{"report_id":"a2fc9c91-07e1-4beb-8348-59e8aec6646c","version":0,"status":"done","tags":[],"date":"2026-09-29T04:50:38Z","url":{"schema":"http","addr":"langsunggas.com/","fqdn":"langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":0,"asn":62904,"as":"Eonix Corporation","country":"United States","country_code":"US"},"final":{"url":{"schema":"http","addr":"www.langsunggas.com/","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"title":"87365最快检测中心|中国有限公司-官方网站","dom":{"size":4107,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4069), with no line terminators","md5":"7bb6ef34058813b9d0f2711e1860f935","sha1":"41eda826bd0616984e7a61c48d8921e541acdd26","sha256":"22688a15c47da052eb8203c47a21006d400d660e5e2840624f1ba4fdbe2b8a57","sha512":"722e9dfc604261c9df0c022075d7dc5bc7daa6887475070719c82e5ddd7fcb0ed30a0e37b1ccdf461ec0671a44e4673cbfe191efb1c18f1ed375d5ad47d3ed0c","ssdeep":"96:uatKmUiX/A6MJrIgzato687xSXwXZxSXwXR:u7WXYvJz+87xSXwXZxSXwXR","tlshash":"168161ab8988d50e8952e488d27afadd9557202fce27dc07fee4d4ceed14ad948031cc","dom_hash":"domhash7193c639895cceed9caa86ef2a7c26d2","first_seen":"2026-09-29T04:51:11.946821Z","last_seen":"2026-09-29T04:51:11.946821Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"langsunggas.com/","fqdn":"langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":0,"asn":62904,"as":"Eonix Corporation","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-03T04:50:38Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"31pu2ilhjrkmwpf"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":12}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"tp.xinxiyidiantong.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"fcl.xueyuxingfeng.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"img75.chem17.com","ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2020-07-02T02:38:34Z","last_seen":"2026-08-27T03:39:39.052278Z","alert_count":0,"request_count":2,"received_data":494,"sent_data":1211,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"www.chem17.com","ip":{"addr":"163.181.131.243","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Germany","country_code":"DE"},"domain_registered":"2003-03-17","domain_rank":3165666,"first_seen":"2013-06-12T07:47:44Z","last_seen":"2026-09-28T14:45:13.353957Z","alert_count":0,"request_count":3,"received_data":8245,"sent_data":2397,"comment":"","tags":null,"fingerprints":[{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"89tongji.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2023-08-03","domain_rank":3345724,"first_seen":"2023-08-03T16:00:12Z","last_seen":"2026-09-21T08:21:42.371575Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":457,"comment":"","tags":null,"fingerprints":null},{"fqdn":"img47.chem17.com","ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2018-01-22T02:37:37Z","last_seen":"2026-09-18T08:23:05.867961Z","alert_count":0,"request_count":2,"received_data":494,"sent_data":1211,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"tp.xinxiyidiantong.com","ip":{"addr":"27.124.44.50","port":5868,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"domain_registered":"2019-08-03","domain_rank":0,"first_seen":"2022-06-30T09:41:39Z","last_seen":"2026-09-21T22:18:13.686459Z","alert_count":8,"request_count":8,"received_data":1494596,"sent_data":4718,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"sdk.51.la","ip":{"addr":"43.159.107.113","port":80,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"domain_registered":"2005-01-17","domain_rank":347679,"first_seen":"2021-03-08T16:03:51Z","last_seen":"2026-09-22T20:37:33.176088Z","alert_count":0,"request_count":2,"received_data":69564,"sent_data":682,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"img76.chem17.com","ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2021-08-20T07:23:10Z","last_seen":"2026-08-29T02:39:31.31516Z","alert_count":0,"request_count":8,"received_data":1910,"sent_data":4712,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"img52.chem17.com","ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2013-11-27T18:29:53Z","last_seen":"2026-09-22T09:28:50.926735Z","alert_count":0,"request_count":4,"received_data":988,"sent_data":2422,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"img50.chem17.com","ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2018-01-04T13:20:18Z","last_seen":"2026-09-22T09:28:50.187979Z","alert_count":0,"request_count":4,"received_data":988,"sent_data":2422,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"img72.chem17.com","ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2020-07-23T08:16:54Z","last_seen":"2026-09-12T12:10:52.834114Z","alert_count":0,"request_count":2,"received_data":494,"sent_data":1211,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"chat.chem17.com","ip":{"addr":"163.181.131.231","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Germany","country_code":"DE"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2014-05-27T23:58:43Z","last_seen":"2026-09-08T18:00:07.103995Z","alert_count":0,"request_count":2,"received_data":2151,"sent_data":972,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}]},{"fqdn":"img58.chem17.com","ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2013-11-27T18:29:53Z","last_seen":"2026-09-22T09:28:49.10118Z","alert_count":0,"request_count":6,"received_data":38730,"sent_data":3349,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}]},{"fqdn":"img65.chem17.com","ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2015-04-26T09:19:08Z","last_seen":"2026-09-08T18:00:07.716846Z","alert_count":0,"request_count":2,"received_data":494,"sent_data":1211,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"img57.chem17.com","ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2013-11-27T18:29:52Z","last_seen":"2026-09-22T09:28:49.162747Z","alert_count":0,"request_count":2,"received_data":494,"sent_data":1211,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"img63.chem17.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2013-11-27T18:29:54Z","last_seen":"2026-09-08T18:00:08.025257Z","alert_count":0,"request_count":2,"received_data":279,"sent_data":1211,"comment":"","tags":null,"fingerprints":null},{"fqdn":"img61.chem17.com","ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2013-10-02T03:25:02Z","last_seen":"2026-09-12T23:20:05.092125Z","alert_count":0,"request_count":2,"received_data":494,"sent_data":1211,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"img41.chem17.com","ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2016-11-12T23:22:17Z","last_seen":"2026-09-12T12:10:53.14085Z","alert_count":0,"request_count":2,"received_data":494,"sent_data":1211,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"www.langsunggas.com","ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":245,"request_count":49,"received_data":385105,"sent_data":21858,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"www.hzyangyi.cn","ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":37,"received_data":8002,"sent_data":20819,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"img78.chem17.com","ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2022-06-02T00:43:33Z","last_seen":"2026-09-12T23:24:46.657784Z","alert_count":0,"request_count":4,"received_data":988,"sent_data":2422,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"pinganfafa.com","ip":{"addr":"143.92.57.25","port":25858,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"domain_registered":"2024-12-12","domain_rank":6845800,"first_seen":"2024-12-18T10:35:17.798759Z","last_seen":"2026-09-11T23:15:43.303766Z","alert_count":0,"request_count":1,"received_data":2932,"sent_data":813,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"fcl.xueyuxingfeng.com","ip":{"addr":"27.124.44.6","port":6987,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"domain_registered":"2021-06-17","domain_rank":0,"first_seen":"2021-06-17T13:30:21Z","last_seen":"2026-09-27T14:30:12.447607Z","alert_count":1,"request_count":1,"received_data":3644,"sent_data":473,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"img49.chem17.com","ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2018-01-22T02:37:37Z","last_seen":"2026-09-22T09:28:50.553649Z","alert_count":0,"request_count":2,"received_data":494,"sent_data":1211,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"collect-v6.51.la","ip":{"addr":"43.159.107.113","port":80,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"domain_registered":"2005-01-17","domain_rank":348646,"first_seen":"2021-03-08T16:03:54Z","last_seen":"2026-09-22T08:25:05.640931Z","alert_count":0,"request_count":2,"received_data":732,"sent_data":808,"comment":"","tags":null,"fingerprints":[{"name":"EdgeOne","description":"EdgeOne is an edge-service platform that delivers global content distribution, network acceleration, and integrated security protections for distributed applications.","website":"https://edgeone.ai","common_platform_enumeration":"","icon":"EdgeOne.svg","categories":["CDN"]}]},{"fqdn":"img60.chem17.com","ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2013-11-27T18:29:53Z","last_seen":"2026-09-22T09:28:49.517953Z","alert_count":0,"request_count":4,"received_data":988,"sent_data":2422,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"img80.chem17.com","ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2022-06-02T00:43:33Z","last_seen":"2026-09-08T18:00:07.952Z","alert_count":0,"request_count":6,"received_data":1267,"sent_data":3633,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"img45.chem17.com","ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2016-08-23T23:54:56Z","last_seen":"2026-09-18T08:23:05.948395Z","alert_count":0,"request_count":2,"received_data":494,"sent_data":1211,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"img56.chem17.com","ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2013-12-07T17:47:33Z","last_seen":"2026-09-08T23:24:53.520831Z","alert_count":0,"request_count":4,"received_data":988,"sent_data":2422,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"img53.chem17.com","ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2013-11-27T18:29:54Z","last_seen":"2026-09-12T23:38:59.571438Z","alert_count":0,"request_count":4,"received_data":988,"sent_data":2422,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"img59.chem17.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2003-03-17","domain_rank":0,"first_seen":"2013-05-25T14:24:16Z","last_seen":"2026-09-22T09:28:50.512421Z","alert_count":0,"request_count":2,"received_data":279,"sent_data":1211,"comment":"","tags":null,"fingerprints":null},{"fqdn":"langsunggas.com","ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":10,"request_count":2,"received_data":195,"sent_data":884,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"http","addr":"www.langsunggas.com/","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2364053bee78c919efb5c1806e0720da","sha1":"3564145a9b2ce81d49a3baea51b65cc88abbf4c6","sha256":"e85f74731e34744e806434dccf06e94a7ae011a7828f917d59ae889aa4292865","sha512":"f25f3044a5759da7f4d9c4d8dc5bbe576e5c69f9ceba5d3baf5cea2f21736ea8c2bec551d5ed0516400504a4ca06ea45102bd0b4f2c2896941f8064cf5c53c05","ssdeep":"","tlshash":"17f0d4ae6c41a9545bc3349c97dfd74cd15f00381009c417a5d9c8cd3d38fc5082174c","size":493,"data":"","first_seen":"2026-08-15T11:31:14.126787Z","last_seen":"2026-10-11T11:29:56.97501Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"43.159.107.113","port":80,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"8fc0b01d35300e8398d6e957987c01e7","sha1":"f1eb32c75b8d8e4b0555ebc2a5f5d1d60296f41e","sha256":"b164aafa0bb83dfe511912ca2ca475880bfffac8d8f098c947fd3d4af440d3a4","sha512":"fab84d067e724d45f35821d8f37c0cd4f608af2975de48a61b905dba89189ca8778b04b4d507e6417a4187193a3da2d0a8939c02bf2d39adb9733cffd2358401","ssdeep":"768:Xzz9qAO+a/y1jaKUiQU5enEU9GMXB0XXQVEXB3CNSPf:Xzz9qnT/c+KUc5enEU9GMXB/EXB3LPf","tlshash":"55f22d9577c0717cc3c782e9361b401ae1a69e810099a8acf345f594bd74e66a33ffa8","size":34329,"data":"","first_seen":"2023-04-05T07:31:50Z","last_seen":"2026-10-10T22:03:35.779038Z","times_seen":10954,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chat.chem17.com/chat/KFCenterBox/274521","fqdn":"chat.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"163.181.131.231","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"b936460ba988b30cd79d99ae93c77106","sha1":"a44405ff5b67abf66ef77714e4364e6c3f1e9940","sha256":"6cd604b71e1e21050b6a41602716b9a722e769a5d7cfb3b97152f3d73dcef5c9","sha512":"ad4731faf916fbb7118af38e25fa7e15814294950676fbd4ec41aeba5c7508ed34b7a7a4c98e1834e1096ea92e6301935699ed6df01a7416632e39063c0c9661","ssdeep":"","tlshash":"3990023209b10052711510915943e1456595959129de9915a00004a572529539a06d51","size":49,"data":"","first_seen":"2023-03-07T12:42:46Z","last_seen":"2026-10-10T04:28:39.707249Z","times_seen":735,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"379ec8d8919af69427d08b5a4ca3bbc0","sha1":"f1643a7382c726fc27ba71ef934c001bde99dea0","sha256":"80de7ab9ebfeb808cffd2c76a5374cedab56483294af2f7c32d3120e425c8b93","sha512":"fd4fb83593548748f7e9d50d31e2c568c689f4cafcdcc54b8a4212d27d0c18dc14e796c1b399e142304b841851765f692f890460db8a5f4b6fb3b4ea31d5d374","ssdeep":"","tlshash":"e2012027be36c8888123b49871e632b890adc6038857294783fc06da87f15d9a702e53","size":770,"data":"","first_seen":"2026-09-29T04:51:11.987879Z","last_seen":"2026-09-29T04:51:11.987879Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"c3d0e73fe04fdce81e9f9473af608d67","sha1":"870c7aa97db83ea4a4fe0744664ecd8c4b8bb544","sha256":"19e5a5af74519c1594865d15623e426ba4912788d8e11ee02d0f1a19be1ccba4","sha512":"1e11167198f6ff4d1db0f9dd97e2e8f53263e5438274efda12e88b1e653c45c65621b0ccb55eca0c4143824c64f7cc4656bf4f6b461c3b4836d9d02163f9c682","ssdeep":"","tlshash":"d1a002bf3690b35521116553b5661d4e69b75434d440847cba545594087cc544395c55","size":82,"data":"","first_seen":"2026-09-29T04:51:11.989415Z","last_seen":"2026-09-29T04:51:11.989415Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"f2574be7b7a6bfaebb519a966361ea51","sha1":"0d49137b6850743198dd7a8911d5190faa7c24c4","sha256":"2377f965c7fe2c6da0ab193b426d66ef5a408ddc3989be4139903895c06f8607","sha512":"1d8c878703980e310ee438dbbd0a893109d1d9f148c51d72fe5b8e7bfd77b580f29f5448c2d2fa072b2a1c75ddd6a2167d1fdeac3e7d228b8c5b8aa5d9147c2b","ssdeep":"","tlshash":"6e01c284417810638663f13f1c3f6221a66b928bd8ee2cb474ad0440cf2916d4bfebb0","size":773,"data":"","first_seen":"2026-06-23T07:59:41.020638Z","last_seen":"2026-10-11T09:36:10.930249Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"f6607e9f4eed471a6e536d906a7b98c9","sha1":"297b95a0f26addbae111f78cc2cfb33aa8d83520","sha256":"6924224a687aabd6afc6d3d5b436977a3ff99ef6cac4a295bc72d3609aa3fa86","sha512":"ccad61c6cac8da99dc5655ad6404b232b9bdaa0030e35a24927834092997d1d63a4cfec7b12caee475543ce90dd3d4d341a2b31802ad489111ff65e28e15ec89","ssdeep":"","tlshash":"5a2147868028643782a2e27f1c3f62116a2bc2c7c8ee3cb1709d0540cf2a15e16fe7b4","size":1280,"data":"","first_seen":"2026-09-29T04:51:11.993367Z","last_seen":"2026-09-29T04:51:11.993367Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"d4a2b2b26799c68fbefbd6579a86f737","sha1":"1c7611cdad101aeb9e794d59a69a8d28d8c8b135","sha256":"05bd3566ad41f4c3315f3655b0effccbce728d342fc28eead9030387b587c425","sha512":"1c8c71edf57e5b9c56cf2b18da57aa50610b032c64f6b1967c8a761b071186a922aa6af40782513f0571f0334713387814c4db1eb39dccc457aa3268a03dcf15","ssdeep":"","tlshash":"b92145868128547782a3e27f1c3f6211692b82cbc8ee3cb1759c01408f6925e15febb4","size":1411,"data":"","first_seen":"2026-09-29T04:51:11.995321Z","last_seen":"2026-09-29T04:51:11.995321Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"259fff36dc20ab2a65251aa2d341c267","sha1":"0374be9f2329d92cb33f072ef7806c1931932883","sha256":"5ae41089ec94bcb0aea9d06fa65a47dd2e1126b91688102855c37c45f48d008e","