source":"{\"timestamp\":\"2025-10-19T07:59:38.949369+0000\",\"flow_id\":1336106786916075,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.19\",\"src_port\":45250,\"dest_ip\":\"172.245.67.31\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2026889,\"rev\":4,\"signature\":\"ET INFO Suspicious Domain (*.icu) in TLS SNI\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2019_02_06\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"tls\":{\"sni\":\"kkmusic163.icu\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3478,\"start\":\"2025-10-19T07:59:38.624363+0000\"}}"}]}],"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"kkmusic163.icu/","fqdn":"kkmusic163.icu","domain":"kkmusic163.icu","tld":"icu"},"ip":{"addr":"172.245.67.31","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-19T07:59:38.519Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kkmusic163.icu","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Sun, 17 Aug 2025 03:12:38 GMT","end":"Sat, 15 Nov 2025 03:12:37 GMT"},"fingerprint":{"sha1":"E3:1B:F9:3D:55:02:3C:F9:E7:94:19:DB:86:7E:55:E7:A7:40:76:9C","sha256":"12:E7:25:CF:EE:EA:22:43:CC:FE:03:44:30:5F:50:E6:7D:0B:ED:2D:F7:D6:E5:69:3F:EA:01:9F:D4:CE:6A:12"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: kkmusic163.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 19 Oct 2025 07:59:39 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 08 May 2025 14:53:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"681cc54c-242e\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9262,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (415)","md5":"5ca49e2744c2c208494fbf1ce94c1668","sha1":"cc13332188e4ce41471beb718452b899bbed7c67","sha256":"647623ecbcdcf7508794021e48c725406c8631ab5c171f63d7d5a829718dbf4f","sha512":"81fda0d5574db78930011ad16fe1cc62e03dc113af5e89daccb8c6125285395191d101ba6c1f4c3386068f2ffd3e39f6da8501a0389568cbd3b5c451e0b24e8b","ssdeep":"96:Sq6O+5vwANNITM/Q1ZQ5UIIEirT0dTdk8cNpIok4xajqD9p+OQYePZN:4z5YANvk7XEiyRk8apIr2D94OQYePZN","tlshash":"bf12315683a7a412bc67d4b86b371f0623a9c087d906cd2d7fdc3289cf9b1e5896234c","first_seen":"2025-10-19T08:00:10.25232Z","last_seen":"2025-10-19T08:00:19.225697Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1039,"timings":{"blocked":436,"dns":107,"connect":161,"send":0,"wait":165,"receive":0,"ssl":167},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kkmusic163.icu/static/t11098f6bcd22548fb827bf14cf.png","fqdn":"kkmusic163.icu","domain":"kkmusic163.icu","tld":"icu"},"ip":{"addr":"172.245.67.31","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kkmusic163.icu/","date":"2025-10-19T07:59:39.394Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kkmusic163.icu","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Sun, 17 Aug 2025 03:12:38 GMT","end":"Sat, 15 Nov 2025 03:12:37 GMT"},"fingerprint":{"sha1":"E3:1B:F9:3D:55:02:3C:F9:E7:94:19:DB:86:7E:55:E7:A7:40:76:9C","sha256":"12:E7:25:CF:EE:EA:22:43:CC:FE:03:44:30:5F:50:E6:7D:0B:ED:2D:F7:D6:E5:69:3F:EA:01:9F:D4:CE:6A:12"}}},"request":{"raw":"GET /static/t11098f6bcd22548fb827bf14cf.png HTTP/1.1\r\nHost: kkmusic163.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kkmusic163.