{"report_id":"95ca75f1-8e82-4430-8f47-8c59f7853a32","version":0,"status":"done","tags":[],"date":"2026-06-07T16:21:52Z","url":{"schema":"http","addr":"tronsave.vip/","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":0,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"tronsave.vip/#/pages/in/login","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"title":"登 录","dom":{"size":182260,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (39570)","md5":"45fc397cb593590f52c54a79edb274ec","sha1":"faa9c3ee7d6ce5bef59e1d15e1ca32c2bc746922","sha256":"58606d1773af0173607a0dec00750bd7917a6f1a5342de8f995c228454dd2b64","sha512":"77cf2ad578e690ff699e99442539291652361356a330552b7881d940de02f203467e2770828953d0cd9f95fa7d3d13245e1ebbeb71f1d37fbb74990a8924bbae","ssdeep":"3072:RiHikxXxxlNPsoKkdSgvNrcrdeBbmcKzDtA+exfRR52n:RiHik5xV9KCSgvNrcrdeBbmcKzDtA+eW","tlshash":"ac04b7766445215966339aa287c89f584f3cd73380b21cedb3553c4e8f87bda33aa607","dom_hash":"domhash72b6520e483922c33bd74c9be729fdf4","first_seen":"2026-06-07T16:22:02.187208Z","last_seen":"2026-06-07T16:22:02.187208Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"tronsave.vip/","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":0,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-12T16:21:52Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"chat.tronsave.it.com","ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":4,"received_data":4164,"sent_data":2095,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"tronsave.vip","ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":42,"request_count":21,"received_data":1905215,"sent_data":11687,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"www.mescroll.com","ip":{"addr":"185.199.110.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2017-06-01","domain_rank":2976239,"first_seen":"2019-05-22T11:41:52Z","last_seen":"2026-05-29T02:49:34.731651Z","alert_count":0,"request_count":2,"received_data":1913,"sent_data":1106,"comment":"","tags":null,"fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"GitHub Pages","description":"GitHub Pages is a static site hosting service.","website":"https://pages.github.com/","common_platform_enumeration":"","icon":"GitHub.svg","categories":["PaaS"]},{"name":"Fastly","description":"Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video \u0026 streaming services.","website":"https://www.fastly.com","common_platform_enumeration":"","icon":"Fastly.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"at.alicdn.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2008-06-25","domain_rank":96084,"first_seen":"2013-11-28T05:03:29Z","last_seen":"2026-06-05T02:29:15.968348Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":526,"comment":"","tags":null,"fingerprints":null},{"fqdn":"cdn.dcloud.net.cn","ip":{"addr":"106.54.228.253","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"domain_registered":"2013-07-17","domain_rank":296858,"first_seen":"2018-09-15T09:18:08Z","last_seen":"2026-06-05T05:21:58.99907Z","alert_count":0,"request_count":1,"received_data":576,"sent_data":547,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"tronsave.vip/static/js/index.bb6d7664.js","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"54c740eb5564b954d35d17028317e41d","sha1":"67e6f45d0673ddd16dba7d7444ed7e6c392659d3","sha256":"4dec3996d6724cdb594ae8e0458d322e119ced42820c3ae8e993ec771c9a14a2","sha512":"8fcd1b7f98b098a64bec6cb9df35af71e4db915c1a4b498c47f89ca8a1efdfea4bc91b1e7f3fa34a850065175e171ea755c28ed895507a8b3e2fdda0d5bc2b48","ssdeep":"3072:OiicC5093eHIjBcL6kvVDZ3fULYHikxXxxlNPsoKkNvO54mQUNHJ:OcA09zcHviYHik5xV9KG+w0HJ","tlshash":"bf4409ba708aeb9d15ab7067781fb20325353c924c8db051e3b9e5e49f9e14a9733f04","size":275655,"data":"","first_seen":"2026-06-07T16:22:02.226771Z","last_seen":"2026-06-07T16:22:02.226771Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/js/pages-chat-index~pages-chat-message~pages-details-index~pages-friend-index~pages-my-details~pages-my-index.a0b67159.js","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"3362053427a6d58a2eb0f3be494d6b34","sha1":"da49dbb12a673f8b5827203f98776e90490772a2","sha256":"b743ca1c62d83d2c8159a4c7562d678bfb35e5fd255e8fb38bfcd9d358d50e33","sha512":"c669991f2477134722d6688c1a4b02372c2932d5de20509403aa875bc2043c271e3276aa6ac4897d1292a06af980c066162f48884de502be3ee96076220db654","ssdeep":"192:+KhFWZzcmZm++myppikKDrBEqnjqMPIsiqi44vDz/9GLqRsOz:+KaZgmZ9SiPfWhg8txvDZBf","tlshash":"bf2295dc72c7f46902932620941f200ae23f2d9de909d095e765d9e3fcb454e922bf78","size":10786,"data":"","first_seen":"2026-06-07T16:22:02.216594Z","last_seen":"2026-06-07T16:22:02.216594Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/js/pages-chat-index~pages-my-trans_index.c501f2fc.js","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"1a0c1973d6ffa28c593d140b87a85929","sha1":"b7f91f9fbd54d525ec4725a4cbb24f3064ed9297","sha256":"5ff5d1f9c24570d7b416b6ca7f85a2b9e7a7d33866ab19372bc210cbf73a044b","sha512":"79948c49b8407f69bfa16dd0ccd75fa1dca928b41eb2c5f792341c2ce82ce3da904acd03c38b898e7a36bbf93b93a31d6b320471a84e443c533dc758b31c648c","ssdeep":"192:Qw0wqRsmYt8lpBN5U8K0/Mbtx+tPMHzZ9qRsE4MzqwdTjQ2Rfn8yy1eH0yXN+9TJ:TYC2FU8F/Mf9dshwwd/BRfuehFl6","tlshash":"4b920a44b0c6b45a06835168017ba209a0377db9a415a4d1f7f4fafa8ef4a9f1337f6c","size":20798,"data":"","first_seen":"2026-06-07T16:22:02.223378Z","last_seen":"2026-06-07T16:22:02.223378Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/js/pages-chat-index.7e1c85be.js","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"74d638e0d59e3d93c287d22f494e5844","sha1":"ccf199d12dffc4f0ac0ec9ad8779ca27e3a7e0e7","sha256":"e6dd00d25445de5b02a9291f85cf782ab80299644d8c6f18aaef471f791d00e8","sha512":"dead8d75a05c79dd3581c8d62902ca10e5b1d5957243051bf8da7e20b0d208334da6d67bfe73e10d8cdb3d4a895298aaffbee57e3de99f9e4c0de593103cd209","ssdeep":"3072:dwSvpLWmRghNrcrdeBbmcKzDtA+exfBRp2FymV63nNrbBg:iUghNrcrdeBbmcKzDtA+exfBRp2FlONG","tlshash":"d604c6597441219d42736aa282de0a484739a72710712cfd73519ccf8f6bbdf33aab27","size":176710,"data":"","first_seen":"2026-06-07T16:22:02.212914Z","last_seen":"2026-06-07T16:22:02.212914Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/js/pages-chat-index~pages-scan-scan.ba60e78b.js","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"aed5f7aa1ed47e85e6c87782030152d6","sha1":"9dfd93e1ec82528b61bad41ab7fd8a94f059a7dd","sha256":"b1da26b2b043249a27596375541