sha512":"c2ce72d687654344e6d229e8de7da75fed78f3d04afdebbc3827a4198db6821c927be93de8a01f9c158f4aac6b8780385e36e342cc0c5aba97f045a853b33c48","ssdeep":"","tlshash":"a22128868128543782b3e27f1c3f6211596b92cbccee3cb5759d05808f2925e55febb4","size":1411,"data":"","first_seen":"2026-09-29T04:51:11.997095Z","last_seen":"2026-09-29T04:51:11.997095Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"b9002b67ab03011edae3b3d72652e1a7","sha1":"3e0794ed840799c66a881412bbb21a8ce0058779","sha256":"a8d4b0df404f0d1680593eb5279c93b0623cfbf1c6a494d149f445eb7eb4c546","sha512":"cb57e977f4fabb58fe32b25c77c0910cc01c9cdf0f98475bc2218ca39e88a60e876fa4ea07d1c254d84f0619f50dd61b298e62ed68e901b50f15baf07db1e671","ssdeep":"","tlshash":"0ce026aa29721674578419fa992ff92cf1aa617c0554e003f58dfc220024eef4e2ead5","size":343,"data":"","first_seen":"2026-06-06T21:46:17.717816Z","last_seen":"2026-10-11T14:31:39.033601Z","times_seen":333,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/js/pt_js.js","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7bfe05726f803ae0557a465cc8b829de","sha1":"c3600a51cbef86ddbb44a8638967a7a7fd51419a","sha256":"7e01855837d56696ec9e063f9e51ba41d3494b55e180548be012f0cf5014c987","sha512":"477c665b9c57dc02dd2ea08a7653880e7c4c05e5ad47edc44656c70e677518bdd708e0332f9ddd63be4d540d0c6805b8b96450cf858ef052b77937d441953690","ssdeep":"","tlshash":"a441ef07f3b49a3812ff366b183fa0486a482883d58b5451f47e15b4cdac23cb2a7da5","size":2380,"data":"","first_seen":"2023-05-22T11:49:21Z","last_seen":"2026-09-29T04:51:11.97616Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"9001e8b9755542ab4ebadeae66d3f95c","sha1":"aebdaeee255555c6ac8d8f5da64d0d8f4057f5fa","sha256":"bd65945f6b8646f13da4b70b816d0793db220db8ed5bdfd751370c096f24b725","sha512":"ed8b12a72f5190c201c879e79ba65c62869fc9c0a875c38089ff77bd54a4438f3f7b47d2178ac14a3f8d4cff5cbf55d4015e9917890ef98378048edc6a80e3cc","ssdeep":"","tlshash":"e0f097ae5881a1586ad734e89babd648c0ae2026500ed813b5dac5cd2d38fc80821b5c","size":493,"data":"","first_seen":"2026-09-07T04:25:13.777328Z","last_seen":"2026-09-29T04:51:11.999498Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/js/JSChat.js","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"c585663f5b83e34d09092e44326b9377","sha1":"498b43fec7eb7cb801257cc121f97c12be542abc","sha256":"97da6e4048ee96ed0c9d00a4f87b00c26adb4af9af53df68e5d8b6669f4bb690","sha512":"5e9a059d9ff3f80b3aa58f6411925c2744e579450f08885deaf41bbdfcb95af3254195a4fde2454047d63838ec6a4eb5cd4d3b213bf1d94df9d5d30ba86f44e9","ssdeep":"","tlshash":"7731dfb28913d31609194e63c716174ca267915b9103e9623d3d7e643f88d2bb3997f0","size":1622,"data":"","first_seen":"2024-01-31T06:36:47Z","last_seen":"2026-10-11T12:37:33.490973Z","times_seen":704,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chat.chem17.com/chat/KFLeftBox/274521","fqdn":"chat.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"163.181.131.231","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"b936460ba988b30cd79d99ae93c77106","sha1":"a44405ff5b67abf66ef77714e4364e6c3f1e9940","sha256":"6cd604b71e1e21050b6a41602716b9a722e769a5d7cfb3b97152f3d73dcef5c9","sha512":"ad4731faf916fbb7118af38e25fa7e15814294950676fbd4ec41aeba5c7508ed34b7a7a4c98e1834e1096ea92e6301935699ed6df01a7416632e39063c0c9661","ssdeep":"","tlshash":"3990023209b10052711510915943e1456595959129de9915a00004a572529539a06d51","size":49,"data":"","first_seen":"2023-03-07T12:42:46Z","last_seen":"2026-10-10T04:28:39.707249Z","times_seen":735,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.chem17.com/mystat.aspx?u=yangyikeji","fqdn":"www.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"163.181.131.243","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"101d58b4c03a7e7e4cd64412afe83634","sha1":"91dd40195a72cc48cfa70702278bcf815742ffd3","sha256":"f2f861fa295abfe57e32d8aa6250b5940cac190a6ab77aebe1a1e1e7b741da1c","sha512":"0679067dcad3002ef9fba58d8eb894de4b35fb5aa3f66544f62b42e083b5935806d1cb5761b906d45aab479416461065dbfec954721da63a4486c28498780b95","ssdeep":"","tlshash":"ea214d541d06c0a4bc39713d89b7c13cd2b11a273865d73678cca9088f78fa525deeea","size":1361,"data":"","first_seen":"2026-09-29T04:51:11.984025Z","last_seen":"2026-09-29T04:51:11.984025Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/jquery.min.js","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a75ada17c3011458d74a0e4c5cc17ffa","sha1":"8e57d597b1caeb46af5a4578034187eda8bf8b26","sha256":"8056951f7605e0cc00e96769abe87124de09d74273e83efb7992dddc056390ce","sha512":"b56551f614e99478ac6a0e273fe4bb4b796c29e118732b903d11ec3dfc8368f0872386a3970dad897a0b5dceb21adb5557827c6dad66a642480a1f52c45fef4e","ssdeep":"","tlshash":"d30181d8c7c4d89baecc5e43ea24deca25b3813b97d832838318fe8c01ad157c89c049","size":718,"data":"","first_seen":"2023-03-07T12:26:46Z","last_seen":"2026-10-11T11:29:56.968744Z","times_seen":214,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/js/swiper.min.js","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"727aa43ba881b4b217f03be36e50889a","sha1":"76b1d139be6e5ceeee1bee6ec84e48ffe080536f","sha256":"8734a3237b1f9a943eb5be499e0c29a65eb39dd4074a98f56a75dc59c42747b1","sha512":"5b64172cf2c427793369315fc747b12f31efaf4ab339fa7ebc8085ba02d973b4dc94ad23835e6499d27f24bb945029a7a7395d4514a802a12ba99f9110d38015","ssdeep":"1536:dyOkN3TklR3ZIFD7+Y7n2L5ydUTq0tSQfCBTR:QTF73uTq/","tlshash":"4c93d66db314f3e295d3214a679ac64122f21706b849dae870b54c4a68bcc5d03bffbd","size":96141,"data":"","first_seen":"2024-09-19T20:59:52.708226Z","last_seen":"2026-10-11T09:36:10.808371Z","times_seen":140,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/js/qq.js","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b165bcd3f323ed7df6d36630f5d7aeab","sha1":"b90d52cfe33d1f2935a4fafc0d5db25d4eeddb0a","sha256":"0ede023b10cadd81266e82f0ef09e13d926e4f26eebeb4639dcee41326d4fc41","sha512":"61e4d22373ca062b479f153a0b873ff6d6204438b18c9e65ba4e979fb20f1672d4ebbc1ccc97e88cabae5dd902fea7427eaa0d41527109af2199f5981cfee63f","ssdeep":"","tlshash":"3531acd8f78e152150f5b27d993fd7cd313e2023b853a857ac6d88b808b867b1625d98","size":1694,"data":"","first_seen":"2023-05-22T11:49:21Z","last_seen":"2026-09-29T04:51:11.985398Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/jquery.la.min.js","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8fd4b6cce314883a0f42ecdd36ee4a0c","sha1":"589bc7e2a54ca867dc40c02b117b8f8a514a79f2","sha256":"98dbd7adb78c3ae0190868fdb4f5501183030b3b99928f95c044052c1b16bb5a","sha512":"09dd35061d7958d3857f8746108030b6abfccc329390afdc4c832d9d7382a96664faf01f37cc704ec24be70d9f7e483169a0c64ac2dfd73af2366034c02d81a9","ssdeep":"","tlshash":"9c21c15efc05e2146f56397633b7d9ace9ae10319409d80665eec0ac7c25ff94511e0c","size":1221,"data":"","first_seen":"2023-11-23T05:47:09Z","last_seen":"2026-10-03T06:31:04.05539Z","times_seen":48,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fcl.xueyuxingfeng.com:6987/067/ade/sj.js","fqdn":"fcl.xueyuxingfeng.com","domain":"xueyuxingfeng.com","tld":"com"},"ip":{"addr":"27.124.44.6","port":6987,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"fa19716607c7d8137d9cfbe623dba7cb","sha1":"e46242940c345610d692c2b1ce8fe9c1152aa46c","sha256":"cc9193fc7e8e2722b308b5de9881b0442e21363e33b296824381d574816bae16","sha512":"391ff0cdc99fdcfb81af8a0a72425b9e178309d74d5ec96642dbfc1fdd98be8529260af73ac6896dd45266adde8cfcfa96083e4c94a10ef1a3e593de0915d60b","ssdeep":"","tlshash":"4b611f54ef8d20338e133155ae6f958c24be68577d48eca7f84c64d44fa0d38852beac","size":3363,"data":"","first_seen":"2024-12-18T10:35:23.532443Z","last_seen":"2026-10-11T11:29:56.953338Z","times_seen":340,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/js/jquery-3.6.0.min.js","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"46831fe773a633cbc6b491e456a0b66b","sha1":"aa798cd2820d0a596821dd83ac8e96fe4b5792b3","sha256":"7bf3461bc9e57a4820571d7e417b644c7d30927fe07d9b6e9802fe6758feb6f7","sha512":"493d28fc7a7bf3ffe38814c89c647fc0da8b23efbd167fcba148a0b8a9f4eea2964ae0cf0e20dd8315d01037b15e3ea767b976783743d2113067e96bdbdb7f7d","ssdeep":"1536:ajExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiXYmQ1vo:aIh8GgP3hujzwbhdXXvxiDQ47GK/","tlshash":"3a9309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","size":89404,"data":"","first_seen":"2025-07-14T20:47:05.285961Z","last_seen":"2026-10-11T11:29:56.960994Z","times_seen":38,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"error","text":"ChatError:202005061528","filename":"https://chat.chem17.com/chat/KFCenterBox/274521","line_number":2,"column_number":16},{"level":"error","text":"ChatError:202005061528","filename":"https://chat.chem17.com/chat/KFLeftBox/274521","line_number":2,"column_number":16},{"level":"warn","text":"jQuery.Deferred exception: ssssssssssss is not defined@http://www.langsunggas.com/skins/274521/js/pt_js.js:51:22\ne@http://www.langsunggas.com/skins/274521/js/jquery-3.6.0.min.js:2:30038\nDeferred/then/l/\u003c/t\u003c@http://www.langsunggas.com/skins/274521/js/jquery-3.6.0.min.js:2:30340\nsetTimeout handler*Deferred/then/l/\u003c@http://www.langsunggas.com/skins/274521/js/jquery-3.6.0.min.js:2:30549\nc@http://www.langsunggas.com/skins/274521/js/jquery-3.6.0.min.js:2:28327\nfireWith@http://www.langsunggas.com/skins/274521/js/jquery-3.6.0.min.js:2:29072\nfire@http://www.langsunggas.com/skins/274521/js/jquery-3.6.0.min.js:2:29108\nc@http://www.langsunggas.com/skins/274521/js/jquery-3.6.0.min.js:2:28327\nfireWith@http://www.langsunggas.com/skins/274521/js/jquery-3.6.0.min.js:2:29072\nready@http://www.langsunggas.com/skins/274521/js/jquery-3.6.0.min.js:2:32045\nB@http://www.langsunggas.com/skins/274521/js/jquery-3.6.0.min.js:2:31824\nEventListener.handleEvent*@http://www.langsunggas.com/skins/274521/js/jquery-3.6.0.min.js:2:32193\n@http://www.langsunggas.com/skins/274521/js/jquery-3.6.0.min.js:2:220\n@http://www.langsunggas.com/skins/274521/js/jquery-3.6.0.min.js:2:225\nmap[type:undefined]","filename":"http://www.langsunggas.com/skins/274521/js/jquery-3.6.0.min.js","line_number":2,"column_number":31593}]},"http":[{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/footico1.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.982Z","timestamp":1790657410982,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/footico1.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:31 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/footico1.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":884,"timings":{"blocked":705,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img80.chem17.com/gxhpic_4c8bb56aa0/24e8f035994b740a942d1928a0cd65076d3324154a680e8f286facf35ffffde06762b11daad905c0_280_280_5.png","fqdn":"img80.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.106Z","timestamp":1790657411106,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/24e8f035994b740a942d1928a0cd65076d3324154a680e8f286facf35ffffde06762b11daad905c0_280_280_5.png HTTP/1.1\r\nHost: img80.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:11 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/nav_bg1.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.171Z","timestamp":1790657411171,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/nav_bg1.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:13 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 9447330645817869361\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.xinxiyidiantong.com:5868/uploads/73in1fspksw4vkiz33cink1f95gkt6.png","fqdn":"tp.xinxiyidiantong.com","domain":"xinxiyidiantong.com","tld":"com"},"ip":{"addr":"27.124.44.50","port":5868,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.845Z","timestamp":1790657411845,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"tp.xinxiyidiantong.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 15 Sep 2026 08:22:00 GMT","end":"Mon, 14 Dec 2026 08:21:59 GMT"},"fingerprint":{"sha1":"F0:C4:3B:CB:7D:58:09:21:F7:9E:98:A7:26:FC:B7:1C:93:6D:B6:16","sha256":"D4:C1:67:34:92:14:60:F1:77:4C:A7:52:10:36:72:3D:42:CE:06:89:6B:78:C3:11:3A:E6:D0:13:4F:A6:D8:F3"}}},"request":{"raw":"GET /uploads/73in1fspksw4vkiz33cink1f95gkt6.png HTTP/1.1\r\nHost: tp.xinxiyidiantong.com:5868\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 85269\r\nLast-Modified: Thu, 30 May 2024 07:57:09 GMT\r\nConnection: keep-alive\r\nETag: \"66583155-14d15\"\r\nExpires: Thu, 29 Oct 2026 04:50:12 GMT\r\nCache-Control: max-age=2592000\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":85269,"size_decoded":85576,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1000x200, components 3","md5":"dd634dd0e0dd49206dcc5895ead43e77","sha1":"1ed15d3f4c9f439901ad35e48e997cd61e21da0c","sha256":"e5bd386dd7f166c21d2b28383dc15fc365a6a9dcad30f3d31ea03ade011f980c","sha512":"520f5c0aaa03859ad2b7a39b5aab91564d24efc9e54f802d07a2e0922089836fd44e43caba81c133e1344efee4d923759abf5bbb60b03049f0ff09c9ab924ec3","ssdeep":"1536:ghHfCs1mEmhYj/SLO+lC1zjLUKOjQ6FmkyjQ5UpshRm6gccXc5s5+IsI0h:YfC2m3qQCZXoDmkyjQjhR/BcM210h","tlshash":"6a83020460391e2efad6bc306e2d59bf96a59012e3a7d2b774e6386ff3b8130114c54e","first_seen":"2024-06-02T21:28:55Z","last_seen":"2026-10-11T14:31:39.006308Z","times_seen":2332,"resource_available":false,"data":null}},"time_used":1285,"timings":{"blocked":-1,"dns":1,"connect":211,"send":0,"wait":423,"receive":224,"ssl":426},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"tp.xinxiyidiantong.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/top_home.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.798Z","timestamp":1790657409798,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/top_home.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/top_home.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":1143,"timings":{"blocked":964,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/logo.jpg","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.799Z","timestamp":1790657409799,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/logo.jpg HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/logo.jpg\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":1050,"timings":{"blocked":889,"dns":0,"connect":0,"send":0,"wait":161,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img78.chem17.com/gxhpic_4c8bb56aa0/24e8f035994b740ae629a26b2906486954e085b25d66c078a708caa1888e71756b1156fbb48b18b9_340_340_5.jpg","fqdn":"img78.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.739Z","timestamp":1790657410739,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/24e8f035994b740ae629a26b2906486954e085b25d66c078a708caa1888e71756b1156fbb48b18b9_340_340_5.jpg HTTP/1.1\r\nHost: img78.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:11 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/news_bt_bg.jpg","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.958Z","timestamp":1790657410958,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/news_bt_bg.jpg HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:31 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/news_bt_bg.jpg\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":760,"timings":{"blocked":601,"dns":0,"connect":0,"send":0,"wait":159,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/news_ico.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.959Z","timestamp":1790657410959,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/news_ico.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:31 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/news_ico.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":779,"timings":{"blocked":617,"dns":0,"connect":0,"send":0,"wait":162,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/footico3.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.984Z","timestamp":1790657410984,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/footico3.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:31 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/footico3.