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 19 Oct 2025 07:59:39 GMT\r\ncontent-type: image/png\r\nlast-modified: Sun, 13 Oct 2024 03:28:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"670b3e64-b0884\"\r\nexpires: Tue, 18 Nov 2025 07:59:39 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":723076,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1868 x 1080, 8-bit/color RGBA, non-interlaced","md5":"6cba7852acc633472dade8104b044624","sha1":"4e2f821cea8e707667bdaa58abccf41a3e546d1b","sha256":"0418fb6a54076fcc6e68d14e44eb5b7cd007e072757e953d3e6e1af59db722f4","sha512":"9b81f43efe38cb4079b1e271fa41ff573cd2faea6203f7a7ee6ff3a536a049c5f496b626fc716b8b83d87766681b087f84bb0f7cdd91b6b9a1e3c08e5033b28e","ssdeep":"12288:EdNbstkC1H2x4qwEcsz9HC+Qq9vYj/b1Nsdm5IY3+jmUtljGz52K7/rIGe+VIYVV:EdNWkgzqA09H+0Aj/JNsyIYgmoC5Jr99","tlshash":"1df4236eccd1867406ce117422c73a8e27e786734769000f5c8aaa69de619fd7bc0d9f","first_seen":"2025-10-19T08:00:10.272597Z","last_seen":"2025-10-19T08:00:19.304129Z","times_seen":2,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"p4.ssl.qhimg.com/t11b673bcd67dbca4043c86833f.png","fqdn":"p4.ssl.qhimg.com","domain":"qhimg.com","tld":"com"},"ip":{"addr":"138.113.181.188","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kkmusic163.icu/","date":"2025-10-19T07:59:39.399Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ssl.qhimg.com","organization":""},"issuer":{"commonName":"WoTrus DV Server CA  [Run by the Issuer]","organization":"WoTrus CA Limited"},"validity":{"start":"Mon, 17 Mar 2025 00:00:00 GMT","end":"Fri, 17 Apr 2026 23:59:59 GMT"},"fingerprint":{"sha1":"9F:97:DF:6D:B1:CC:B8:56:24:EB:FA:31:A3:58:CC:DE:1E:98:35:B7","sha256":"D1:C7:C4:4F:EA:BB:25:D9:22:3D:3E:42:81:5B:C0:52:D6:83:34:0C:34:AA:24:C3:61:E4:53:D4:90:99:15:71"}}},"request":{"raw":"GET /t11b673bcd67dbca4043c86833f.png HTTP/1.1\r\nHost: p4.ssl.qhimg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kkmusic163.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 19 Oct 2025 07:59:40 GMT\r\ncontent-type: image/png\r\ncontent-length: 435\r\nexpires: Sat, 10 Jan 2026 07:38:16 GMT\r\nserver: nginx\r\nlast-modified: Wed, 24 Sep 2025 11:27:32 GMT\r\nxzp: orxleiwzhoemlml\r\ncache-control: max-age=7776000\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nxcs: HIT\r\naccept-ranges: bytes, bytes\r\nx-via: 1.1 PS-000-01oeV47:17 (Cdn Cache Server V2.0), 0.0 PS-ARN-01C8L93:7 (Cdn Cache Server V2.0)\r\nage: 1\r\nx-ws-request-id: 68f49a6c_PS-ARN-01C8L93_43892-45421\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":435,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"10d7bbc06b57bc6fa84d94979fa719f8","sha1":"a27caaff1d16e0c6a7085c508f948e4f5b2d721c","sha256":"a6a07491a6ba6b7641d4a63e0c537f2c890a34a35cc5fbb8acc6dd9ada8566f0","sha512":"ff0378f2979cedd33c1ba02f231017ce265e3b89f51e6d009e47fbf515455c1ecfa4b8001d1822b5a57e84085a765258a7a4eddb76c21ceaf68bb65bd6107752","ssdeep":"","tlshash":"cee0dcc6790054bcc22dc06e52524c4afe6a7a0d44a36a48a896f2142991a08f54fb03","first_seen":"2025-10-17T17:35:08.510754Z","last_seen":"2026-05-30T07:55:54.210455Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1844,"timings":{"blocked":907,"dns":252,"connect":27,"send":0,"wait":22,"receive":1,"ssl":630},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"p0.qhimg.com/t11098f6bcdcccb140f443976f0.png","fqdn":"p0.qhimg.com","domain":"qhimg.com","tld":"com"},"ip":{"addr":"138.113.181.188","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kkmusic163.icu/","date":"2025-10-19T07:59:39.406Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qhimg.com","organization":""},"issuer":{"commonName":"WoTrus DV Server CA  [Run by the Issuer]","organization":"WoTrus CA Limited"},"validity":{"start":"Tue, 08 Oct 2024 00:00:00 GMT","end":"Sat, 08 Nov 2025 23:59:59 GMT"},"fingerprint":{"sha1":"E1:82:63:45:40:BA:FC:AC:01:24:60:F3:43:4A:74:8E:FD:5C:EC:DC","sha256":"8C:49:E3:45:F0:0F:3C:C4:DC:60:DF:D1:93:F6:BB:C8:D9:F5:5E:25:34:FD:D4:2E:4F:2B:52:A6:DF:EC:13:4D"}}},"request":{"raw":"GET /t11098f6bcdcccb140f443976f0.png HTTP/1.1\r\nHost: p0.qhimg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 19 Oct 2025 07:59:40 