a5d130674f472aefcb705006ca864ebb37696","sha512":"5669d73ae3d2a21300f2e794d1a3e33514ddf0372bc1cf9d4c8599f204b66be22a3716baa42d2eae355f0a83aa1fa29505a5bb3018d24f72997a70d0931a11e8","ssdeep":"12288:dhkpYxNZki7JuknGmZHiiQJWI4YIYWyAW:dhkykitriiOWI4YIYWlW","tlshash":"3ea41b9472d370a0979371a8046f2009b1bb2878588dc068ff35ded7ada9d8b6677f34","size":454995,"data":"","first_seen":"2026-06-07T16:22:02.202849Z","last_seen":"2026-06-07T16:22:02.202849Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/js/pages-in-login.fddd4177.js","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"5f438c502cc8aa82cd229876c50822f8","sha1":"690a40dc7717221f8a0ccde741a3d1118ea37887","sha256":"e1dbe7b9e7274e1fb0f17ce3a3318bc328a4ce2026b65a0cb09ee05a8e00443e","sha512":"71212264296f1b2227099e37b4d9fedf6029532aa0ac67215ed2bf940e2b88011653405582fb4f8cbba566bddaf0dad6fc76049cc15911fe6eff74a9fbb2e2b5","ssdeep":"192:93J2eFcLeIaedgGgSwwTwAw+5w8CfwVH10upVHeOqRsPx7c2C6zTt8pIMsOM9k6h:v39IzdzaOrLJAEJaI","tlshash":"4c520a21f18db96e9d97c0d4d0a35364d13a5fbaa000ad48eb72fed80ed698716327dc","size":13916,"data":"","first_seen":"2026-06-07T16:22:02.237727Z","last_seen":"2026-06-07T16:22:02.237727Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"93368157fb131b56a45d6f60f8b40342","sha1":"ea2a25edb7b00c3e0a06650f02fded5bd87dfa20","sha256":"c48d4859bc082aa591168f7d7230bef438ecc2b3074e707c83864e11ec1a891f","sha512":"366c90d022f7fd6718d76460de51a154cf6cf8bf8e3aefa2e0e736cbba24ec53506485331abd3c3c2a7e6ae00c9a3b957a9aa675ecdd389afca7863ad8365908","ssdeep":"","tlshash":"c8e068c260a6294c02208016304ac1031bb608729ec149613c4c67a58fb9f4bc46e859","size":352,"data":"","first_seen":"2023-03-07T01:10:06Z","last_seen":"2026-08-09T03:22:31.894857Z","times_seen":7165,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/js/chunk-vendors.b0bc56f8.js","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"8160e979f9a1356fb3438464bdbddbc8","sha1":"a7209d76276f66b415c3d86daad3819979e79675","sha256":"8bfaa3800bb7821dc37ec686055bc55d96f502c1aaaab8dcbd125193f1cb71f1","sha512":"65e5ed00650516d9d6af72cc778288b15b6d52c7b96978d7514e626db5f6994b3192365c5e185c3f08bbf1e39e3ae704cd140d844a34e92ec150b5a417262aea","ssdeep":"6144:0yi1bPFxYYlIAIXtwTf3Oyb/+xNvMNTKrbsvmRnO+Qhlxv3z8UHjBCfF:0HZv3IdwTfAxVMtyPOJv3zLj2","tlshash":"5a05f78df282b0b60be760b5403f220bb2376959b40a84d4f675e4d4ad7894e6237f7d","size":814178,"data":"","first_seen":"2026-06-07T16:22:02.221743Z","last_seen":"2026-06-07T16:22:02.221743Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"tronsave.vip/static/float/qunliao.png","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:23.225Z","timestamp":1780849283225,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /static/float/qunliao.png HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 825\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\netag: \"69e113e6-339\"\r\nexpires: Tue, 07 Jul 2026 16:21:23 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":825,"size_decoded":1165,"mime_type":"image/png","magic":"ASCII text, with very long lines (1102), with no line terminators","md5":"da3176728d6298a6316dadc5d0b68476","sha1":"e03722738a3d67e556a6ae0631d5f38f263b3eef","sha256":"fdc2c04cfc46f1bd63450f02975a141660a35f1007efbddba583e19b1c71060e","sha512":"2f84e9c702e0e4eec8e0bd0e49bc41481e4b8dd79088c3a281c55868b8f4fd7c113c3f7f2b329719c651aa39e375fb7125feea02cadf6145178e2144b2f9f041","ssdeep":"","tlshash":"a51182324ec0e09b0265c990301bd6502d43d7e9020e7a2d3386c0a66dfe588bdefb54","first_seen":"2026-06-07T16:22:02.190266Z","last_seen":"2026-06-07T16:22:02.190266Z","times_seen":1,"resource_available":false,"data":null}},"time_used":255,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":255,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/float/shoucang.png","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:23.226Z","timestamp":1780849283226,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /static/float/shoucang.png HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:23 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69e113e6-95c\"\r\nexpires: Tue, 07 Jul 2026 16:21:23 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2396,"size_decoded":2770,"mime_type":"image/png","magic":"ASCII text, with very long lines (3198), with no line terminators","md5":"d3e6bf7a18be9abdf114e45120b57e4b","sha1":"8d9656e63af4cb8b6ef2674fa01038610ca1fdd3","sha256":"f851b12144c33594edc2b7c55eb5a974298781604ba8bd2701e6e99acc4318fe","sha512":"c0b7098ad49eb0e59244b84e0688e7bedc42bdccb450fa69a0647d04fc64d55f6fcdf4cc4e64728c8682cf9353495fd8b6236af64f1cd968c305eb3739991029","ssdeep":"","tlshash":"d3612cb0c1a12e7987a8db8ba1f051543fc96cac0b78b1e71b8c531d58771e3441a148","first_seen":"2026-06-07T16:22:02.192864Z","last_seen":"2026-06-07T16:22:02.192864Z","times_seen":1,"resource_available":false,"data":null}},"time_used":255,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":255,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/theme/default/chat/defaultpage_nomessages.png","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:23.222Z","timestamp":1780849283222,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /static/theme/default/chat/defaultpage_nomessages.png HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:23 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69e113e6-392d\"\r\nexpires: Tue, 07 Jul 2026 16:21:23 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14637,"size_decoded":14833,"mime_type":"image/png","magic":"ASCII text, with very long lines (19516), with no line terminators","md5":"a7b6807110678b93afad71e3840b22d3","sha1":"d27ac6c5109573c811f703a0fc2fc650ad7c060b","sha256":"a892d1837e1a90cfdf4c2d112b4dcd928d7490bd86c3f53219ebc170118004a5","sha512":"e4c4f6ebb5c70c68ebcd61ca00c2dbc878a5e4f339db5ddb037b283834c7d19b5451acc553c435a758eb2a7dcd14ebbf93335c48f464242e95afa6f75365daa9","ssdeep":"384:uXLU0NwjhNMTKPo9HSbgQF1EykEq3GLMXr61tG5m4BW55uq8:uXrwE5NQFSy1Lc23ymSr","tlshash":"0792e13199cc2d6f80614a373f0417956f0d7c4f0a6a3d81fedaeec8d8757b16aa052a","first_seen":"2026-06-07T16:22:02.195484Z","last_seen":"2026-06-07T16:22:02.195484Z","times_seen":1,"resource_available":false,"data":null}},"time_used":256,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.mescroll.com/img/mescroll-totop.png","fqdn":"www.mescroll.com","domain":"mescroll.com","tld":"com"},"ip":{"addr":"185.199.110.