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":891,"timings":{"blocked":731,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/nav_bg.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.160Z","timestamp":1790657411160,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/nav_bg.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:13 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 12204243406097359881\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"43.159.107.113","port":80,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:12.015Z","timestamp":1790657412015,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /js-sdk-pro.min.js HTTP/1.1\r\nHost: sdk.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Sat, 10 Jun 2023 08:47:40 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"648438ac-861a\"\r\nServer: openresty\r\nContent-Type: application/javascript; charset=utf-8\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Credentials: true\r\nCache-Control: max-age=1296000\r\nContent-Length: 12853\r\nAccept-Ranges: bytes\r\nConnection: keep-alive\r\nDate: Tue, 29 Sep 2026 04:50:12 GMT\r\nEO-LOG-UUID: 11284366965430946252\r\nEO-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":34330,"size_decoded":13306,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (34109)","md5":"8fc0b01d35300e8398d6e957987c01e7","sha1":"f1eb32c75b8d8e4b0555ebc2a5f5d1d60296f41e","sha256":"b164aafa0bb83dfe511912ca2ca475880bfffac8d8f098c947fd3d4af440d3a4","sha512":"fab84d067e724d45f35821d8f37c0cd4f608af2975de48a61b905dba89189ca8778b04b4d507e6417a4187193a3da2d0a8939c02bf2d39adb9733cffd2358401","ssdeep":"768:Xzz9qAO+a/y1jaKUiQU5enEU9GMXB0XXQVEXB3CNSPf:Xzz9qnT/c+KUc5enEU9GMXB/EXB3LPf","tlshash":"55f22d9577c0717cc3c782e9361b401ae1a69e810099a8acf345f594bd74e66a33ffa8","first_seen":"2023-04-05T07:31:50Z","last_seen":"2026-10-10T22:03:35.779038Z","times_seen":10954,"resource_available":true,"data":null}},"time_used":138,"timings":{"blocked":-1,"dns":2,"connect":19,"send":0,"wait":116,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chat.chem17.com/chat/KFLeftBox/274521","fqdn":"chat.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"163.181.131.231","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.774Z","timestamp":1790657409774,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /chat/KFLeftBox/274521 HTTP/1.1\r\nHost: chat.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: ESA\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 49\r\nConnection: keep-alive\r\nSet-Cookie: acw_tc=a3b5839517906574098648432ea4c7b99e6ce5cdd016e318e088911792;path=/;HttpOnly;Max-Age=3600\ncdn_sec_tc=a3b5839517906574098648432ea4c7b99e6ce5cdd016e318e088911792;path=/;HttpOnly;Max-Age=3600\nASP.NET_SessionId=insnmm35di20mfkm0n5oddrv; path=/; HttpOnly; SameSite=Lax\nmtcached_mtsession_insnmm35di20mfkm0n5oddrv=10.115.3.112:9720; domain=chat.chem17.com; path=/; HttpOnly\r\nStrict-Transport-Security: max-age=15552000; includeSubDomains\r\nCache-Control: private\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nvia: ens-cache43.l2eo166-17[75,0,DP], ens-cache34.l2hk12[110,0,DP], ens-cache33.l2sg9[149,0,DP], ens-cache1.de7[319,0,DP], ens-cache1.de7[324,0]\r\nx-site-cache-status: DYNAMIC\r\nX-AspNetMvc-Version: 3.0\r\nX-AspNet-Version: 4.0.30319\r\nX-Powered-By: ASP.NET-hg4.165\r\nContent-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval' data:;\r\nTiming-Allow-Origin: *\r\nEagleId: a3b5839517906574098648432e\r\n\r\n","headers":null,"cookies":[{"name":"acw_tc","value":"a3b5839517906574098648432ea4c7b99e6ce5cdd016e318e088911792","quoted":false,"path":"/","max_age":3600,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"acw_tc=a3b5839517906574098648432ea4c7b99e6ce5cdd016e318e088911792;path=/;HttpOnly;Max-Age=3600"},{"name":"cdn_sec_tc","value":"a3b5839517906574098648432ea4c7b99e6ce5cdd016e318e088911792","quoted":false,"path":"/","max_age":3600,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"cdn_sec_tc=a3b5839517906574098648432ea4c7b99e6ce5cdd016e318e088911792;path=/;HttpOnly;Max-Age=3600"},{"name":"ASP.NET_SessionId","value":"insnmm35di20mfkm0n5oddrv","quoted":false,"path":"/","secure":false,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"ASP.NET_SessionId=insnmm35di20mfkm0n5oddrv; path=/; HttpOnly; SameSite=Lax"},{"name":"mtcached_mtsession_insnmm35di20mfkm0n5oddrv","value":"10.115.3.112:9720","quoted":false,"path":"/","domain":"chat.chem17.com","secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"mtcached_mtsession_insnmm35di20mfkm0n5oddrv=10.115.3.112:9720; domain=chat.chem17.com; path=/; HttpOnly"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}],"data":{"size":49,"size_decoded":1076,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with CRLF line terminators","md5":"b936460ba988b30cd79d99ae93c77106","sha1":"a44405ff5b67abf66ef77714e4364e6c3f1e9940","sha256":"6cd604b71e1e21050b6a41602716b9a722e769a5d7cfb3b97152f3d73dcef5c9","sha512":"ad4731faf916fbb7118af38e25fa7e15814294950676fbd4ec41aeba5c7508ed34b7a7a4c98e1834e1096ea92e6301935699ed6df01a7416632e39063c0c9661","ssdeep":"","tlshash":"3990023209b10052711510915943e1456595959129de9915a00004a572529539a06d51","first_seen":"2023-03-07T12:42:46Z","last_seen":"2026-10-10T04:28:39.707249Z","times_seen":735,"resource_available":true,"data":null}},"time_used":449,"timings":{"blocked":-1,"dns":48,"connect":22,"send":0,"wait":348,"receive":0,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img78.chem17.com/gxhpic_4c8bb56aa0/5f8c4cffcfd3c26a1ee7a860f46297dda2f6a2598b2a62d568b0eec1687d3b431a8ab4da13e51179_280_280_5.jpg","fqdn":"img78.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.827Z","timestamp":1790657409827,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/5f8c4cffcfd3c26a1ee7a860f46297dda2f6a2598b2a62d568b0eec1687d3b431a8ab4da13e51179_280_280_5.jpg HTTP/1.1\r\nHost: img78.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img78.chem17.com/gxhpic_4c8bb56aa0/5f8c4cffcfd3c26a1ee7a860f46297dda2f6a2598b2a62d568b0eec1687d3b431a8ab4da13e51179_280_280_5.jpg\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":841,"timings":{"blocked":710,"dns":93,"connect":18,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img58.chem17.com/2/20250325/638785151312871099634_170_170_5.jpg","fqdn":"img58.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.833Z","timestamp":1790657409833,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /2/20250325/638785151312871099634_170_170_5.jpg HTTP/1.1\r\nHost: img58.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img58.chem17.com/2/20250325/638785151312871099634_170_170_5.jpg\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":1093,"timings":{"blocked":709,"dns":346,"connect":19,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/top_tel.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.845Z","timestamp":1790657410845,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/top_tel.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/top_tel.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":200,"timings":{"blocked":41,"dns":0,"connect":0,"send":0,"wait":159,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/more.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.897Z","timestamp":1790657410897,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/more.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:31 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/more.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":806,"timings":{"blocked":628,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tp.xinxiyidiantong.com:5868/uploads/zdxu27gbnptd1nlnoezm734xiww2lz8gs5rh881c.gif","fqdn":"tp.xinxiyidiantong.com","domain":"xinxiyidiantong.com","tld":"com"},"ip":{"addr":"27.124.44.50","port":5868,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.843Z","timestamp":1790657411843,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"tp.xinxiyidiantong.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 15 Sep 2026 08:22:00 GMT","end":"Mon, 14 Dec 2026 08:21:59 GMT"},"fingerprint":{"sha1":"F0:C4:3B:CB:7D:58:09:21:F7:9E:98:A7:26:FC:B7:1C:93:6D:B6:16","sha256":"D4:C1:67:34:92:14:60:F1:77:4C:A7:52:10:36:72:3D:42:CE:06:89:6B:78:C3:11:3A:E6:D0:13:4F:A6:D8:F3"}}},"request":{"raw":"GET /uploads/zdxu27gbnptd1nlnoezm734xiww2lz8gs5rh881c.gif HTTP/1.1\r\nHost: tp.xinxiyidiantong.com:5868\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:12 GMT\r\nContent-Type: image/gif\r\nContent-Length: 36274\r\nLast-Modified: Wed, 19 Feb 2020 07:01:50 GMT\r\nConnection: keep-alive\r\nETag: \"5e4cdd5e-8db2\"\r\nExpires: Thu, 29 Oct 2026 04:50:12 GMT\r\nCache-Control: max-age=2592000\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36274,"size_decoded":36580,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 1000x200, components 3","md5":"7e5d039a1efc18bb7bea97fd777c69af","sha1":"68ef09f74077052dcb97d54c3223d60b3cc8b571","sha256":"49f4dac0c9655023462733d66e03a78de44377c97c6e1c78347a571f93696ba5","sha512":"eb933bd838dfa2cb7b6b4d78b9675ab1243290dba4ab65c49e15ed82e51c10264cc1217ca042cb4d4589c9335f3e03b35788f7c5e982170352fe6c33ffc1cffd","ssdeep":"768:HqqTTVl/XyWz5/SfYem+xeUFFXEBYj5GEeseg5mT25HFwSCJvu0us:Kql5d1iX58UaYXr62X/yvu0us","tlshash":"3df2e1a4a7d09c6cc76715ffdb37f6f0270194709874227a8b982a681d38cf1cae2795","first_seen":"2023-05-06T09:40:17Z","last_seen":"2026-10-11T14:28:05.423219Z","times_seen":1883,"resource_available":false,"data":null}},"time_used":1147,"timings":{"blocked":-1,"dns":3,"connect":227,"send":0,"wait":455,"receive":5,"ssl":457},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"tp.xinxiyidiantong.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/about_bg.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.874Z","timestamp":1790657411874,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/about_bg.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:14 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 17110361079930122236\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/top_ss.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.844Z","timestamp":1790657410844,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/top_ss.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/top_ss.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":201,"timings":{"blocked":41,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/banner2.jpg","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.855Z","timestamp":1790657410855,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/banner2.jpg HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:31 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/banner2.jpg\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":838,"timings":{"blocked":659,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/top_tel.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.125Z","timestamp":1790657411125,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/top_tel.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:13 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 15763898472790287143\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/js/swiper.min.js","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.539Z","timestamp":1790657409539,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/js/swiper.min.js HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:29 GMT\r\nContent-Type: application/javascript;charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nX-Powered-By: PHP/5.4.41\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":96141,"size_decoded":27588,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (31997)","md5":"727aa43ba881b4b217f03be36e50889a","sha1":"76b1d139be6e5ceeee1bee6ec84e48ffe080536f","sha256":"8734a3237b1f9a943eb5be499e0c29a65eb39dd4074a98f56a75dc59c42747b1","sha512":"5b64172cf2c427793369315fc747b12f31efaf4ab339fa7ebc8085ba02d973b4dc94ad23835e6499d27f24bb945029a7a7395d4514a802a12ba99f9110d38015","ssdeep":"1536:dyOkN3TklR3ZIFD7+Y7n2L5ydUTq0tSQfCBTR:QTF73uTq/","tlshash":"4c93d66db314f3e295d3214a679ac64122f21706b849dae870b54c4a68bcc5d03bffbd","first_seen":"2024-09-19T20:59:52.708226Z","last_seen":"2026-10-11T09:36:10.808371Z","times_seen":140,"resource_available":true,"data":null}},"time_used":495,"timings":{"blocked":-1,"dns":0,"connect":145,"send":0,"wait":205,"receive":145,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tp.xinxiyidiantong.com:5868/uploads/w1ldefq37i5y25na7cemsopbpww2nu.gif","fqdn":"tp.xinxiyidiantong.com","domain":"xinxiyidiantong.com","tld":"com"},"ip":{"addr":"27.124.44.50","port":5868,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.841Z","timestamp":1790657411841,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"tp.xinxiyidiantong.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 15 Sep 2026 08:22:00 GMT","end":"Mon, 14 Dec 2026 08:21:59 GMT"},"fingerprint":{"sha1":"F0:C4:3B:CB:7D:58:09:21:F7:9E:98:A7:26:FC:B7:1C:93:6D:B6:16","sha256":"D4:C1:67:34:92:14:60:F1:77:4C:A7:52:10:36:72:3D:42:CE:06:89:6B:78:C3:11:3A:E6:D0:13:4F:A6:D8:F3"}}},"request":{"raw":"GET /uploads/w1ldefq37i5y25na7cemsopbpww2nu.gif HTTP/1.1\r\nHost: tp.xinxiyidiantong.com:5868\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:12 GMT\r\nContent-Type: image/gif\r\nContent-Length: 162061\r\nLast-Modified: Fri, 14 Jun 2024 06:33:54 GMT\r\nConnection: keep-alive\r\nETag: \"666be452-2790d\"\r\nExpires: Thu, 29 Oct 2026 04:50:12 GMT\r\nCache-Control: max-age=2592000\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":162061,"size_decoded":162369,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1000 x 300","md5":"4fb4afe26198c3287fb8e1a05be78270","sha1":"7f2f7b226aef1c717e47b49c29301efa77568374","sha256":"238929b5dc9d4726fd89356e5a33fa365a42d4168943a3934cb7753170bcc7fa","sha512":"5ff12adcefc3bad13c9130fcdd3a3d6c9917ee840bb63d31d5ad8901a770992b24a3a35babd62d4b6ba96898c403a228f38a157fb672addef9d1e40825679fdc","ssdeep":"3072:kW4NNuRHKOxC/DmufPzz76plgJXaBz7KT44Oz8vbM:kWuuRqUC/Dmuf7z7sqXaBz7KU4W8vbM","tlshash":"6ef3123900c89622ae6e3b2d157d86c59556f962acb02eff3b911378aff50df80054ed","first_seen":"2024-02-16T03:28:22Z","last_seen":"2026-10-11T12:37:33.441517Z","times_seen":424,"resource_available":false,"data":null}},"time_used":1703,"timings":{"blocked":-1,"dns":5,"connect":228,"send":0,"wait":461,"receive":552,"ssl":457},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"tp.xinxiyidiantong.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/footico1.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.878Z","timestamp":1790657411878,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/footico1.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:14 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 3851179660256726373\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-29T04:50:09.129Z","timestamp":1790657409129,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:28 GMT\r\nContent-Type: text/html;charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nX-Powered-By: PHP/5.4.41\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":46037,"size_decoded":12596,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (641)","md5":"576b49f853d22d1eb05c626940f89922","sha1":"22789584ce931fb2a0f53316a41b8329bd3ede4a","sha256":"dfc02ca49d6f0cc3e67ef4a6b821deca5bdd99062e63d359af783e029c0112d1","sha512":"3bdb0f895b8faa3327aaf3be19a3ccbe11467fe6f4e25d0dc949692623a9d392964ac072c49cd154a8bd5605dcb624c0721cf65c9c9212f6b4a08826c5eb0c6c","ssdeep":"768:8UKmNnWYi9joV2/NVcvB9qygDjaWUZVQDwCCvcBWRviSI7keH2vqhgmMDmxQVVAd:8UKm0YAjoV2IvB9qygDjT5ZGkaFWS8t","tlshash":"5223066254e52077117361e0a9b4376af8d2e26bd8171e8b33fc26c6dfc5fd98e0205a","first_seen":"2026-09-29T04:51:11.962871Z","last_seen":"2026-09-29T04:51:11.962871Z","times_seen":1,"resource_available":true,"data":null}},"time_used":320,"timings":{"blocked":-1,"dns":4,"connect":145,"send":0,"wait":171,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"img45.chem17.com/gxhpic_4c8bb56aa0/10569a3e6f9b134c174d3668d905454924a8c00e2413b2cbc7ae4e585646006b850dbc8e442951aa_340_340_5.png","fqdn":"img45.