GMT\r\nContent-Type: image/png\r\nContent-Length: 14886\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Fri, 17 Oct 2025 10:56:35 GMT\r\nxzp: mrvhmrovmrsrmlml\r\nExpires: Sat, 17 Jan 2026 07:59:40 GMT\r\nCache-Control: max-age=7776000\r\nAccess-Control-Allow-Origin: *\r\nTiming-Allow-Origin: *\r\nXCS: HIT\r\nAccept-Ranges: bytes, bytes\r\nx-via: 1.1 dx141:3 (Cdn Cache Server V2.0), 1.1 PS-HND-01SaS134:5 (Cdn Cache Server V2.0), 1.1 PS-ARN-01C8L93:8 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 68f49a6c_PS-ARN-01C8L93_44047-1038\r\nX-Cache: MISS from cache.51cdn.com\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14886,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"f7812ea0f1c8ad727d3e2d9e5b8c0303","sha1":"3c86e0366c9fa031ee0dc8ea2767cb172ed0e992","sha256":"1360ed53c67f4457956f0e328636f38d3dda0639e950c2ea2182e0649d421c44","sha512":"9a2a9f15bb8565707bb779376783e200c301e0149fd96b32d35a4421cc00aff5866c13a97f81185ff8311ac0a8d97b297e84c044fc7edaaceb10ca2b7e64d372","ssdeep":"192:nCQ15chEK8WKQdWM/0qIKOMQVk1pUKDp9dO4clyBvAd/yqIgQB96xVQTjgnPS6/J:l15chEpaIZMck1z24c4Ydq7smaK6/ou","tlshash":"a762d1af9212f2d41d50d1f080a1b877e1bd4d5f5388cc3f85f987526ea9a8ebca11b1","first_seen":"2025-10-19T08:00:10.315442Z","last_seen":"2025-10-19T08:00:19.419596Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2319,"timings":{"blocked":893,"dns":208,"connect":8,"send":0,"wait":501,"receive":33,"ssl":672},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"se2.360simg.com/d/inn/c96b2eaf7894/logo-360.png","fqdn":"se2.360simg.com","domain":"360simg.com","tld":"com"},"ip":{"addr":"104.192.108.23","port":443,"asn":55992,"as":"Beijing Qihu Technology Company Limited","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kkmusic163.icu/","date":"2025-10-19T07:59:39.708Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.360simg.com","organization":""},"issuer":{"commonName":"WoTrus DV Server CA  [Run by the Issuer]","organization":"WoTrus CA Limited"},"validity":{"start":"Wed, 10 Sep 2025 00:00:00 GMT","end":"Sun, 11 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:52:94:FD:FD:64:B8:E1:09:5D:09:19:8C:B5:6C:4E:AB:A0:BE:4D","sha256":"F1:D8:4A:FB:8A:30:B9:87:89:A5:9A:65:3D:38:3A:38:1C:A9:EE:49:8C:AA:5F:76:F7:C3:E1:CB:2C:93:5D:89"}}},"request":{"raw":"GET /d/inn/c96b2eaf7894/logo-360.png HTTP/1.1\r\nHost: se2.360simg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kkmusic163.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 19 Oct 2025 07:59:41 GMT\r\ncontent-type: image/png\r\ncontent-length: 1212\r\nlast-modified: Tue, 26 Aug 2025 13:22:59 GMT\r\nxzp: orxleiwzhoemlml\r\nexpires: Sat, 17 Jan 2026 07:59:41 GMT\r\ncache-control: s-maxage=7776000, max-age=7776000\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nxcs: HIT\r\nkcs-via: HIT from w-fc02.lato;HIT from w-sc02.lyct\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1212,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 20 x 21, 8-bit/color RGBA, non-interlaced","md5":"8b532b2c91d3b3b380046345a0a63786","sha1":"bd317249cfa5360094c79fec879c4b1d1af4709c","sha256":"27d19a2622dd88d7c59b76c4a1f1a3f181879f54b29c5e13066b8f67c3c400f6","sha512":"4cbb584b8d2bd6adc706793a5681ec31fb1162313421b7cc58fe351c36f13035b2084c506d1b70e4968c4ba68969124a4c9e49b4f3884cb4f02506f81f4112cc","ssdeep":"","tlshash":"d221b46a6f109006bd70dfe39f525944c2a831a635445e3e1a22e8b8fe98b38b981517","first_seen":"2025-10-19T08:00:10.326853Z","last_seen":"2025-11-19T06:30:19.346036Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1806,"timings":{"blocked":-1,"dns":1169,"connect":156,"send":0,"wait":156,"receive":0,"ssl":324},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}