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:23.223Z","timestamp":1780849283223,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.mescroll.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Apr 2026 04:37:55 GMT","end":"Thu, 16 Jul 2026 04:37:54 GMT"},"fingerprint":{"sha1":"0B:CC:1C:A5:6D:F2:86:47:7D:BC:29:11:7F:33:6B:C9:CC:05:57:7F","sha256":"AC:4B:84:A6:40:61:26:35:8A:41:83:58:2C:41:B5:27:E7:08:25:63:F4:E9:56:24:C6:AE:F9:55:D3:66:38:E6"}}},"request":{"raw":"GET /img/mescroll-totop.png HTTP/1.1\r\nHost: www.mescroll.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: GitHub.com\r\ncontent-type: image/png\r\nx-origin-cache: HIT\r\nlast-modified: Mon, 30 Dec 2024 01:21:49 GMT\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31556952\r\netag: \"6771f5ad-120\"\r\nexpires: Tue, 02 Jun 2026 02:25:23 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: MISS\r\nx-github-request-id: 308E:1F1374:5319C3:5C7675:6A1E3CBA\r\naccept-ranges: bytes\r\ndate: Sun, 07 Jun 2026 16:21:23 GMT\r\nvia: 1.1 varnish\r\nage: 179\r\nx-served-by: cache-bma-essb1270055-BMA\r\nx-cache: HIT\r\nx-cache-hits: 1\r\nx-timer: S1780849284.830367,VS0,VE2\r\nvary: Accept-Encoding\r\nx-fastly-request-id: a490843649b423fb4df28f3cb4887c06424ea1f3\r\ncontent-length: 288\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"GitHub Pages","description":"GitHub Pages is a static site hosting service.","website":"https://pages.github.com/","common_platform_enumeration":"","icon":"GitHub.svg","categories":["PaaS"]},{"name":"Fastly","description":"Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video \u0026 streaming services.","website":"https://www.fastly.com","common_platform_enumeration":"","icon":"Fastly.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":288,"size_decoded":982,"mime_type":"image/png","magic":"ASCII text, with very long lines (386), with no line terminators","md5":"1820b58fab03687a9b1e19eeec6ea3c9","sha1":"f0d2ee1048ad8999f91bf70f7ac4056f9dba4553","sha256":"b1249bd1e1723f1751a9c35f8387ec2e9862ab6d398d6cc1b31a691bddb0026b","sha512":"4527eeb8c4364195e1f0d72d50335d1f05a3705c74b54d01bc61f9ff11307032265514e7dd948d9263b909ade543d4a48f2fc9ddd6d772716d538e2cacd3221d","ssdeep":"","tlshash":"65e06a7d0cd2749510510dcd5105aff71d2157c800b327832d9cbd1ac81e1de4e94143","first_seen":"2026-06-07T16:22:02.197956Z","last_seen":"2026-06-07T16:22:02.197956Z","times_seen":1,"resource_available":false,"data":null}},"time_used":614,"timings":{"blocked":-1,"dns":574,"connect":9,"send":0,"wait":13,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/float/tianjiahaoyou.png","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:23.224Z","timestamp":1780849283224,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /static/float/tianjiahaoyou.png HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 585\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\netag: \"69e113e6-249\"\r\nexpires: Tue, 07 Jul 2026 16:21:23 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":585,"size_decoded":925,"mime_type":"image/png","magic":"ASCII text, with very long lines (782), with no line terminators","md5":"32f46003576845cca7722fe075a78b07","sha1":"93e535f145c2dc77dcff3e8ebfc31ff1a6eca2b4","sha256":"2de5509e9f6f0074ac688830f7c6be253f055ad3cfca8fe1337ba700dabc3c51","sha512":"266bb3334fa869b89de180074005306e4d423e62c20b8121b8fe9119d475e384468460fb9e59835d861c5e2a81ebdfda59deb9995827c23f6802b6fe8f36fa70","ssdeep":"","tlshash":"ba01f175349bd58e16520cc8b15542463c13db2825995b3cba85fa1acfaf162ab87348","first_seen":"2026-06-07T16:22:02.200132Z","last_seen":"2026-06-07T16:22:02.200132Z","times_seen":1,"resource_available":false,"data":null}},"time_used":255,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":255,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/js/pages-chat-index~pages-scan-scan.ba60e78b.js","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:22.675Z","timestamp":1780849282675,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /static/js/pages-chat-index~pages-scan-scan.ba60e78b.js HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:22 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69e113e6-6f153\"\r\nexpires: Mon, 08 Jun 2026 04:21:22 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":454995,"size_decoded":128719,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"aed5f7aa1ed47e85e6c87782030152d6","sha1":"9dfd93e1ec82528b61bad41ab7fd8a94f059a7dd","sha256":"b1da26b2b043249a27596375541a5d130674f472aefcb705006ca864ebb37696","sha512":"5669d73ae3d2a21300f2e794d1a3e33514ddf0372bc1cf9d4c8599f204b66be22a3716baa42d2eae355f0a83aa1fa29505a5bb3018d24f72997a70d0931a11e8","ssdeep":"12288:dhkpYxNZki7JuknGmZHiiQJWI4YIYWyAW:dhkykitriiOWI4YIYWlW","tlshash":"3ea41b9472d370a0979371a8046f2009b1bb2878588dc068ff35ded7ada9d8b6677f34","first_seen":"2026-06-07T16:22:02.202849Z","last_seen":"2026-06-07T16:22:02.202849Z","times_seen":1,"resource_available":true,"data":null}},"time_used":258,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":258,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/theme/default/tabBar/2.png","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:22.700Z","timestamp":1780849282700,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /static/theme/default/tabBar/2.png HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:22 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69e113e6-6e2\"\r\nexpires: Tue, 07 Jul 2026 16:21:22 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1762,"size_decoded":2136,"mime_type":"image/png","magic":"ASCII text, with very long lines (2354), with no line terminators","md5":"13466c53a0d6b6acc03de06fed4f5430","sha1":"1998261111b64c9ac3c6267886d4c61d390b64d5","sha256":"dfcc984ce47678708b74e63cf5323b6f9d7e5c7ca2f424cba7766ba91b31c175","sha512":"e03ed1659cba99d96bb6653b86c7f834e00b0a8053a39e0c4a93230c2430ae52d69f23d3d76bd05146e72baa74b65d9e13344daea59861542fcd9b44000fe724","ssdeep":"","tlshash":"a2411b736619064e205273873826fd743f8979681c35e0b6adda7ef8dcb42c10da1145","first_seen":"2026-06-07T16:22:02.205179Z","last_seen":"2026-06-07T16:22:02.205179Z","times_seen":1,"resource_available":false,"data":null}},"time_used":255,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":255,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"at.alicdn.com/t/font_989023_efq0mtli526.ttf","fqdn":"at.alicdn.com","domain":"alicdn.