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.802Z","timestamp":1790657409802,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/10569a3e6f9b134c174d3668d905454924a8c00e2413b2cbc7ae4e585646006b850dbc8e442951aa_340_340_5.png HTTP/1.1\r\nHost: img45.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img45.chem17.com/gxhpic_4c8bb56aa0/10569a3e6f9b134c174d3668d905454924a8c00e2413b2cbc7ae4e585646006b850dbc8e442951aa_340_340_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":846,"timings":{"blocked":714,"dns":92,"connect":19,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img76.chem17.com/gxhpic_4c8bb56aa0/3b96d8b43fb45b271403fb38ccbe080269a526f92780435fcf9868d2029ae449a136b5dbf3e1a856_280_280_5.png","fqdn":"img76.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.818Z","timestamp":1790657409818,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/3b96d8b43fb45b271403fb38ccbe080269a526f92780435fcf9868d2029ae449a136b5dbf3e1a856_280_280_5.png HTTP/1.1\r\nHost: img76.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img76.chem17.com/gxhpic_4c8bb56aa0/3b96d8b43fb45b271403fb38ccbe080269a526f92780435fcf9868d2029ae449a136b5dbf3e1a856_280_280_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":846,"timings":{"blocked":712,"dns":93,"connect":19,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img52.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea4a3c41fd171b40e6d40c5ab089124fcb4305f3f294bfc6c_280_280_5.png","fqdn":"img52.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.738Z","timestamp":1790657410738,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea4a3c41fd171b40e6d40c5ab089124fcb4305f3f294bfc6c_280_280_5.png HTTP/1.1\r\nHost: img52.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:10 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/home_bg.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.100Z","timestamp":1790657411100,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/home_bg.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img80.chem17.com/gxhpic_4c8bb56aa0/3b96d8b43fb45b27185fae8cf3ec2d00efd2f182d7eab0417a4f9944eeda26f161e5797b8a2ec3b0_340_340_5.png","fqdn":"img80.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.120Z","timestamp":1790657411120,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/3b96d8b43fb45b27185fae8cf3ec2d00efd2f182d7eab0417a4f9944eeda26f161e5797b8a2ec3b0_340_340_5.png HTTP/1.1\r\nHost: img80.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/jquery.la.min.js","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.825Z","timestamp":1790657411825,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /jquery.la.min.js HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:31 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Mon, 28 Sep 2026 02:57:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6ab9d780-4c5\"\r\nExpires: Tue, 29 Sep 2026 05:48:31 GMT\r\nCache-Control: max-age=3600\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1221,"size_decoded":823,"mime_type":"application/javascript","magic":"HTML document, ASCII text, with very long lines (554)","md5":"8fd4b6cce314883a0f42ecdd36ee4a0c","sha1":"589bc7e2a54ca867dc40c02b117b8f8a514a79f2","sha256":"98dbd7adb78c3ae0190868fdb4f5501183030b3b99928f95c044052c1b16bb5a","sha512":"09dd35061d7958d3857f8746108030b6abfccc329390afdc4c832d9d7382a96664faf01f37cc704ec24be70d9f7e483169a0c64ac2dfd73af2366034c02d81a9","ssdeep":"","tlshash":"9c21c15efc05e2146f56397633b7d9ace9ae10319409d80665eec0ac7c25ff94511e0c","first_seen":"2023-11-23T05:47:09Z","last_seen":"2026-10-03T06:31:04.05539Z","times_seen":48,"resource_available":true,"data":null}},"time_used":182,"timings":{"blocked":-1,"dns":0,"connect":145,"send":0,"wait":165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"img50.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a171ef84a2c4f1f1102da910c1db42eeca3bc18c14c969f9b57_340_340_5.png","fqdn":"img50.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.813Z","timestamp":1790657409813,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a171ef84a2c4f1f1102da910c1db42eeca3bc18c14c969f9b57_340_340_5.png HTTP/1.1\r\nHost: img50.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img50.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a171ef84a2c4f1f1102da910c1db42eeca3bc18c14c969f9b57_340_340_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":848,"timings":{"blocked":712,"dns":92,"connect":21,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/mulu_tlt.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.296Z","timestamp":1790657411296,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/mulu_tlt.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:13 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 14665553666384902266\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.xinxiyidiantong.com:5868/uploads/9ac8ygliapz5ww4p3uuacykkfhn6am4w6t6hqand.png","fqdn":"tp.xinxiyidiantong.com","domain":"xinxiyidiantong.com","tld":"com"},"ip":{"addr":"27.124.44.50","port":5868,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.842Z","timestamp":1790657411842,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"tp.xinxiyidiantong.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 15 Sep 2026 08:22:00 GMT","end":"Mon, 14 Dec 2026 08:21:59 GMT"},"fingerprint":{"sha1":"F0:C4:3B:CB:7D:58:09:21:F7:9E:98:A7:26:FC:B7:1C:93:6D:B6:16","sha256":"D4:C1:67:34:92:14:60:F1:77:4C:A7:52:10:36:72:3D:42:CE:06:89:6B:78:C3:11:3A:E6:D0:13:4F:A6:D8:F3"}}},"request":{"raw":"GET /uploads/9ac8ygliapz5ww4p3uuacykkfhn6am4w6t6hqand.png HTTP/1.1\r\nHost: tp.xinxiyidiantong.com:5868\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 178073\r\nLast-Modified: Fri, 14 Jun 2024 06:35:05 GMT\r\nConnection: keep-alive\r\nETag: \"666be499-2b799\"\r\nExpires: Thu, 29 Oct 2026 04:50:12 GMT\r\nCache-Control: max-age=2592000\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":178073,"size_decoded":178381,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1000 x 200","md5":"f10b57811b5cbd80cc2adb677fcbe3e2","sha1":"9c566090638bacef4fb11e5ce3798f6162f52770","sha256":"f4d197904303977c5b8764801ab45de427c7ea38e212e9e158aff5b3bdad6473","sha512":"f3665bcd909bba365acb53d64a6e95d2e1212eaf4f1f8a31419611e1d9a839366f058b9014caa35a429e8492643d49ea7937afce230f8fae1846317ab0a92893","ssdeep":"3072:kmOFOk0AYABeHXNScStRzJmQ3aNIYlmwLs6CLWBOcV8u2OPvr8qFw8Y79C6vaQgL:1AboHXNXStRzAUauwLaLWBOW7hw8elGV","tlshash":"4c0412697de7e838c12bd8d7c2cc57984810cc7c929d4023a6a74d406a77af2ce8d7ca","first_seen":"2024-02-16T22:50:56Z","last_seen":"2026-10-11T14:31:39.018041Z","times_seen":1285,"resource_available":false,"data":null}},"time_used":1751,"timings":{"blocked":-1,"dns":4,"connect":213,"send":0,"wait":431,"receive":675,"ssl":427},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"tp.xinxiyidiantong.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"img80.chem17.com/gxhpic_4c8bb56aa0/3b96d8b43fb45b27185fae8cf3ec2d00efd2f182d7eab0417a4f9944eeda26f161e5797b8a2ec3b0_340_340_5.png","fqdn":"img80.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.807Z","timestamp":1790657409807,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/3b96d8b43fb45b27185fae8cf3ec2d00efd2f182d7eab0417a4f9944eeda26f161e5797b8a2ec3b0_340_340_5.png HTTP/1.1\r\nHost: img80.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img80.chem17.com/gxhpic_4c8bb56aa0/3b96d8b43fb45b27185fae8cf3ec2d00efd2f182d7eab0417a4f9944eeda26f161e5797b8a2ec3b0_340_340_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":1101,"timings":{"blocked":714,"dns":344,"connect":21,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img50.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a171ef84a2c4f1f1102da910c1db42eeca3bc18c14c969f9b57_340_340_5.png","fqdn":"img50.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.737Z","timestamp":1790657410737,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a171ef84a2c4f1f1102da910c1db42eeca3bc18c14c969f9b57_340_340_5.png HTTP/1.1\r\nHost: img50.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:10 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img58.chem17.com/2/20250325/638785151312871099634_170_170_5.jpg","fqdn":"img58.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.103Z","timestamp":1790657411103,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /2/20250325/638785151312871099634_170_170_5.jpg HTTP/1.1\r\nHost: img58.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:11 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/pro_hover.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.388Z","timestamp":1790657411388,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/pro_hover.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:13 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 2657339464387293410\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.xinxiyidiantong.com:5868/uploads/uqpu1x4t749lwvxkguwwsdova106pr.jpg","fqdn":"tp.xinxiyidiantong.com","domain":"xinxiyidiantong.com","tld":"com"},"ip":{"addr":"27.124.44.50","port":5868,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.844Z","timestamp":1790657411844,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"tp.xinxiyidiantong.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 15 Sep 2026 08:22:00 GMT","end":"Mon, 14 Dec 2026 08:21:59 GMT"},"fingerprint":{"sha1":"F0:C4:3B:CB:7D:58:09:21:F7:9E:98:A7:26:FC:B7:1C:93:6D:B6:16","sha256":"D4:C1:67:34:92:14:60:F1:77:4C:A7:52:10:36:72:3D:42:CE:06:89:6B:78:C3:11:3A:E6:D0:13:4F:A6:D8:F3"}}},"request":{"raw":"GET /uploads/uqpu1x4t749lwvxkguwwsdova106pr.jpg HTTP/1.1\r\nHost: tp.xinxiyidiantong.com:5868\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:12 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 200943\r\nLast-Modified: Fri, 30 Sep 2022 18:42:07 GMT\r\nConnection: keep-alive\r\nETag: \"6337387f-310ef\"\r\nExpires: Thu, 29 Oct 2026 04:50:12 GMT\r\nCache-Control: max-age=2592000\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":200943,"size_decoded":201252,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1000x200, components 3","md5":"93b5fd25fa34d9f1f81869e9aa56dda7","sha1":"dc51916e54c77eb33536ba9acb346fc1e86cbe62","sha256":"e612039673cad23b189f1b221bb32b9f8133ea1327fb12e3ea5ef4723606efb4","sha512":"31ebdd12f3bf07d18fb093b3ea7e3783f1242ad253c494413286a5c3403ac2c208904b3bfc067a4c8933628876507889b07fe23361818d2cf5d931139325cfde","ssdeep":"6144:e8qa7OrrWXdlKyAcrn9Y1OhN8zvJ20dJj6SI:4a7Oyd0ncm12kvj6SI","tlshash":"a91412342adb8aececd6b579af1017a6114b0df2d4499fd3c634a838967e20b0d5bd70","first_seen":"2023-05-06T09:40:17Z","last_seen":"2026-10-11T14:31:39.02015Z","times_seen":2514,"resource_available":false,"data":null}},"time_used":2702,"timings":{"blocked":-1,"dns":2,"connect":237,"send":0,"wait":474,"receive":1512,"ssl":477},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"tp.xinxiyidiantong.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/css/style.css","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.536Z","timestamp":1790657409536,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/css/style.css HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:29 GMT\r\nContent-Type: text/css;charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nX-Powered-By: PHP/5.4.41\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":116365,"size_decoded":20626,"mime_type":"text/css; charset=utf-8","magic":"troff or preprocessor input, Unicode text, UTF-8 text, with very long lines (399)","md5":"395351b28c8f8321a591b550910e53d7","sha1":"af809f49a6279164942926c7e4952ce73c73e678","sha256":"8d327c979967096a76cfda2694384cdd88ae4249e13a70c288d519607b9df392","sha512":"943274c485ba0506c3f6b0e0b46663937a67d7639835e90f532366cc7dda4bae893cbd8d185771cfea2388ec8bbcbc43cdb95b8e0de1309bcc35dce17218b5bd","ssdeep":"1536:I5OFG1jLl1ecjhQzoSL4GF6T1XwI2i86mNVCIG7Esh:C","tlshash":"aab36333d791220ce2379766ba9297ed2328c517f3831afc6e643535d28f1a940b3b95","first_seen":"2026-09-29T04:51:11.968077Z","last_seen":"2026-09-29T04:51:11.968077Z","times_seen":1,"resource_available":true,"data":null}},"time_used":345,"timings":{"blocked":-1,"dns":0,"connect":164,"send":0,"wait":202,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"img56.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea60a8c93c95f5a608856ad530550efa81ba786ff56e7c5ed_340_340_5.png","fqdn":"img56.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.809Z","timestamp":1790657409809,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea60a8c93c95f5a608856ad530550efa81ba786ff56e7c5ed_340_340_5.png HTTP/1.1\r\nHost: img56.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img56.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea60a8c93c95f5a608856ad530550efa81ba786ff56e7c5ed_340_340_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":984,"timings":{"blocked":925,"dns":17,"connect":21,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img65.chem17.com/gxhpic_4c8bb56aa0/d69c016c8587526cba49d565e10b5d409b96b202c7976a4d9113644bb2da2614d902c6669d150160_340_340_5.png","fqdn":"img65.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.815Z","timestamp":1790657409815,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/d69c016c8587526cba49d565e10b5d409b96b202c7976a4d9113644bb2da2614d902c6669d150160_340_340_5.png HTTP/1.1\r\nHost: img65.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img65.chem17.com/gxhpic_4c8bb56aa0/d69c016c8587526cba49d565e10b5d409b96b202c7976a4d9113644bb2da2614d902c6669d150160_340_340_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":843,"timings":{"blocked":712,"dns":92,"connect":19,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/jiantou_l.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.900Z","timestamp":1790657410900,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/jiantou_l.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/jiantou_l.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":478,"timings":{"blocked":304,"dns":0,"connect":0,"send":0,"wait":174,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img56.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea60a8c93c95f5a608856ad530550efa81ba786ff56e7c5ed_280_280_5.png","fqdn":"img56.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.082Z","timestamp":1790657411082,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea60a8c93c95f5a608856ad530550efa81ba786ff56e7c5ed_280_280_5.png HTTP/1.1\r\nHost: img56.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:11 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img59.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0e49952decbf04fde14fa6d630f50d8aa40caff494d6230ed8_340_340_5.png","fqdn":"img59.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.104Z","timestamp":1790657411104,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0e49952decbf04fde14fa6d630f50d8aa40caff494d6230ed8_340_340_5.png HTTP/1.1\r\nHost: img59.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img58.chem17.com/3/20260923/639257807753621649631.jpg","fqdn":"img58.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.108Z","timestamp":1790657411108,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /3/20260923/639257807753621649631.jpg HTTP/1.1\r\nHost: img58.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public\r\ncontent-disposition: inline;filename=639257807753621649631.jpg\r\ncontent-type: image/webp\r\ndate: Tue, 29 Sep 2026 02:38:28 GMT\r\netag: \"1790649509_webp\"\r\nexpires: Wed, 29 Sep 2027 02:38:28 GMT\r\nlast-modified: Tue, 29 Sep 2026 02:38:29 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-aspnet-version: 4.0.30319\r\nx-cache: HIT, server, disk\r\nx-powered-by: ASP.NET-img58\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}],"data":{"size":37102,"size_decoded":37605,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1167x763, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"828e21ed849623a8071bdc6fc9cf9254","sha1":"b74001c29c21a3fd9417f11698cfb1522a405cf6","sha256":"099129fddba75a7fff297b708b8719a93d33cfa992da09319d0b968f1650daf9","sha512":"fd71fe03af9efe32429e81a3572725cc5834f5b1653f349ecc9403576f3fe0cf537fa97a646fd58cd25662c75f99462700ce5a4f5aa296252d2369f53e44e1c4","ssdeep":"768:Efsbs81N7QH7S8wp/IgJikkxuey1UBkjinScfjwr5jnyXH9iUchS9qb0t:+WsSmbS8CLJihdBWkvS5jnyNF6iay","tlshash":"43f2f1a8c782dd10fef21ac9260eb2046c036e9e95d05fbb4b75bc13e166f1754b8135","first_seen":"2026-09-29T04:51:11.969705Z","last_seen":"2026-09-29T04:51:11.969705Z","times_seen":1,"resource_available":false,"data":null}},"time_used":181,"timings":{"blocked":163,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/tjcp_bg.jpg","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.483Z","timestamp":1790657411483,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/tjcp_bg.jpg HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:14 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 8597402349515669645\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img57.chem17.com/gxhpic_4c8bb56aa0/25880edbb8a6ac95e13c8d2ac7e8fa910d9b2b95e8be822f99125b1ff209196763eb530ef19ffa33_340_340_5.png","fqdn":"img57.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.803Z","timestamp":1790657409803,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/25880edbb8a6ac95e13c8d2ac7e8fa910d9b2b95e8be822f99125b1ff209196763eb530ef19ffa33_340_340_5.png HTTP/1.1\r\nHost: img57.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img57.chem17.com/gxhpic_4c8bb56aa0/25880edbb8a6ac95e13c8d2ac7e8fa910d9b2b95e8be822f99125b1ff209196763eb530ef19ffa33_340_340_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":841,"timings":{"blocked":714,"dns":92,"connect":18,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pinganfafa.com:25858/fcl.php?keyword=87365%E6%9C%80%E5%BF%AB%E6%A3%80%E6%B5%8B%E4%B8%AD%E5%BF%83%7C%E4%B8%AD%E5%9B%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8-%E5%AE%98%E6%96%B9%E7%BD%91%E7%AB%99\u0026from=pc\u0026originUrl=http%3A%2F%2Fwww.langsunggas.com%2F\u0026referer=\u0026userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\u0026v=508","fqdn":"pinganfafa.com","domain":"pinganfafa.com","tld":"com"},"ip":{"addr":"143.92.57.25","port":25858,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.817Z","timestamp":1790657410817,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"pinganfafa.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 03 Sep 2026 00:35:36 GMT","end":"Wed, 02 Dec 2026 00:35:35 GMT"},"fingerprint":{"sha1":"39:B2:B3:FE:AB:98:10:84:3A:30:02:4D:32:4A:81:9E:E1:2C:66:8B","sha256":"99:97:10:83:FD:5F:26:76:E7:2D:8A:E6:A5:F6:33:CE:39:8D:4F:D1:65:02:8D:D5:64:F1:ED:84:E4:C1:C5:85"}}},"request":{"raw":"GET /fcl.php?keyword=87365%E6%9C%80%E5%BF%AB%E6%A3%80%E6%B5%8B%E4%B8%AD%E5%BF%83%7C%E4%B8%AD%E5%9B%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8-%E5%AE%98%E6%96%B9%E7%BD%91%E7%AB%99\u0026from=pc\u0026originUrl=http%3A%2F%2Fwww.langsunggas.com%2F\u0026referer=\u0026userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\u0026v=508 HTTP/1.1\r\nHost: pinganfafa.com:25858\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: http://www.langsunggas.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:11 GMT\r\nContent-Type: text/html;charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nX-Powered-By: PHP/5.4.41\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":2665,"size_decoded":1221,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1841), with CRLF line terminators","md5":"28c2d70fa88ee865fc1dd09daef807f3","sha1":"afccba634c513e7fa512df841c6a077d0987239f","sha256":"dd519f492fdb3e8a889544c44fd7069f0b667d191389126660596a1fd7fcb700","sha512":"82929bb97f07c011a0a9f217f81fff8b689d65b768f366413d5b98234dd6344fc0d9a42a6f1cca48db6c3cc5575c9e0cc851f852ecf8500a70d6ae0e65ce7a9f","ssdeep":"","tlshash":"5251107382cc914e8961e048d234faea6653246fcf73ac4bfe64559fda004ea89534cd","first_seen":"2026-09-29T04:51:11.971544Z","last_seen":"2026-09-29T04:51:11.971544Z","times_seen":1,"resource_available":true,"data":null}},"time_used":974,"timings":{"blocked":0,"dns":82,"connect":216,"send":0,"wait":239,"receive":0,"ssl":436},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/tjcp_bg.jpg","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.917Z","timestamp":1790657410917,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/tjcp_bg.jpg HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/tjcp_bg.jpg\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":561,"timings":{"blocked":374,"dns":0,"connect":0,"send":0,"wait":187,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/ys2.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.099Z","timestamp":1790657411099,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/ys2.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img53.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ecd0ed31dbe9302d96f54048ff53053c1993ce7dd2bb00be4_340_340_5.png","fqdn":"img53.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.110Z","timestamp":1790657411110,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ecd0ed31dbe9302d96f54048ff53053c1993ce7dd2bb00be4_340_340_5.png HTTP/1.1\r\nHost: img53.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:11 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/top_ss.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.124Z","timestamp":1790657411124,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/top_ss.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:13 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 854959132755430840\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.xinxiyidiantong.com:5868/uploads/ndo5u75d8mk1is8ldrdhiw1h429tnk.gif","fqdn":"tp.xinxiyidiantong.com","domain":"xinxiyidiantong.com","tld":"com"},"ip":{"addr":"27.124.44.50","port":5868,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.852Z","timestamp":1790657411852,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"tp.xinxiyidiantong.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 15 Sep 2026 08:22:00 GMT","end":"Mon, 14 Dec 2026 08:21:59 GMT"},"fingerprint":{"sha1":"F0:C4:3B:CB:7D:58:09:21:F7:9E:98:A7:26:FC:B7:1C:93:6D:B6:16","sha256":"D4:C1:67:34:92:14:60:F1:77:4C:A7:52:10:36:72:3D:42:CE:06:89:6B:78:C3:11:3A:E6:D0:13:4F:A6:D8:F3"}}},"request":{"raw":"GET /uploads/ndo5u75d8mk1is8ldrdhiw1h429tnk.gif HTTP/1.1\r\nHost: tp.xinxiyidiantong.com:5868\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:13 GMT\r\nContent-Type: image/gif\r\nContent-Length: 458771\r\nLast-Modified: Tue, 11 May 2021 11:49:00 GMT\r\nConnection: keep-alive\r\nETag: \"609a6f2c-70013\"\r\nExpires: Thu, 29 Oct 2026 04:50:13 GMT\r\nCache-Control: max-age=2592000\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":458771,"size_decoded":459079,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1000 x 300","md5":"70f984740f0767b3a77491391f9fd051","sha1":"315ee281e1f8d78a98c9495ae21a85620f52365e","sha256":"8ca0d1746eea53fd71559c3903ea72e3c7020cbd546667c32511257fdc53dff6","sha512":"6a3c8cd2ceca01d278bc2affca199747c7c1c2318ac74f67bfbfed3027c9fec60102c513c1460edef51b9e6d0d0c4dcea3ade2b62c66f9b9a22960fab7769c59","ssdeep":"12288:LKGXVMvoygGLsJBQQNIqwVYHLMuJNEJnSftlyTAUozFb:hXWVhkFweLMuqSVI36","tlshash":"9ea42312575a395c0ab3a8e35c26ff8b4d35a1962322f03aa30fe57fd4404e794b6763","first_seen":"2023-10-31T02:49:06Z","last_seen":"2026-10-11T14:31:39.007229Z","times_seen":2318,"resource_available":false,"data":null}},"time_used":2294,"timings":{"blocked":1128,"dns":0,"connect":0,"send":0,"wait":230,"receive":936,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"tp.xinxiyidiantong.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"langsunggas.com/","fqdn":"langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-29T04:50:08.650Z","timestamp":1790657408650,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:28 GMT\r\nContent-Type: text/html\r\nContent-Length: 178\r\nConnection: keep-alive\r\nLocation: http://www.langsunggas.com/\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":293,"timings":{"blocked":-1,"dns":2,"connect":145,"send":0,"wait":146,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/ys1.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.820Z","timestamp":1790657409820,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/ys1.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/ys1.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":886,"timings":{"blocked":713,"dns":0,"connect":0,"send":0,"wait":173,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img63.chem17.com/gxhpic_4c8bb56aa0/d69c016c8587526cba49d565e10b5d40aa815be8efcb7eb077ed783e5cb77a2bf5483a542418eb84_340_340_5.png","fqdn":"img63.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.102Z","timestamp":1790657411102,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/d69c016c8587526cba49d565e10b5d40aa815be8efcb7eb077ed783e5cb77a2bf5483a542418eb84_340_340_5.png HTTP/1.1\r\nHost: img63.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/top_home.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.123Z","timestamp":1790657411123,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/top_home.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/mulu1.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.340Z","timestamp":1790657411340,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/mulu1.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:14 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 13889693951287475223\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/jiantou_l.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.385Z","timestamp":1790657411385,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/jiantou_l.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:13 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 13078603465486687291\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img52.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea4a3c41fd171b40e6d40c5ab089124fcb4305f3f294bfc6c_340_340_5.png","fqdn":"img52.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.808Z","timestamp":1790657409808,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea4a3c41fd171b40e6d40c5ab089124fcb4305f3f294bfc6c_340_340_5.png HTTP/1.1\r\nHost: img52.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img52.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea4a3c41fd171b40e6d40c5ab089124fcb4305f3f294bfc6c_340_340_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":845,"timings":{"blocked":714,"dns":91,"connect":19,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img61.chem17.com/gxhpic_4c8bb56aa0/463345e347026bed25ffe065c9b3635f8fe40ffd4b76ef8da1d68c88db78bb6a49f1c8d117db11e1_280_280_5.png","fqdn":"img61.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.830Z","timestamp":1790657409830,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/463345e347026bed25ffe065c9b3635f8fe40ffd4b76ef8da1d68c88db78bb6a49f1c8d117db11e1_280_280_5.png HTTP/1.1\r\nHost: img61.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img61.chem17.com/gxhpic_4c8bb56aa0/463345e347026bed25ffe065c9b3635f8fe40ffd4b76ef8da1d68c88db78bb6a49f1c8d117db11e1_280_280_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":842,"timings":{"blocked":709,"dns":93,"connect":19,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img78.chem17.com/gxhpic_4c8bb56aa0/5f8c4cffcfd3c26a1ee7a860f46297dda2f6a2598b2a62d568b0eec1687d3b431a8ab4da13e51179_280_280_5.jpg","fqdn":"img78.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.718Z","timestamp":1790657410718,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/5f8c4cffcfd3c26a1ee7a860f46297dda2f6a2598b2a62d568b0eec1687d3b431a8ab4da13e51179_280_280_5.jpg HTTP/1.1\r\nHost: img78.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:11 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/about_bg.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.960Z","timestamp":1790657410960,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/about_bg.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:31 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/about_bg.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":884,"timings":{"blocked":704,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"chat.chem17.com/chat/KFCenterBox/274521","fqdn":"chat.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"163.181.131.231","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.771Z","timestamp":1790657409771,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /chat/KFCenterBox/274521 HTTP/1.1\r\nHost: chat.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: ESA\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 49\r\nConnection: keep-alive\r\nSet-Cookie: acw_tc=a3b5839c17906574098716510ee8c49164f9fc4c0c06806d6d87975e78;path=/;HttpOnly;Max-Age=3600\ncdn_sec_tc=a3b5839c17906574098716510ee8c49164f9fc4c0c06806d6d87975e78;path=/;HttpOnly;Max-Age=3600\nASP.NET_SessionId=2rdvsmlz3yy4vh1wqarvqnd5; path=/; HttpOnly; SameSite=Lax\nmtcached_mtsession_2rdvsmlz3yy4vh1wqarvqnd5=10.115.3.112:9720; domain=chat.chem17.com; path=/; HttpOnly\r\nStrict-Transport-Security: max-age=15552000; includeSubDomains\r\nCache-Control: private\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nvia: ens-cache30.l2eo166-17[58,0,DP], ens-cache30.l2hk12[94,0,DP], ens-cache33.l2sg9[131,0,DP], ens-cache8.de7[644,0,DP], ens-cache8.de7[649,0]\r\nx-site-cache-status: DYNAMIC\r\nX-AspNetMvc-Version: 3.0\r\nX-AspNet-Version: 4.0.30319\r\nX-Powered-By: ASP.NET-hg4.165\r\nContent-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval' data:;\r\nTiming-Allow-Origin: *\r\nEagleId: a3b5839c17906574098716510e\r\n\r\n","headers":null,"cookies":[{"name":"acw_tc","value":"a3b5839c17906574098716510ee8c49164f9fc4c0c06806d6d87975e78","quoted":false,"path":"/","max_age":3600,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"acw_tc=a3b5839c17906574098716510ee8c49164f9fc4c0c06806d6d87975e78;path=/;HttpOnly;Max-Age=3600"},{"name":"cdn_sec_tc","value":"a3b5839c17906574098716510ee8c49164f9fc4c0c06806d6d87975e78","quoted":false,"path":"/","max_age":3600,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"cdn_sec_tc=a3b5839c17906574098716510ee8c49164f9fc4c0c06806d6d87975e78;path=/;HttpOnly;Max-Age=3600"},{"name":"ASP.NET_SessionId","value":"2rdvsmlz3yy4vh1wqarvqnd5","quoted":false,"path":"/","secure":false,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"ASP.NET_SessionId=2rdvsmlz3yy4vh1wqarvqnd5; path=/; HttpOnly; SameSite=Lax"},{"name":"mtcached_mtsession_2rdvsmlz3yy4vh1wqarvqnd5","value":"10.115.3.112:9720","quoted":false,"path":"/","domain":"chat.chem17.com","secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"mtcached_mtsession_2rdvsmlz3yy4vh1wqarvqnd5=10.115.3.112:9720; domain=chat.chem17.com; path=/; HttpOnly"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}],"data":{"size":49,"size_decoded":1075,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with CRLF line terminators","md5":"b936460ba988b30cd79d99ae93c77106","sha1":"a44405ff5b67abf66ef77714e4364e6c3f1e9940","sha256":"6cd604b71e1e21050b6a41602716b9a722e769a5d7cfb3b97152f3d73dcef5c9","sha512":"ad4731faf916fbb7118af38e25fa7e15814294950676fbd4ec41aeba5c7508ed34b7a7a4c98e1834e1096ea92e6301935699ed6df01a7416632e39063c0c9661","ssdeep":"","tlshash":"3990023209b10052711510915943e1456595959129de9915a00004a572529539a06d51","first_seen":"2023-03-07T12:42:46Z","last_seen":"2026-10-10T04:28:39.707249Z","times_seen":735,"resource_available":true,"data":null}},"time_used":778,"timings":{"blocked":-1,"dns":50,"connect":20,"send":0,"wait":675,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/title_ico.