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:23.217Z","timestamp":1780849283217,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /t/font_989023_efq0mtli526.ttf HTTP/1.1\r\nHost: at.alicdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://tronsave.vip\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T06:49:09.656184Z","times_seen":17795041,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/js/pages-in-login.fddd4177.js","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:24.090Z","timestamp":1780849284090,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /static/js/pages-in-login.fddd4177.js HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:24 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69e113e6-368e\"\r\nexpires: Mon, 08 Jun 2026 04:21:24 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13966,"size_decoded":4823,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (13162), with no line terminators","md5":"be87f41f93218f54c4d013ed943bf3a7","sha1":"1054f2f598d2498af6314812c409bbc51d454d73","sha256":"b3088dbee89155629b51d9d662463fa1cf88a1b2c37884dfd5246a43c6ccce81","sha512":"1eb721a8b6f234eeed778f59aa2de7acea926058336a1dee5dc6e8513014decb457297275926baf6e931063b2f4cee78a7a62b2158b651514e77f8fff40cbd6f","ssdeep":"192:9aWJ2eFcLeIaedgGgSwwTwAw+5w8CfwVH10upVHeOqRsPx7c2C6zTt8pIMsOM9kC:h39IzdzaOrLJAEJaI","tlshash":"57520a21f18db96e9d97c0d4d0a71364d13a5fbaa000ad48eb72fed80ed698716327dc","first_seen":"2026-06-07T16:22:02.20868Z","last_seen":"2026-06-07T16:22:02.20868Z","times_seen":1,"resource_available":false,"data":null}},"time_used":256,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-07T16:21:19.661Z","timestamp":1780849279661,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:20 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69e113e6-311\"\r\nset-cookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf; Max-Age=86400; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":785,"size_decoded":857,"mime_type":"text/html","magic":"JavaScript source, ASCII text, with very long lines (794), with no line terminators","md5":"f3593b50269e08f9938cc016efdf6a7d","sha1":"5b521fa36bfbe3753692099cbb296eb12040d9bc","sha256":"7f75abe0b1d9da61343c97168635682ede45fbc8f630509b6e0f1cf899369b93","sha512":"6f0213f243e2572eb9d2b64964ecf47444c6d4b1f54618a0b2854003119661bd491937a3af3b3b8907779044ae0828c113b1f46abaaf6acca13b52fc73155bf6","ssdeep":"","tlshash":"4a01cec71c51e04d1710855131bae51e89674df5ada1dd503cdc3aeccbd0b8ade1e810","first_seen":"2026-06-07T16:22:02.210955Z","last_seen":"2026-06-07T16:22:02.210955Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1280,"timings":{"blocked":-1,"dns":255,"connect":255,"send":0,"wait":256,"receive":0,"ssl":514},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/js/pages-chat-index.7e1c85be.js","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:22.680Z","timestamp":1780849282680,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /static/js/pages-chat-index.7e1c85be.js HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:22 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69e113e6-2b246\"\r\nexpires: Mon, 08 Jun 2026 04:21:22 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":176710,"size_decoded":36691,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64612), with no line terminators","md5":"74d638e0d59e3d93c287d22f494e5844","sha1":"ccf199d12dffc4f0ac0ec9ad8779ca27e3a7e0e7","sha256":"e6dd00d25445de5b02a9291f85cf782ab80299644d8c6f18aaef471f791d00e8","sha512":"dead8d75a05c79dd3581c8d62902ca10e5b1d5957243051bf8da7e20b0d208334da6d67bfe73e10d8cdb3d4a895298aaffbee57e3de99f9e4c0de593103cd209","ssdeep":"3072:dwSvpLWmRghNrcrdeBbmcKzDtA+exfBRp2FymV63nNrbBg:iUghNrcrdeBbmcKzDtA+exfBRp2FlONG","tlshash":"d604c6597441219d42736aa282de0a484739a72710712cfd73519ccf8f6bbdf33aab27","first_seen":"2026-06-07T16:22:02.212914Z","last_seen":"2026-06-07T16:22:02.212914Z","times_seen":1,"resource_available":true,"data":null}},"time_used":267,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":267,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/favicon.ico","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:22.965Z","timestamp":1780849282965,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:23 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":279,"mime_type":"text/html","magic":"HTML document, ASCII text, with no line terminators","md5":"095063eb4b95af0ce60c74c3c7db526b","sha1":"0a1c57168160f0a9f4eb645a2ec67134b2de8ca7","sha256":"5ca529e43d30d4687978195b5961c17df1c1fdb695bb696c915f2c30a93875fe","sha512":"f813c5b3a586ab4b7e1a455c7123b7dda69e8ded5fddee1872273bc3085f01bad900c468e300214bc95ab50e8906641955c29148299ec4f0f65d3adaae08595a","ssdeep":"","tlshash":"8cc08c1cb813308485030ba00bc33542c29aa22ba8ba802104884203e0ce2bac8ea3d5","first_seen":"2026-05-25T18:26:35.33239Z","last_seen":"2026-06-07T19:26:14.981182Z","times_seen":354,"resource_available":false,"data":null}},"time_used":256,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.dcloud.net.cn/img/shadow-grey.png","fqdn":"cdn.dcloud.net.cn","domain":"dcloud.net.cn","tld":"net.cn"},"ip":{"addr":"106.54.228.253","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:24.719Z","timestamp":1780849284719,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dcloud.net.cn","organization":""},"issuer":{"commonName":"Certum Domain Validation CA SHA2","organization":"Unizeto Technologies S.A."},"validity":{"start":"Tue, 26 Aug 2025 11:47:17 GMT","end":"Fri, 25 Sep 2026 11:47:16 GMT"},"fingerprint":{"sha1":"47:A7:6C:09:6B:1D:CA:2D:7D:39:2E:C1:7F:15:DE:5D:F2:C4:0F:77","sha256":"EA:73:37:83:D0:38:44:D9:3C:0B:26:F0:DD:D1:22:2F:36:F7:F2:86:A1:B0:58:52:DE:4E:0A:21:D6:89:E7:3E"}}},"request":{"raw":"GET /img/shadow-grey.png HTTP/1.1\r\nHost: cdn.dcloud.net.