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.801Z","timestamp":1790657409801,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/title_ico.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/title_ico.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":881,"timings":{"blocked":716,"dns":0,"connect":0,"send":0,"wait":165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/about_img.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.833Z","timestamp":1790657409833,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/about_img.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/about_img.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":895,"timings":{"blocked":712,"dns":0,"connect":0,"send":0,"wait":183,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img65.chem17.com/gxhpic_4c8bb56aa0/d69c016c8587526cba49d565e10b5d409b96b202c7976a4d9113644bb2da2614d902c6669d150160_340_340_5.png","fqdn":"img65.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.724Z","timestamp":1790657410724,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/d69c016c8587526cba49d565e10b5d409b96b202c7976a4d9113644bb2da2614d902c6669d150160_340_340_5.png HTTP/1.1\r\nHost: img65.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:10 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/banner5.jpg","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.134Z","timestamp":1790657411134,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/banner5.jpg HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:13 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 5866979734821073596\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/nav_line.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.213Z","timestamp":1790657411213,"http_version":"HTTP/1.1","security_state":"","security_info":null,"request":{"raw":"GET /skins/274521/images/nav_line.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:13 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 722892177882295690\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/jiantou_r.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.356Z","timestamp":1790657411356,"http_version":"HTTP/1.1","security_state":"","security_info":null,"request":{"raw":"GET /skins/274521/images/jiantou_r.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:13 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 11404308904517028026\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/banner1.jpg","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.854Z","timestamp":1790657410854,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/banner1.jpg HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:31 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/banner1.jpg\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":809,"timings":{"blocked":624,"dns":0,"connect":0,"send":0,"wait":185,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"img76.chem17.com/gxhpic_4c8bb56aa0/3b96d8b43fb45b271403fb38ccbe080269a526f92780435fcf9868d2029ae449a136b5dbf3e1a856_340_340_5.png","fqdn":"img76.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.808Z","timestamp":1790657409808,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/3b96d8b43fb45b271403fb38ccbe080269a526f92780435fcf9868d2029ae449a136b5dbf3e1a856_340_340_5.png HTTP/1.1\r\nHost: img76.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img76.chem17.com/gxhpic_4c8bb56aa0/3b96d8b43fb45b271403fb38ccbe080269a526f92780435fcf9868d2029ae449a136b5dbf3e1a856_340_340_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":844,"timings":{"blocked":713,"dns":93,"connect":18,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/js/jquery-3.6.0.min.js","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.538Z","timestamp":1790657409538,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/js/jquery-3.6.0.min.js HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:29 GMT\r\nContent-Type: application/javascript;charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nX-Powered-By: PHP/5.4.41\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":89407,"size_decoded":34972,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65535)","md5":"46831fe773a633cbc6b491e456a0b66b","sha1":"aa798cd2820d0a596821dd83ac8e96fe4b5792b3","sha256":"7bf3461bc9e57a4820571d7e417b644c7d30927fe07d9b6e9802fe6758feb6f7","sha512":"493d28fc7a7bf3ffe38814c89c647fc0da8b23efbd167fcba148a0b8a9f4eea2964ae0cf0e20dd8315d01037b15e3ea767b976783743d2113067e96bdbdb7f7d","ssdeep":"1536:ajExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiXYmQ1vo:aIh8GgP3hujzwbhdXXvxiDQ47GK/","tlshash":"3a9309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","first_seen":"2025-07-14T20:47:05.285961Z","last_seen":"2026-10-11T11:29:56.960994Z","times_seen":38,"resource_available":true,"data":null}},"time_used":525,"timings":{"blocked":-1,"dns":0,"connect":164,"send":0,"wait":196,"receive":165,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img52.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea4a3c41fd171b40e6d40c5ab089124fcb4305f3f294bfc6c_340_340_5.png","fqdn":"img52.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.731Z","timestamp":1790657410731,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea4a3c41fd171b40e6d40c5ab089124fcb4305f3f294bfc6c_340_340_5.png HTTP/1.1\r\nHost: img52.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:10 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/ys1.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.752Z","timestamp":1790657410752,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/ys1.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/banner2.jpg","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.697Z","timestamp":1790657411697,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/banner2.jpg HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:14 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 15707765868226963582\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/home_bg.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.800Z","timestamp":1790657409800,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/home_bg.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/home_bg.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":1094,"timings":{"blocked":914,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img76.chem17.com/gxhpic_4c8bb56aa0/aa48a738dd6987648af2c5a5416f00ee996d0674794db0863e59ba91b1565fe28d5e33ab1f9665e8_280_280_5.jpg","fqdn":"img76.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.725Z","timestamp":1790657410725,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/aa48a738dd6987648af2c5a5416f00ee996d0674794db0863e59ba91b1565fe28d5e33ab1f9665e8_280_280_5.jpg HTTP/1.1\r\nHost: img76.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:10 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img41.chem17.com/gxhpic_4c8bb56aa0/e896eca9769be1d4027ef2358ca1b957816f3dc81aedb83737db7896d3a537524edeaa0bc442b7f5_340_340_5.png","fqdn":"img41.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.754Z","timestamp":1790657410754,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/e896eca9769be1d4027ef2358ca1b957816f3dc81aedb83737db7896d3a537524edeaa0bc442b7f5_340_340_5.png HTTP/1.1\r\nHost: img41.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:11 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/news_more.jpg","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.759Z","timestamp":1790657410759,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/news_more.jpg HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/icon2.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.138Z","timestamp":1790657411138,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/icon2.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:31 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/icon2.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":391,"timings":{"blocked":213,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.chem17.com/stat.aspx?u=yangyikeji\u0026referer=\u0026title=87365%u6700%u5FEB%u68C0%u6D4B%u4E2D%u5FC3%7C%u4E2D%u56FD%u6709%u9650%u516C%u53F8-%u5B98%u65B9%u7F51%u7AD9\u0026httpreferer=http%3A//www.langsunggas.com/","fqdn":"www.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"163.181.131.243","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.chem17.com/asyncstat.aspx?u=yangyikeji\u0026referer=\u0026title=87365%u6700%u5FEB%u68C0%u6D4B%u4E2D%u5FC3%7C%u4E2D%u56FD%u6709%u9650%u516C%u53F8-%u5B98%u65B9%u7F51%u7AD9","date":"2026-09-29T04:50:11.208Z","timestamp":1790657411208,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /stat.aspx?u=yangyikeji\u0026referer=\u0026title=87365%u6700%u5FEB%u68C0%u6D4B%u4E2D%u5FC3%7C%u4E2D%u56FD%u6709%u9650%u516C%u53F8-%u5B98%u65B9%u7F51%u7AD9\u0026httpreferer=http%3A//www.langsunggas.com/ HTTP/1.1\r\nHost: www.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.chem17.com/asyncstat.aspx?u=yangyikeji\u0026referer=\u0026title=87365%u6700%u5FEB%u68C0%u6D4B%u4E2D%u5FC3%7C%u4E2D%u56FD%u6709%u9650%u516C%u53F8-%u5B98%u65B9%u7F51%u7AD9\r\nCookie: acw_tc=9b66334617906574099415997e9cb215da397f7f6fd464e06e676a53ca; cdn_sec_tc=9b66334617906574099415997e9cb215da397f7f6fd464e06e676a53ca; mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720; mtcached_mtsession_zdc5tzpu1ili012c34w1qioj=10.115.3.114:9715\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: ESA\r\ncontent-type: text/html\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\ncache-control: no-cache\r\ncontent-encoding: gzip\r\ndate: Tue, 29 Sep 2026 04:50:11 GMT\r\nexpires: -1\r\nset-cookie: ASP.NET_SessionId=e52pruzeeodgclticec213in; path=/; HttpOnly; SameSite=Lax\nmtcached_mtsession_e52pruzeeodgclticec213in=10.115.3.114:9715; domain=.chem17.com; path=/; HttpOnly\r\nvary: Accept-Encoding\r\nvia: ens-cache2.l2eo166-17[46,0,DP], ens-cache1.l2hk12[82,0,DP], ens-cache18.l2sg9[120,0,DP], ens-cache15.de7[300,0,DP], ens-cache15.de7[301,0]\r\nx-site-cache-status: DYNAMIC\r\npragma: no-cache\r\nx-aspnet-version: 4.0.30319\r\nx-powered-by: ASP.NET-hg4.26\r\ntiming-allow-origin: *\r\neagleid: 9b66334617906574111846327e\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"ASP.NET_SessionId","value":"e52pruzeeodgclticec213in","quoted":false,"path":"/","secure":false,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"ASP.NET_SessionId=e52pruzeeodgclticec213in; path=/; HttpOnly; SameSite=Lax"},{"name":"mtcached_mtsession_e52pruzeeodgclticec213in","value":"10.115.3.114:9715","quoted":false,"path":"/","domain":".chem17.com","secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"mtcached_mtsession_e52pruzeeodgclticec213in=10.115.3.114:9715; domain=.chem17.com; path=/; HttpOnly"}],"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3692,"size_decoded":2432,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (835), with CRLF line terminators","md5":"b2ec41e5f7ad2dac938cf4389bd3a954","sha1":"b4e2fc5408115edcc4c9c4d8e43f6dc57b3f60e3","sha256":"7f7d769ec6cc6e43ad7b71ae9a9889cd2e321689f98505d4d36e95ce874441f1","sha512":"e33427429df1c473c44364a068fc778980f05322dff385cd001b75d4460eec3ef5aa57315ffebc7bee6512857d09aa1b6072cef15782a9672e2437a05f28b6f8","ssdeep":"","tlshash":"2771302155c7213ab237c5e36863764cf996868ba6014b68f1ff36e79f9b5ca5023500","first_seen":"2025-08-30T04:25:16.913929Z","last_seen":"2026-09-29T04:51:11.975442Z","times_seen":179,"resource_available":true,"data":null}},"time_used":323,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":323,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/pro_bg.jpg","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.893Z","timestamp":1790657410893,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/pro_bg.jpg HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/pro_bg.jpg\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":313,"timings":{"blocked":147,"dns":0,"connect":0,"send":0,"wait":166,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/js/pt_js.js","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.788Z","timestamp":1790657409788,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/js/pt_js.js HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:29 GMT\r\nContent-Type: application/javascript;charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nX-Powered-By: PHP/5.4.41\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":2380,"size_decoded":1043,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"7bfe05726f803ae0557a465cc8b829de","sha1":"c3600a51cbef86ddbb44a8638967a7a7fd51419a","sha256":"7e01855837d56696ec9e063f9e51ba41d3494b55e180548be012f0cf5014c987","sha512":"477c665b9c57dc02dd2ea08a7653880e7c4c05e5ad47edc44656c70e677518bdd708e0332f9ddd63be4d540d0c6805b8b96450cf858ef052b77937d441953690","ssdeep":"","tlshash":"a441ef07f3b49a3812ff366b183fa0486a482883d58b5451f47e15b4cdac23cb2a7da5","first_seen":"2023-05-22T11:49:21Z","last_seen":"2026-09-29T04:51:11.97616Z","times_seen":9,"resource_available":true,"data":null}},"time_used":265,"timings":{"blocked":48,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.chem17.com/asyncstat.aspx?u=yangyikeji\u0026referer=\u0026title=87365%u6700%u5FEB%u68C0%u6D4B%u4E2D%u5FC3%7C%u4E2D%u56FD%u6709%u9650%u516C%u53F8-%u5B98%u65B9%u7F51%u7AD9","fqdn":"www.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"163.181.131.243","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.840Z","timestamp":1790657410840,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /asyncstat.aspx?u=yangyikeji\u0026referer=\u0026title=87365%u6700%u5FEB%u68C0%u6D4B%u4E2D%u5FC3%7C%u4E2D%u56FD%u6709%u9650%u516C%u53F8-%u5B98%u65B9%u7F51%u7AD9 HTTP/1.1\r\nHost: www.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nCookie: acw_tc=9b66334617906574099415997e9cb215da397f7f6fd464e06e676a53ca; cdn_sec_tc=9b66334617906574099415997e9cb215da397f7f6fd464e06e676a53ca; mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ESA\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 548\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\ncache-control: no-cache\r\ndate: Tue, 29 Sep 2026 04:50:11 GMT\r\nexpires: -1\r\nset-cookie: ASP.NET_SessionId=zdc5tzpu1ili012c34w1qioj; path=/; HttpOnly; SameSite=Lax\nmtcached_mtsession_zdc5tzpu1ili012c34w1qioj=10.115.3.114:9715; domain=.chem17.com; path=/; HttpOnly\r\nvia: ens-cache2.l2eo166-17[40,0,DP], ens-cache28.l2hk12[73,0,DP], ens-cache18.l2sg9[111,0,DP], ens-cache15.de7[297,0,DP], ens-cache15.de7[298,0]\r\nx-site-cache-status: DYNAMIC\r\npragma: no-cache\r\nx-aspnet-version: 4.0.30319\r\nx-powered-by: ASP.NET-hg24\r\ncontent-security-policy: default-src * 'unsafe-inline' 'unsafe-eval' data: blob:;\r\ntiming-allow-origin: *\r\neagleid: 9b66334617906574108166230e\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"ASP.NET_SessionId","value":"zdc5tzpu1ili012c34w1qioj","quoted":false,"path":"/","secure":false,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"ASP.NET_SessionId=zdc5tzpu1ili012c34w1qioj; path=/; HttpOnly; SameSite=Lax"},{"name":"mtcached_mtsession_zdc5tzpu1ili012c34w1qioj","value":"10.115.3.114:9715","quoted":false,"path":"/","domain":".chem17.com","secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"mtcached_mtsession_zdc5tzpu1ili012c34w1qioj=10.115.3.114:9715; domain=.chem17.com; path=/; HttpOnly"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}],"data":{"size":548,"size_decoded":1379,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (514), with CRLF line terminators","md5":"31dfad76d536db290f47a06657db3fe9","sha1":"96095b4c492289f3fd6b905fe06780e8ecc94f36","sha256":"a0e608e2433f5a1e5a6ce995978d3d526cb8d1c20d189fa1760f4034cdb92177","sha512":"5caeb6a7f1fcd4f0084c197c7ff9d19742d509b14df80303510606e623f9ec6616b83bb3475c958b4b8b75f4f2df900dc8818fb0d14af137e03b3c46f020d0c1","ssdeep":"","tlshash":"7af08b674c01d2ea8805b8edde62e384c04b0f6b3152da72a267008032201bbb0acdcb","first_seen":"2026-09-29T04:51:11.977523Z","last_seen":"2026-09-29T04:51:11.977523Z","times_seen":1,"resource_available":true,"data":null}},"time_used":321,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":321,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/icon2.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.537Z","timestamp":1790657411537,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/icon2.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:14 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 3402301396363564405\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img60.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a17556864754f223514c620b0e20d903cf64571899d6401b6f3_280_280_5.png","fqdn":"img60.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.819Z","timestamp":1790657409819,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a17556864754f223514c620b0e20d903cf64571899d6401b6f3_280_280_5.png HTTP/1.1\r\nHost: img60.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img60.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a17556864754f223514c620b0e20d903cf64571899d6401b6f3_280_280_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":843,"timings":{"blocked":711,"dns":94,"connect":17,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/ys4.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.758Z","timestamp":1790657410758,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/ys4.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/banner3.jpg","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.581Z","timestamp":1790657411581,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/banner3.jpg HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:14 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 10460524739884761237\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/css/swiper.min.css","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.535Z","timestamp":1790657409535,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/css/swiper.min.css HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:29 GMT\r\nContent-Type: text/css;charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nX-Powered-By: PHP/5.4.41\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":17483,"size_decoded":3362,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (17459)","md5":"38e4982a90c5d5bdbdeffe240a2bfc19","sha1":"a03a3d806f0a0d77278dbd3cab61a8d1765c5878","sha256":"513d915b018f385bcca60beb2c167297dfb701bac48ef65274b3eb58460b4b67","sha512":"9696c4d5c02839aa27e1ab9512df2c01eea678655226c40c121ecf2844968461636bb49218b1c009c63106a7b6d1ee4cd3b4d25f38a8dfc31db418247519f013","ssdeep":"192:b+0GpaNCO8jrfg5WHmXgyXyzSHF68DJB0SwD:b+52CXfgWHfyXyzSl68Pe","tlshash":"6672822c17002067f6324f1987c9e77c9715c8839e4368ef6650de48cbba5a9227f7a6","first_seen":"2023-05-10T09:17:05Z","last_seen":"2026-10-11T09:36:10.775562Z","times_seen":390,"resource_available":true,"data":null}},"time_used":354,"timings":{"blocked":-1,"dns":0,"connect":144,"send":0,"wait":210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"img50.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a171ef84a2c4f1f1102da910c1db42eeca3bc18c14c969f9b57_280_280_5.png","fqdn":"img50.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.817Z","timestamp":1790657409817,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a171ef84a2c4f1f1102da910c1db42eeca3bc18c14c969f9b57_280_280_5.png HTTP/1.1\r\nHost: img50.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img50.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a171ef84a2c4f1f1102da910c1db42eeca3bc18c14c969f9b57_280_280_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":844,"timings":{"blocked":712,"dns":92,"connect":19,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/ys3.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.822Z","timestamp":1790657409822,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/ys3.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/ys3.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":1131,"timings":{"blocked":949,"dns":0,"connect":0,"send":0,"wait":182,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img76.chem17.com/gxhpic_4c8bb56aa0/3b96d8b43fb45b271403fb38ccbe080269a526f92780435fcf9868d2029ae449a136b5dbf3e1a856_340_340_5.png","fqdn":"img76.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.716Z","timestamp":1790657410716,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/3b96d8b43fb45b271403fb38ccbe080269a526f92780435fcf9868d2029ae449a136b5dbf3e1a856_340_340_5.png HTTP/1.1\r\nHost: img76.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:10 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/footico4.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.988Z","timestamp":1790657410988,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/footico4.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:31 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/footico4.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":910,"timings":{"blocked":750,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tp.xinxiyidiantong.com:5868/uploads/vinb9ufmfncf975y9rvx382nt7h7123khi4lo6kk.gif","fqdn":"tp.xinxiyidiantong.com","domain":"xinxiyidiantong.com","tld":"com"},"ip":{"addr":"27.124.44.50","port":5868,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.851Z","timestamp":1790657411851,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"tp.xinxiyidiantong.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 15 Sep 2026 08:22:00 GMT","end":"Mon, 14 Dec 2026 08:21:59 GMT"},"fingerprint":{"sha1":"F0:C4:3B:CB:7D:58:09:21:F7:9E:98:A7:26:FC:B7:1C:93:6D:B6:16","sha256":"D4:C1:67:34:92:14:60:F1:77:4C:A7:52:10:36:72:3D:42:CE:06:89:6B:78:C3:11:3A:E6:D0:13:4F:A6:D8:F3"}}},"request":{"raw":"GET /uploads/vinb9ufmfncf975y9rvx382nt7h7123khi4lo6kk.gif HTTP/1.1\r\nHost: tp.xinxiyidiantong.com:5868\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:12 GMT\r\nContent-Type: image/gif\r\nContent-Length: 214316\r\nLast-Modified: Thu, 14 Nov 2019 06:29:46 GMT\r\nConnection: keep-alive\r\nETag: \"5dccf45a-3452c\"\r\nExpires: Thu, 29 Oct 2026 04:50:12 GMT\r\nCache-Control: max-age=2592000\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":214316,"size_decoded":214624,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=3, software=Adobe Photoshop CC 2014 (Windows), datetime=2019-09-30T17:50:59+08:00], progressive, precision 8, 1020x255, components 3","md5":"8fbc123b4636b3c9a8f1411c160a9e99","sha1":"48f62c4c22122a04026a1e329bccce93fc7aae77","sha256":"69f497a64f8dab090cb547e5f9063b1c33d0d8fc87573f87eff1016fb2d4dad5","sha512":"821f26949d9b21304202d7cd0945a3351e3420ebba3d129b6111176978e3a5ba1e4135a963042eaa59be817cf02182f8761c7a0ba2fd9271c4b53304d69a3671","ssdeep":"6144:p5K6mEbeWe5b5/AT6dvesgRvyNlbc+6cKO90asTGIo5lj:u6tbeWe59oudvpg5yPblXKUIGlj","tlshash":"cb24130bfa57e081d29a4db4c077677cdc4f8b56aaa4563ae66c2c2cc7d05c3b0ad246","first_seen":"2023-05-06T09:40:17Z","last_seen":"2026-10-11T14:31:39.025178Z","times_seen":2271,"resource_available":false,"data":null}},"time_used":1626,"timings":{"blocked":-1,"dns":0,"connect":213,"send":0,"wait":435,"receive":548,"ssl":429},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"tp.xinxiyidiantong.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/footico2.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.891Z","timestamp":1790657411891,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/footico2.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:14 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 4168485766998438633\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/jquery.min.js","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.534Z","timestamp":1790657409534,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /jquery.min.js HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:29 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 718\r\nLast-Modified: Mon, 28 Sep 2026 02:57:04 GMT\r\nConnection: keep-alive\r\nETag: \"6ab9d780-2ce\"\r\nExpires: Tue, 29 Sep 2026 05:48:29 GMT\r\nCache-Control: max-age=3600\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":718,"size_decoded":1031,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (718), with no line terminators","md5":"a75ada17c3011458d74a0e4c5cc17ffa","sha1":"8e57d597b1caeb46af5a4578034187eda8bf8b26","sha256":"8056951f7605e0cc00e96769abe87124de09d74273e83efb7992dddc056390ce","sha512":"b56551f614e99478ac6a0e273fe4bb4b796c29e118732b903d11ec3dfc8368f0872386a3970dad897a0b5dceb21adb5557827c6dad66a642480a1f52c45fef4e","ssdeep":"","tlshash":"d30181d8c7c4d89baecc5e43ea24deca25b3813b97d832838318fe8c01ad157c89c049","first_seen":"2023-03-07T12:26:46Z","last_seen":"2026-10-11T11:29:56.968744Z","times_seen":214,"resource_available":true,"data":null}},"time_used":145,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":145,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/about_img.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.757Z","timestamp":1790657410757,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/about_img.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img56.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea60a8c93c95f5a608856ad530550efa81ba786ff56e7c5ed_340_340_5.png","fqdn":"img56.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.096Z","timestamp":1790657411096,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea60a8c93c95f5a608856ad530550efa81ba786ff56e7c5ed_340_340_5.png HTTP/1.1\r\nHost: img56.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:11 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/news_bt_bg.jpg","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.723Z","timestamp":1790657411723,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/news_bt_bg.jpg HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:14 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 16272964018003754491\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/ys4.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.823Z","timestamp":1790657409823,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/ys4.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/ys4.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":896,"timings":{"blocked":712,"dns":0,"connect":0,"send":0,"wait":184,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"img76.chem17.com/gxhpic_4c8bb56aa0/aa48a738dd6987648af2c5a5416f00ee996d0674794db0863e59ba91b1565fe28d5e33ab1f9665e8_280_280_5.jpg","fqdn":"img76.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.825Z","timestamp":1790657409825,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/aa48a738dd6987648af2c5a5416f00ee996d0674794db0863e59ba91b1565fe28d5e33ab1f9665e8_280_280_5.jpg HTTP/1.1\r\nHost: img76.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img76.chem17.com/gxhpic_4c8bb56aa0/aa48a738dd6987648af2c5a5416f00ee996d0674794db0863e59ba91b1565fe28d5e33ab1f9665e8_280_280_5.jpg\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":843,"timings":{"blocked":711,"dns":93,"connect":19,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/nav_bg.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.848Z","timestamp":1790657410848,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/nav_bg.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/nav_bg.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":306,"timings":{"blocked":121,"dns":0,"connect":0,"send":0,"wait":185,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img80.chem17.com/gxhpic_4c8bb56aa0/3b96d8b43fb45b271403fb38ccbe08022052807a68046b4fdf1dcab1cea25b7d897e051e68cd0bfb_280_280_5.png","fqdn":"img80.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.107Z","timestamp":1790657411107,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/3b96d8b43fb45b271403fb38ccbe08022052807a68046b4fdf1dcab1cea25b7d897e051e68cd0bfb_280_280_5.png HTTP/1.1\r\nHost: img80.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:11 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img49.chem17.com/gxhpic_4c8bb56aa0/62cb8b98dc5a045e41d52a77885feba732425d840e68bb89e021f880d41ef762e2588179cd3f8f83_340_340_5.png","fqdn":"img49.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.116Z","timestamp":1790657411116,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/62cb8b98dc5a045e41d52a77885feba732425d840e68bb89e021f880d41ef762e2588179cd3f8f83_340_340_5.png HTTP/1.1\r\nHost: img49.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:11 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/pro_bg.jpg","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.217Z","timestamp":1790657411217,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/pro_bg.jpg HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:13 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 1665906746105954765\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img60.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a17556864754f223514c620b0e20d903cf64571899d6401b6f3_340_340_5.png","fqdn":"img60.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.812Z","timestamp":1790657409812,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a17556864754f223514c620b0e20d903cf64571899d6401b6f3_340_340_5.png HTTP/1.1\r\nHost: img60.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img60.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a17556864754f223514c620b0e20d903cf64571899d6401b6f3_340_340_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":849,"timings":{"blocked":712,"dns":94,"connect":21,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/jiantou_r.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.898Z","timestamp":1790657410898,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/jiantou_r.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/jiantou_r.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":449,"timings":{"blocked":260,"dns":0,"connect":0,"send":0,"wait":189,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/logo.jpg","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.097Z","timestamp":1790657411097,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/logo.jpg HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img53.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ecd0ed31dbe9302d96f54048ff53053c1993ce7dd2bb00be4_280_280_5.png","fqdn":"img53.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.114Z","timestamp":1790657411114,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ecd0ed31dbe9302d96f54048ff53053c1993ce7dd2bb00be4_280_280_5.png HTTP/1.1\r\nHost: img53.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:11 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/banner1.jpg","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.673Z","timestamp":1790657411673,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/banner1.jpg HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:14 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 6191967983521687531\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/news_more.jpg","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.831Z","timestamp":1790657409831,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/news_more.jpg HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/news_more.jpg\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":901,"timings":{"blocked":712,"dns":0,"connect":0,"send":0,"wait":189,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"img63.chem17.com/gxhpic_4c8bb56aa0/d69c016c8587526cba49d565e10b5d40aa815be8efcb7eb077ed783e5cb77a2bf5483a542418eb84_340_340_5.png","fqdn":"img63.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.814Z","timestamp":1790657409814,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/d69c016c8587526cba49d565e10b5d40aa815be8efcb7eb077ed783e5cb77a2bf5483a542418eb84_340_340_5.png HTTP/1.1\r\nHost: img63.