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:26 GMT\r\ncontent-type: image/png\r\ncontent-length: 136\r\nlast-modified: Thu, 06 Jun 2019 06:42:07 GMT\r\netag: \"5cf8b5bf-88\"\r\nexpires: Sun, 07 Jun 2026 16:51:26 GMT\r\ncache-control: max-age=1800\r\nset-cookie: __uni__uid=rBEQg2olmoZ3HNpkA2GRAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136,"size_decoded":576,"mime_type":"image/png","magic":"ASCII text, with no line terminators","md5":"81d74976bd1b29c4bebe8b9f95af9535","sha1":"58d60dc1219f10aee72d4181420d5afd4483c514","sha256":"68b9e97640da06298f886cc65a9575e0cabed9ec61824c5c388e883c69a42870","sha512":"9f43b6f659764a25285b7a8b24aef955cf45a1153d6bf4c869c549e57ae2a097d4450e9b8e06c98bd93494e2f2148247174b4fe71388dce139e9bc16be334244","ssdeep":"","tlshash":"aec080b345035d5e155624045921f8020d42af57976854153fcc017715fd1708f4d667","first_seen":"2026-05-25T19:25:32.616826Z","last_seen":"2026-06-07T17:30:19.809667Z","times_seen":14,"resource_available":false,"data":null}},"time_used":1708,"timings":{"blocked":0,"dns":3,"connect":233,"send":0,"wait":233,"receive":0,"ssl":1239},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/js/pages-chat-index~pages-chat-message~pages-details-index~pages-friend-index~pages-my-details~pages-my-index.a0b67159.js","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:22.673Z","timestamp":1780849282673,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /static/js/pages-chat-index~pages-chat-message~pages-details-index~pages-friend-index~pages-my-details~pages-my-index.a0b67159.js HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:22 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69e113e6-2a22\"\r\nexpires: Mon, 08 Jun 2026 04:21:22 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10786,"size_decoded":4699,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (8295)","md5":"3362053427a6d58a2eb0f3be494d6b34","sha1":"da49dbb12a673f8b5827203f98776e90490772a2","sha256":"b743ca1c62d83d2c8159a4c7562d678bfb35e5fd255e8fb38bfcd9d358d50e33","sha512":"c669991f2477134722d6688c1a4b02372c2932d5de20509403aa875bc2043c271e3276aa6ac4897d1292a06af980c066162f48884de502be3ee96076220db654","ssdeep":"192:+KhFWZzcmZm++myppikKDrBEqnjqMPIsiqi44vDz/9GLqRsOz:+KaZgmZ9SiPfWhg8txvDZBf","tlshash":"bf2295dc72c7f46902932620941f200ae23f2d9de909d095e765d9e3fcb454e922bf78","first_seen":"2026-06-07T16:22:02.216594Z","last_seen":"2026-06-07T16:22:02.216594Z","times_seen":1,"resource_available":true,"data":null}},"time_used":256,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"chat.tronsave.it.com/App/config","fqdn":"chat.tronsave.it.com","domain":"tronsave.it.com","tld":"it.com"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:23.209Z","timestamp":1780849283209,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chat.tronsave.it.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Fri, 10 Apr 2026 15:00:00 GMT","end":"Thu, 09 Jul 2026 14:59:59 GMT"},"fingerprint":{"sha1":"43:0E:94:5C:5F:18:D3:A3:87:F9:60:D8:EA:BB:5A:C0:6B:71:E3:39","sha256":"FB:9C:F7:FB:62:3D:55:87:F8:15:BC:20:0C:60:0E:F1:DF:D1:5A:FB:EB:F0:8E:67:4D:2C:FA:9E:66:B0:C7:8A"}}},"request":{"raw":"POST /App/config HTTP/1.1\r\nHost: chat.tronsave.it.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 19\r\nOrigin: https://tronsave.vip\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:23 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: Origin, No-Cache, X-Requested-With, If-Modified-Since, Pragma, Last-Modified, Cache-Control, Expires, Content-Type, X-E4M-With\r\nset-cookie: server_name_session=f72c2ac0cf85b3d0d3995a403b828010; Max-Age=86400; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":901,"size_decoded":1083,"mime_type":"application/json; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (987), with no line terminators","md5":"c8724bdc10ef74eed5b124e1d68e6a34","sha1":"362fff1518317e4d416ce134fb20d8cc38deb9b9","sha256":"684e5fe4c8c217c0e7b2ab6b092c45f85c2fa634d2d0ac08024b2eccd72409b8","sha512":"c8ec8aa19c26a4b74a6a876bd319a9310510f7cb852db462e005b179ff8436eba77a140d94a8643736db9fe7db2f98006533f736f531d1a632a980df99572d45","ssdeep":"","tlshash":"cf115787508bdd92f8c0ed8e0df96d37608c95b9c19e64001378ed84c1ce53165b69a2","first_seen":"2026-06-07T16:22:02.218409Z","last_seen":"2026-06-07T16:22:02.218409Z","times_seen":1,"resource_available":false,"data":null}},"time_used":840,"timings":{"blocked":-1,"dns":27,"connect":269,"send":0,"wait":271,"receive":0,"ssl":273},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chat.tronsave.it.com/get/chatList","fqdn":"chat.tronsave.it.com","domain":"tronsave.it.com","tld":"it.com"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:23.215Z","timestamp":1780849283215,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chat.tronsave.it.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Fri, 10 Apr 2026 15:00:00 GMT","end":"Thu, 09 Jul 2026 14:59:59 GMT"},"fingerprint":{"sha1":"43:0E:94:5C:5F:18:D3:A3:87:F9:60:D8:EA:BB:5A:C0:6B:71:E3:39","sha256":"FB:9C:F7:FB:62:3D:55:87:F8:15:BC:20:0C:60:0E:F1:DF:D1:5A:FB:EB:F0:8E:67:4D:2C:FA:9E:66:B0:C7:8A"}}},"request":{"raw":"POST /get/chatList HTTP/1.1\r\nHost: chat.tronsave.it.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 19\r\nOrigin: https://tronsave.vip\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:23 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: Origin, No-Cache, X-Requested-With, If-Modified-Since, Pragma, Last-Modified, Cache-Control, Expires, Content-Type, X-E4M-With\r\nset-cookie: server_name_session=f72c2ac0cf85b3d0d3995a403b828010; Max-Age=86400; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":32,"size_decoded":622,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"ef751a7bfc004540126cfff72a2f3a83","sha1":"ca2ec24f2df873973a71f55ba28776f541fd8d5b","sha256":"830577fab2f92d482beb253e1d7e7434f98c9bb012fdf52186403e1b8aeed8d8","sha512":"3a6fac80c581572dd9af27a47a853654988bcba4c10ddbc09bd9ba7078c3d10de26c1766a9e2832053512cb124ac19c9ed0d7b7e589f57cab587e5b6b8b45ea0","ssdeep":"","tlshash":"599004510044d0d1c57015c440f4d5030f07015034353714070dd4cccc010101c3341d","first_seen":"2026-06-07T16:22:02.220087Z","last_seen":"2026-06-07T16:22:02.220087Z","times_seen":1,"resource_available":false,"data":null}},"time_used":822,"timings":{"blocked":-1,"dns":22,"connect":261,"send":0,"wait":274,"receive":0,"ssl":265},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chat.tronsave.it.com/get/getUserInfo","fqdn":"chat.tronsave.it.com","domain":"tronsave.it.com","tld":"it.com"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:23.216Z","timestamp":1780849283216,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chat.tronsave.it.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Fri, 10 Apr 2026 15:00:00 GMT","end":"Thu, 09 Jul 2026 14:59:59 GMT"},"fingerprint":{"sha1":"43:0E:94:5C:5F:18:D3:A3:87:F9:60:D8:EA:BB:5A:C0:6B:71:E3:39","sha256":"FB:9C:F7:FB:62:3D:55:87:F8:15:BC:20:0C:60:0E:F1:DF:D1:5A:FB:EB:F0:8E:67:4D:2C:FA:9E:66:B0:C7:8A"}}},"request":{"raw":"POST /get/getUserInfo HTTP/1.1\r\nHost: chat.tronsave.it.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 19\r\nOrigin: https://tronsave.vip\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:23 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: Origin, No-Cache, X-Requested-With, If-Modified-Since, Pragma, Last-Modified, Cache-Control, Expires, Content-Type, X-E4M-With\r\nset-cookie: server_name_session=f72c2ac0cf85b3d0d3995a403b828010; Max-Age=86400; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32,"size_decoded":622,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"ef751a7bfc004540126cfff72a2f3a83","sha1":"ca2ec24f2df873973a71f55ba28776f541fd8d5b","sha256":"830577fab2f92d482beb253e1d7e7434f98c9bb012fdf52186403e1b8aeed8d8","sha512":"3a6fac80c581572dd9af27a47a853654988bcba4c10ddbc09bd9ba7078c3d10de26c1766a9e2832053512cb124ac19c9ed0d7b7e589f57cab587e5b6b8b45ea0","ssdeep":"","tlshash":"599004510044d0d1c57015c440f4d5030f07015034353714070dd4cccc010101c3341d","first_seen":"2026-06-07T16:22:02.220087Z","last_seen":"2026-06-07T16:22:02.220087Z","times_seen":1,"resource_available":false,"data":null}},"time_used":823,"timings":{"blocked":-1,"dns":21,"connect":259,"send":0,"wait":276,"receive":0,"ssl":266},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/js/chunk-vendors.b0bc56f8.js","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:21.173Z","timestamp":1780849281173,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /static/js/chunk-vendors.b0bc56f8.js HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:21 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69e113e6-c6c62\"\r\nexpires: Mon, 08 Jun 2026 04:21:21 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":814178,"size_decoded":250667,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65531), with no line terminators","md5":"8160e979f9a1356fb3438464bdbddbc8","sha1":"a7209d76276f66b415c3d86daad3819979e79675","sha256":"8bfaa3800bb7821dc37ec686055bc55d96f502c1aaaab8dcbd125193f1cb71f1","sha512":"65e5ed00650516d9d6af72cc778288b15b6d52c7b96978d7514e626db5f6994b3192365c5e185c3f08bbf1e39e3ae704cd140d844a34e92ec150b5a417262aea","ssdeep":"6144:0yi1bPFxYYlIAIXtwTf3Oyb/+xNvMNTKrbsvmRnO+Qhlxv3z8UHjBCfF:0HZv3IdwTfAxVMtyPOJv3zLj2","tlshash":"5a05f78df282b0b60be760b5403f220bb2376959b40a84d4f675e4d4ad7894e6237f7d","first_seen":"2026-06-07T16:22:02.221743Z","last_seen":"2026-06-07T16:22:02.221743Z","times_seen":1,"resource_available":true,"data":null}},"time_used":768,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":768,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/js/pages-chat-index~pages-my-trans_index.c501f2fc.js","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:22.679Z","timestamp":1780849282679,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /static/js/pages-chat-index~pages-my-trans_index.c501f2fc.js HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:22 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69e113e6-513e\"\r\nexpires: Mon, 08 Jun 2026 04:21:22 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20798,"size_decoded":5879,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (19284), with no line terminators","md5":"1a0c1973d6ffa28c593d140b87a85929","sha1":"b7f91f9fbd54d525ec4725a4cbb24f3064ed9297","sha256":"5ff5d1f9c24570d7b416b6ca7f85a2b9e7a7d33866ab19372bc210cbf73a044b","sha512":"79948c49b8407f69bfa16dd0ccd75fa1dca928b41eb2c5f792341c2ce82ce3da904acd03c38b898e7a36bbf93b93a31d6b320471a84e443c533dc758b31c648c","ssdeep":"192:Qw0wqRsmYt8lpBN5U8K0/Mbtx+tPMHzZ9qRsE4MzqwdTjQ2Rfn8yy1eH0yXN+9TJ:TYC2FU8F/Mf9dshwwd/BRfuehFl6","tlshash":"4b920a44b0c6b45a06835168017ba209a0377db9a415a4d1f7f4fafa8ef4a9f1337f6c","first_seen":"2026-06-07T16:22:02.223378Z","last_seen":"2026-06-07T16:22:02.223378Z","times_seen":1,"resource_available":true,"data":null}},"time_used":265,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":265,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/float/popmenu_icon_groupchat.png","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:23.227Z","timestamp":1780849283227,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /static/float/popmenu_icon_groupchat.png HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 723\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\netag: \"69e113e6-2d3\"\r\nexpires: Tue, 07 Jul 2026 16:21:23 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":723,"size_decoded":1063,"mime_type":"image/png","magic":"ASCII text, with very long lines (966), with no line terminators","md5":"1672e09103aa446423c80fbd7dab0c5d","sha1":"50cdd08f731c49c612dfce9d747fd7f370f1ab89","sha256":"ef33c4e8df8c26584fc58f4449bad57ad5a1f9cfd5bcda9b084d0b4007ab3422","sha512":"25a87f20520bb0ac016eb2aa7eb00c52cb08a6de4e6342ae9918262e0cd82c512ca172af4138ebd59b944d217afa77ed22b99a7705bed90b73a92b9f9a1fc715","ssdeep":"","tlshash":"4d119469abe0f26d195710b3307fa2954c6beb99e4810d2d360594822d6c200aee7f4c","first_seen":"2026-06-07T16:22:02.225104Z","last_seen":"2026-06-07T16:22:02.225104Z","times_seen":1,"resource_available":false,"data":null}},"time_used":255,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":255,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/js/index.bb6d7664.js","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:21.175Z","timestamp":1780849281175,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /static/js/index.bb6d7664.js HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:21 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69e113e6-434c7\"\r\nexpires: Mon, 08 Jun 2026 04:21:21 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":275655,"size_decoded":64050,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64652), with no line terminators","md5":"54c740eb5564b954d35d17028317e41d","sha1":"67e6f45d0673ddd16dba7d7444ed7e6c392659d3","sha256":"4dec3996d6724cdb594ae8e0458d322e119ced42820c3ae8e993ec771c9a14a2","sha512":"8fcd1b7f98b098a64bec6cb9df35af71e4db915c1a4b498c47f89ca8a1efdfea4bc91b1e7f3fa34a850065175e171ea755c28ed895507a8b3e2fdda0d5bc2b48","ssdeep":"3072:OiicC5093eHIjBcL6kvVDZ3fULYHikxXxxlNPsoKkNvO54mQUNHJ:OcA09zcHviYHik5xV9KG+w0HJ","tlshash":"bf4409ba708aeb9d15ab7067781fb20325353c924c8db051e3b9e5e49f9e14a9733f04","first_seen":"2026-06-07T16:22:02.226771Z","last_seen":"2026-06-07T16:22:02.226771Z","times_seen":1,"resource_available":true,"data":null}},"time_used":766,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":766,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/login/close.png","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:24.369Z","timestamp":1780849284369,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /static/login/close.png HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:24 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69e113e6-1807\"\r\nexpires: Tue, 07 Jul 2026 16:21:24 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6151,"size_decoded":5973,"mime_type":"image/png","magic":"ASCII text, with very long lines (8206), with no line terminators","md5":"4955fe6d58eabbef4d0c3c23ab04366c","sha1":"642a4b5fe792258e2ad2c2d726e4051fc7374b70","sha256":"f65dd0d2e7bbcbea990d9914dd93862c12abe5bae68243d56fdcfd1a44ffc9ba","sha512":"2d9a865abe663705107291cca72f68c8c8c61fff43cc7b80dfc8a75892ab5fa1dc25b239fbab457b8bc05f79255d2b0b4716c401652b6cd60b180f38712c3655","ssdeep":"192:DHiO0iO0igGtm/RX/cDksGfsWSYzZWr6jy45aWNZrytYnB+g:NErMx/+ksGf3nzZe6jy45vNpyMB+g","tlshash":"1c029ee304905f15099ba1c4701ca90819bdfeb282f0e69fdbe977b316f947adc27841","first_seen":"2026-06-07T16:22:02.228457Z","last_seen":"2026-06-07T16:22:02.228457Z","times_seen":1,"resource_available":false,"data":null}},"time_used":256,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/float/saoyisao.png","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:23.228Z","timestamp":1780849283228,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /static/float/saoyisao.png HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 433\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\netag: \"69e113e6-1b1\"\r\nexpires: Tue, 07 Jul 2026 16:21:23 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":433,"size_decoded":773,"mime_type":"image/png","magic":"ASCII text, with very long lines (582), with no line terminators","md5":"2132729b39f48de00f3094553f092967","sha1":"af366526dc780bc5d443f26c2b1e8afcf475d2e3","sha256":"30658d4ab3a852ce26404d6a193c999c3b674c285a1a9e0bf87afd091f9f9677","sha512":"bda146676d488fde976229e8adebf22cd1d7191cb56c29c48a3c9745d3593d9a40e6f12889bf4c3d33fd5ad5acff2dc292b4d24d3f07b925f37e1c0d98ade434","ssdeep":"","tlshash":"65f0e1b348ce9b7542b32424b55e20055d37c79116482c5d35848b0f7ead499f9eb754","first_seen":"2026-06-07T16:22:02.230019Z","last_seen":"2026-06-07T16:22:02.230019Z","times_seen":1,"resource_available":false,"data":null}},"time_used":255,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":255,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"chat.tronsave.it.com/App/config","fqdn":"chat.tronsave.it.com","domain":"tronsave.it.com","tld":"it.com"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:24.359Z","timestamp":1780849284359,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chat.tronsave.it.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Fri, 10 Apr 2026 15:00:00 GMT","end":"Thu, 09 Jul 2026 14:59:59 GMT"},"fingerprint":{"sha1":"43:0E:94:5C:5F:18:D3:A3:87:F9:60:D8:EA:BB:5A:C0:6B:71:E3:39","sha256":"FB:9C:F7:FB:62:3D:55:87:F8:15:BC:20:0C:60:0E:F1:DF:D1:5A:FB:EB:F0:8E:67:4D:2C:FA:9E:66:B0:C7:8A"}}},"request":{"raw":"POST /App/config HTTP/1.1\r\nHost: chat.tronsave.it.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 19\r\nOrigin: https://tronsave.vip\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:24 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: Origin, No-Cache, X-Requested-With, If-Modified-Since, Pragma, Last-Modified, Cache-Control, Expires, Content-Type, X-E4M-With\r\nset-cookie: server_name_session=f72c2ac0cf85b3d0d3995a403b828010; Max-Age=86400; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":901,"size_decoded":1083,"mime_type":"application/json; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (987), with no line terminators","md5":"c8724bdc10ef74eed5b124e1d68e6a34","sha1":"362fff1518317e4d416ce134fb20d8cc38deb9b9","sha256":"684e5fe4c8c217c0e7b2ab6b092c45f85c2fa634d2d0ac08024b2eccd72409b8","sha512":"c8ec8aa19c26a4b74a6a876bd319a9310510f7cb852db462e005b179ff8436eba77a140d94a8643736db9fe7db2f98006533f736f531d1a632a980df99572d45","ssdeep":"","tlshash":"cf115787508bdd92f8c0ed8e0df96d37608c95b9c19e64001378ed84c1ce53165b69a2","first_seen":"2026-06-07T16:22:02.218409Z","last_seen":"2026-06-07T16:22:02.218409Z","times_seen":1,"resource_available":false,"data":null}},"time_used":271,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":271,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/index.cc298949.css","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:21.172Z","timestamp":1780849281172,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /static/index.cc298949.css HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:21 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69e113e6-17998\"\r\nexpires: Mon, 08 Jun 2026 04:21:21 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":96664,"size_decoded":26860,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"b23ffbdf507ee417fc3c7b7b242737a7","sha1":"eba2371178176221506aff0dc474570e47562e55","sha256":"97fafefc6bb45ed52a6930fd2fa079e13da77929f11bc7b813d5f09c85ff0f36","sha512":"c5bcad9b474333689093a848601b2871dcd50e04fbd2592ebee0053bed1c540a95f371e84db5bd34f641345bff4cfdf3938a9266b3280243f95fa7cafd6e4519","ssdeep":"1536:qlIApuK7hmVmU2RS1Wu3xdynGJ7eh/nQhlvbc:hApuK7hmV+S1Wu3iG41nQPI","tlshash":"b993f73719012e39e52bcd26b6c1ab5a1e61c033e15307adfba47628cbcf9c9167b345","first_seen":"2026-03-22T00:30:56.219993Z","last_seen":"2026-08-09T03:22:31.84727Z","times_seen":492,"resource_available":false,"data":null}},"time_used":513,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":513,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/theme/default/tabBar/1_s.png","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:22.698Z","timestamp":1780849282698,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /static/theme/default/tabBar/1_s.png HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:22 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69e113e6-556\"\r\nexpires: Tue, 07 Jul 2026 16:21:22 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1366,"size_decoded":1740,"mime_type":"image/png","magic":"ASCII text, with very long lines (1826), with no line terminators","md5":"0c759844a53fb87454b3ea39073551af","sha1":"480bd5bcd19afe282356b9250f09acf6be670b09","sha256":"bb62069aa14f74632e0820084e8175ecbe42ee21a2e8f84fc52450e361cb3ad2","sha512":"7b4680d1f2011230d69ac1faeb116ddf624bb468c90e891871a7af6111ff16e3135baea41e1e4d2cac045fefa137a3312b99edf986aed030df312471c8832f88","ssdeep":"","tlshash":"82310914d400bf8f8a099a89e527df538b64b99bf4fe72d23b7442b15a6c3229f34045","first_seen":"2026-06-07T16:22:02.232201Z","last_seen":"2026-06-07T16:22:02.232201Z","times_seen":1,"resource_available":false,"data":null}},"time_used":256,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/theme/default/tabBar/3.png","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:22.702Z","timestamp":1780849282702,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /static/theme/default/tabBar/3.png HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:22 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69e113e6-af2\"\r\nexpires: Tue, 07 Jul 2026 16:21:22 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2802,"size_decoded":3176,"mime_type":"image/png","magic":"ASCII text, with very long lines (3738), with no line terminators","md5":"651d17d6151754ea97eeeddefece21eb","sha1":"8ff8c531510e527742fbc12cc7b0272066e5c800","sha256":"3d1f20a0b4bf1b8dc9a2bfeac78ec717160167ceb432198c0447c3fc83d16d97","sha512":"e00abad626ca6dca6aea90f96b8d847e1fe7300f65ffb77533789076d99303cbba7e0cb18d9c57886fec577820241851b201909b1e08521638d6146d8d629880","ssdeep":"","tlshash":"bf716c75b2f9d089c686c3a2028c4700ceabc57b219c2a9f1586bf13ab52be14f4c15e","first_seen":"2026-06-07T16:22:02.23356Z","last_seen":"2026-06-07T16:22:02.23356Z","times_seen":1,"resource_available":false,"data":null}},"time_used":256,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tronsave.vip/static/theme/default/tabBar/4.png","fqdn":"tronsave.vip","domain":"tronsave.vip","tld":"vip"},"ip":{"addr":"119.28.3.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:22.704Z","timestamp":1780849282704,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tronsave.vip","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 16 Apr 2026 05:00:00 GMT","end":"Wed, 15 Jul 2026 04:59:59 GMT"},"fingerprint":{"sha1":"88:26:48:94:DD:B9:09:E9:EA:30:3C:CA:FF:BC:4A:D5:7F:2B:B4:CC","sha256":"9D:7D:D5:62:08:8A:AF:03:E4:61:60:C1:CE:A5:D1:C5:E9:B6:6B:81:8A:22:24:38:64:E2:B0:BC:B1:A4:83:5C"}}},"request":{"raw":"GET /static/theme/default/tabBar/4.png HTTP/1.1\r\nHost: tronsave.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nCookie: server_name_session=673472e73f9ee6c7b0552c31733b1fdf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 07 Jun 2026 16:21:22 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 16 Apr 2026 16:52:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69e113e6-6ab\"\r\nexpires: Tue, 07 Jul 2026 16:21:22 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1707,"size_decoded":2081,"mime_type":"image/png","magic":"ASCII text, with very long lines (2278), with no line terminators","md5":"586cf1cd471b384ba756ae07b6e8eef9","sha1":"335e79ef1429f84b02f93fad540b21b7f0310cf1","sha256":"a0655e06c523553d83eb8cea547d7cc6099d211bbe568c5a4451b38b220e1350","sha512":"e65718b37925f319a613ebb41d4939df46085a60d26720c4001e0d9865d48f7da5c2ac83c33f10a8c52f1b490dc2b9d9c879a30497d1ac373452dcb91e2e696c","ssdeep":"","tlshash":"2841f99a00f99be3adff0621cc6584b4ce058beb505d206e2985d6218d2405f57d6f27","first_seen":"2026-06-07T16:22:02.235109Z","last_seen":"2026-06-07T16:22:02.235109Z","times_seen":1,"resource_available":false,"data":null}},"time_used":255,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":255,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"tronsave.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.mescroll.com/img/xinlang/mescroll-arrow.png","fqdn":"www.mescroll.com","domain":"mescroll.com","tld":"com"},"ip":{"addr":"185.199.110.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tronsave.vip/","date":"2026-06-07T16:21:23.221Z","timestamp":1780849283221,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.mescroll.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Apr 2026 04:37:55 GMT","end":"Thu, 16 Jul 2026 04:37:54 GMT"},"fingerprint":{"sha1":"0B:CC:1C:A5:6D:F2:86:47:7D:BC:29:11:7F:33:6B:C9:CC:05:57:7F","sha256":"AC:4B:84:A6:40:61:26:35:8A:41:83:58:2C:41:B5:27:E7:08:25:63:F4:E9:56:24:C6:AE:F9:55:D3:66:38:E6"}}},"request":{"raw":"GET /img/xinlang/mescroll-arrow.png HTTP/1.1\r\nHost: www.mescroll.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tronsave.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: GitHub.com\r\ncontent-type: image/png\r\nlast-modified: Mon, 30 Dec 2024 01:21:49 GMT\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31556952\r\netag: \"6771f5ad-101\"\r\nexpires: Sun, 07 Jun 2026 16:31:24 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: MISS\r\nx-github-request-id: CE92:32F72F:354E3E:3AB32F:6A259A82\r\naccept-ranges: bytes\r\nage: 0\r\ndate: Sun, 07 Jun 2026 16:21:24 GMT\r\nvia: 1.1 varnish\r\nx-served-by: cache-bma-essb1270055-BMA\r\nx-cache: MISS\r\nx-cache-hits: 0\r\nx-timer: S1780849284.050999,VS0,VE107\r\nvary: Accept-Encoding\r\nx-fastly-request-id: 81cb42787503df31f59adab95634d92fd179f06e\r\ncontent-length: 257\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"GitHub Pages","description":"GitHub Pages is a static site hosting service.","website":"https://pages.github.com/","common_platform_enumeration":"","icon":"GitHub.svg","categories":["PaaS"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Fastly","description":"Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video \u0026 streaming services.","website":"https://www.fastly.com","common_platform_enumeration":"","icon":"Fastly.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":257,"size_decoded":931,"mime_type":"image/png","magic":"ASCII text, with very long lines (346), with no line terminators","md5":"5cdfcfe31696bb288ed8c7a1a7e5945a","sha1":"99567d11f6f47e8b8f15c28dc878db2642ec859b","sha256":"8b4eaa12e99699632d71fb0ab990ca1e0fca7dc5c1e844df0363473a1d18ec2c","sha512":"cf849946987b8d43b6c3847796ac5e4d5ac8758546993c76cd91334854300d902898cb9486f951a29a8f6b9c89f2810b477a061231f15465e2941a754404a21f","ssdeep":"","tlshash":"9ae02638b041b997c0eb6ed95d2c1d6b5d92b8ea221dbd1277ba10850cae80ad16646c","first_seen":"2026-06-07T16:22:02.236515Z","last_seen":"2026-06-07T16:22:02.236515Z","times_seen":1,"resource_available":false,"data":null}},"time_used":941,"timings":{"blocked":-1,"dns":576,"connect":10,"send":0,"wait":116,"receive":0,"ssl":238},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}