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img63.chem17.com/gxhpic_4c8bb56aa0/d69c016c8587526cba49d565e10b5d40aa815be8efcb7eb077ed783e5cb77a2bf5483a542418eb84_340_340_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":1095,"timings":{"blocked":711,"dns":346,"connect":17,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/fx.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.518Z","timestamp":1790657411518,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/fx.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:14 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 16810072856450273841\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/footico3.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.882Z","timestamp":1790657411882,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/footico3.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:14 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 705502559368547501\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"89tongji.com/tj.js?id=51","fqdn":"89tongji.com","domain":"89tongji.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:12.019Z","timestamp":1790657412019,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /tj.js?id=51 HTTP/1.1\r\nHost: 89tongji.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.langsunggas.com/","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-29T04:50:08.952Z","timestamp":1790657408952,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/js/JSChat.js","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.540Z","timestamp":1790657409540,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /js/JSChat.js HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:29 GMT\r\nContent-Type: application/javascript;charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nX-Powered-By: PHP/5.4.41\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1596,"size_decoded":860,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text","md5":"5122b87041a34991740a2418cf688de4","sha1":"ae0142e84d1e0f3c4749ea58827ae56d2a32fbbc","sha256":"40061d6dc948529ad974ca45b9b63d65ff87037086f65629d1e958cb1de10ccd","sha512":"a96700940fd242137764811caa4748780c79b6925f05ad2b31238126ee24d24ab70c05f0c72de11fde17efd99247a5b3225dbdc708249c59f9b047d5e435a481","ssdeep":"","tlshash":"de31edb24a53931209094ea3c71a134ce267915b9117e8623d3d6d643f88927b7997f0","first_seen":"2025-04-06T23:54:49.048059Z","last_seen":"2026-10-11T12:37:33.472237Z","times_seen":867,"resource_available":true,"data":null}},"time_used":354,"timings":{"blocked":-1,"dns":0,"connect":164,"send":0,"wait":192,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img61.chem17.com/gxhpic_4c8bb56aa0/463345e347026bed25ffe065c9b3635f8fe40ffd4b76ef8da1d68c88db78bb6a49f1c8d117db11e1_280_280_5.png","fqdn":"img61.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.726Z","timestamp":1790657410726,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/463345e347026bed25ffe065c9b3635f8fe40ffd4b76ef8da1d68c88db78bb6a49f1c8d117db11e1_280_280_5.png HTTP/1.1\r\nHost: img61.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:10 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img60.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a17556864754f223514c620b0e20d903cf64571899d6401b6f3_340_340_5.png","fqdn":"img60.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.736Z","timestamp":1790657410736,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a17556864754f223514c620b0e20d903cf64571899d6401b6f3_340_340_5.png HTTP/1.1\r\nHost: img60.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:10 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img72.chem17.com/gxhpic_4c8bb56aa0/5f8c4cffcfd3c26a1ee7a860f46297dd471924a25a4685ca8511d4a354d15a32d2c2139ad09d80a0_280_280_5.jpg","fqdn":"img72.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.113Z","timestamp":1790657411113,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/5f8c4cffcfd3c26a1ee7a860f46297dd471924a25a4685ca8511d4a354d15a32d2c2139ad09d80a0_280_280_5.jpg HTTP/1.1\r\nHost: img72.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:11 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img78.chem17.com/gxhpic_4c8bb56aa0/24e8f035994b740ae629a26b2906486954e085b25d66c078a708caa1888e71756b1156fbb48b18b9_340_340_5.jpg","fqdn":"img78.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.806Z","timestamp":1790657409806,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/24e8f035994b740ae629a26b2906486954e085b25d66c078a708caa1888e71756b1156fbb48b18b9_340_340_5.jpg HTTP/1.1\r\nHost: img78.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img78.chem17.com/gxhpic_4c8bb56aa0/24e8f035994b740ae629a26b2906486954e085b25d66c078a708caa1888e71756b1156fbb48b18b9_340_340_5.jpg\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":843,"timings":{"blocked":712,"dns":93,"connect":17,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img47.chem17.com/gxhpic_4c8bb56aa0/a10e47f466ff8fb57d4238b8e5df530690a2cb8c40e01bba6324ee9c60bb6c6f4752131ca7fb3b78_280_280_5.png","fqdn":"img47.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.826Z","timestamp":1790657409826,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/a10e47f466ff8fb57d4238b8e5df530690a2cb8c40e01bba6324ee9c60bb6c6f4752131ca7fb3b78_280_280_5.png HTTP/1.1\r\nHost: img47.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img47.chem17.com/gxhpic_4c8bb56aa0/a10e47f466ff8fb57d4238b8e5df530690a2cb8c40e01bba6324ee9c60bb6c6f4752131ca7fb3b78_280_280_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":1096,"timings":{"blocked":710,"dns":345,"connect":19,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img76.chem17.com/2/20220317/637831242169256980475_170_170_5.jpg","fqdn":"img76.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.834Z","timestamp":1790657409834,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /2/20220317/637831242169256980475_170_170_5.jpg HTTP/1.1\r\nHost: img76.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img76.chem17.com/2/20220317/637831242169256980475_170_170_5.jpg\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":841,"timings":{"blocked":710,"dns":93,"connect":17,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fcl.xueyuxingfeng.com:6987/067/ade/sj.js","fqdn":"fcl.xueyuxingfeng.com","domain":"xueyuxingfeng.com","tld":"com"},"ip":{"addr":"27.124.44.6","port":6987,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.844Z","timestamp":1790657409844,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"fcl.xueyuxingfeng.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 15:56:13 GMT","end":"Fri, 11 Dec 2026 15:56:12 GMT"},"fingerprint":{"sha1":"24:5E:17:56:29:E5:C1:F7:1A:83:64:E8:0B:F3:C8:B6:6A:CA:4C:AE","sha256":"16:51:B2:44:1D:0B:9E:B6:78:57:9A:F5:B3:0B:9F:E6:FB:65:CC:E4:04:07:79:72:13:1F:AA:17:29:74:1F:3F"}}},"request":{"raw":"GET /067/ade/sj.js HTTP/1.1\r\nHost: fcl.xueyuxingfeng.com:6987\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Fri, 13 Dec 2024 04:59:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"675bbf19-d26\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3366,"size_decoded":1805,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text","md5":"fa19716607c7d8137d9cfbe623dba7cb","sha1":"e46242940c345610d692c2b1ce8fe9c1152aa46c","sha256":"cc9193fc7e8e2722b308b5de9881b0442e21363e33b296824381d574816bae16","sha512":"391ff0cdc99fdcfb81af8a0a72425b9e178309d74d5ec96642dbfc1fdd98be8529260af73ac6896dd45266adde8cfcfa96083e4c94a10ef1a3e593de0915d60b","ssdeep":"","tlshash":"4b611f54ef8d20338e133155ae6f958c24be68577d48eca7f84c64d44fa0d38852beac","first_seen":"2024-12-18T10:35:23.532443Z","last_seen":"2026-10-11T11:29:56.953338Z","times_seen":340,"resource_available":true,"data":null}},"time_used":955,"timings":{"blocked":-1,"dns":18,"connect":232,"send":0,"wait":238,"receive":0,"ssl":467},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"fcl.xueyuxingfeng.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img76.chem17.com/2/20220317/637831242169256980475_170_170_5.jpg","fqdn":"img76.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.710Z","timestamp":1790657410710,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /2/20220317/637831242169256980475_170_170_5.jpg HTTP/1.1\r\nHost: img76.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:10 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/title_ico.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.751Z","timestamp":1790657410751,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/title_ico.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"collect-v6.51.la/v6/collect?dt=4","fqdn":"collect-v6.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"43.159.107.113","port":80,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:12.172Z","timestamp":1790657412172,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /v6/collect?dt=4 HTTP/1.1\r\nHost: collect-v6.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 315\r\nOrigin: http://www.langsunggas.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":460,"data":"\u001f‹\b\u0000„C»j\u0000\u0003]P±NÃ0\u0014ü•*#í؎Ý\u0015‰\u0015ø€Ä‰\u0003j›TMÒ\f€T\t1 \u0006`ATtc,°!•¡êϐTü\u0005}n»tòéÞùÞÝ»r.#§ÓrN²#\u0015Ë3cŽ½\u003e6D:‡-gX¬'ÄWXpŸ\u0011J\u0004_“\u0005Žô=Á›é¸^Κ÷qóýð;ÿ¬—·×ð¼-šéýß䩾û¨\u001fç¨þzm^~V‹çÕl\u0002®Ý\n\f\u0000Eù\u000eå›\u0010Ô\u0004ŠK‘b\"F\\(†T\u0018kÄ0õx,ƒ(Ä\näº\u0004õEQ\f:®[UU»\u0017¤I^¦I\u0012ämõ]\u0010\r¬Èöè\u0001\"Tâ\u0003‚)\u0003\n\u003e\u0000\u0019§èüÔZÚZeÚM³Ê\u0026\u001aA\"\u0002“x\u0007€¡\f†ö\b\u0018*\f· \u001cåz«+7e°Q^ %Aœ³\u0010qÆ\r’F\u000bDx((\u0016¾\u0011LÀ¦ÒìŸYÞü\u0003R\u0018r\u0010–\u0001\u0000\u0000"}},"response":{"raw":"HTTP/1.1 210 Unknown Status\r\nVary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nAccess-Control-Allow-Origin: http://www.langsunggas.com\r\nAccess-Control-Allow-Credentials: true\r\nServer: TencentEdgeOne\r\nContent-Length: 0\r\nConnection: keep-alive\r\nDate: Tue, 29 Sep 2026 04:50:12 GMT\r\nEO-LOG-UUID: 507776807766450681\r\nEO-Cache-Status: MISS\r\n\r\n","headers":null,"cookies":null,"status_code":"210","status_text":"","fingerprints":[{"name":"EdgeOne","description":"EdgeOne is an edge-service platform that delivers global content distribution, network acceleration, and integrated security protections for distributed applications.","website":"https://edgeone.ai","common_platform_enumeration":"","icon":"EdgeOne.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":1084,"mime_type":"text/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":298,"timings":{"blocked":0,"dns":0,"connect":19,"send":0,"wait":278,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"langsunggas.com/","fqdn":"langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-29T04:50:08.459Z","timestamp":1790657408459,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"img80.chem17.com/gxhpic_4c8bb56aa0/24e8f035994b740a942d1928a0cd65076d3324154a680e8f286facf35ffffde06762b11daad905c0_280_280_5.png","fqdn":"img80.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.824Z","timestamp":1790657409824,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/24e8f035994b740a942d1928a0cd65076d3324154a680e8f286facf35ffffde06762b11daad905c0_280_280_5.png HTTP/1.1\r\nHost: img80.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img80.chem17.com/gxhpic_4c8bb56aa0/24e8f035994b740a942d1928a0cd65076d3324154a680e8f286facf35ffffde06762b11daad905c0_280_280_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":1096,"timings":{"blocked":712,"dns":344,"connect":19,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img75.chem17.com/gxhpic_4c8bb56aa0/5f8c4cffcfd3c26a1ee7a860f46297ddc0ea95c593d9b87c584223cbbabf136d19813cfefb4dc14d_280_280_5.jpg","fqdn":"img75.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.828Z","timestamp":1790657409828,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/5f8c4cffcfd3c26a1ee7a860f46297ddc0ea95c593d9b87c584223cbbabf136d19813cfefb4dc14d_280_280_5.jpg HTTP/1.1\r\nHost: img75.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img75.chem17.com/gxhpic_4c8bb56aa0/5f8c4cffcfd3c26a1ee7a860f46297ddc0ea95c593d9b87c584223cbbabf136d19813cfefb4dc14d_280_280_5.jpg\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":844,"timings":{"blocked":712,"dns":92,"connect":19,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.xinxiyidiantong.com:5868/uploads/iwv840mvscz87ws4p3324p7k2i4yuh.gif","fqdn":"tp.xinxiyidiantong.com","domain":"xinxiyidiantong.com","tld":"com"},"ip":{"addr":"27.124.44.50","port":5868,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.853Z","timestamp":1790657411853,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"tp.xinxiyidiantong.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 15 Sep 2026 08:22:00 GMT","end":"Mon, 14 Dec 2026 08:21:59 GMT"},"fingerprint":{"sha1":"F0:C4:3B:CB:7D:58:09:21:F7:9E:98:A7:26:FC:B7:1C:93:6D:B6:16","sha256":"D4:C1:67:34:92:14:60:F1:77:4C:A7:52:10:36:72:3D:42:CE:06:89:6B:78:C3:11:3A:E6:D0:13:4F:A6:D8:F3"}}},"request":{"raw":"GET /uploads/iwv840mvscz87ws4p3324p7k2i4yuh.gif HTTP/1.1\r\nHost: tp.xinxiyidiantong.com:5868\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:13 GMT\r\nContent-Type: image/gif\r\nContent-Length: 156427\r\nLast-Modified: Thu, 04 Nov 2021 19:43:48 GMT\r\nConnection: keep-alive\r\nETag: \"618437f4-2630b\"\r\nExpires: Thu, 29 Oct 2026 04:50:13 GMT\r\nCache-Control: max-age=2592000\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":156427,"size_decoded":156735,"mime_type":"image/png","magic":"PNG image data, 1000 x 47, 8-bit/color RGBA, non-interlaced","md5":"0dc662bab3fb9dd17ae6f777eae62a0d","sha1":"084f96c8fe5f280844b43235d6137626b11eabf8","sha256":"1d551f0660ef7472997f772901485f85cabf9370b1ea54334dc09ad4f08301e9","sha512":"2a3341c10473717959d703be8c56ba3fa6b5979d020e162c81ef9a02c6559e4ecf5302c14261722c37d7370d05ea95cfd20191e5e92e02c25ddbd37af23f29eb","ssdeep":"3072:lHavYLzuBktXdAkB+aAXW/xMqbirMklbd0dOmvw+swTFT9orAMI:dawLzdckBWWZQrMYbd0/w+XTpbMI","tlshash":"0be31296a119c02856fe25d2145e18394a8d2064ffb30e6ee43cf8fdc1ba5a71fa0d99","first_seen":"2023-05-06T09:40:17Z","last_seen":"2026-10-11T14:31:38.998918Z","times_seen":2495,"resource_available":false,"data":null}},"time_used":1711,"timings":{"blocked":1268,"dns":0,"connect":0,"send":0,"wait":214,"receive":229,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"tp.xinxiyidiantong.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"43.159.107.113","port":80,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:12.018Z","timestamp":1790657412018,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /js-sdk-pro.min.js HTTP/1.1\r\nHost: sdk.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Sat, 10 Jun 2023 08:47:40 GMT\r\nContent-Encoding: gzip\r\nEtag: W/\"648438ac-861a\"\r\nServer: openresty\r\nContent-Type: application/javascript; charset=utf-8\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Credentials: true\r\nCache-Control: max-age=1296000\r\nContent-Length: 12853\r\nAccept-Ranges: bytes\r\nConnection: keep-alive\r\nDate: Tue, 29 Sep 2026 04:50:12 GMT\r\nEO-LOG-UUID: 814601093865930579\r\nEO-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":34330,"size_decoded":13304,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (34109)","md5":"8fc0b01d35300e8398d6e957987c01e7","sha1":"f1eb32c75b8d8e4b0555ebc2a5f5d1d60296f41e","sha256":"b164aafa0bb83dfe511912ca2ca475880bfffac8d8f098c947fd3d4af440d3a4","sha512":"fab84d067e724d45f35821d8f37c0cd4f608af2975de48a61b905dba89189ca8778b04b4d507e6417a4187193a3da2d0a8939c02bf2d39adb9733cffd2358401","ssdeep":"768:Xzz9qAO+a/y1jaKUiQU5enEU9GMXB0XXQVEXB3CNSPf:Xzz9qnT/c+KUc5enEU9GMXB/EXB3LPf","tlshash":"55f22d9577c0717cc3c782e9361b401ae1a69e810099a8acf345f594bd74e66a33ffa8","first_seen":"2023-04-05T07:31:50Z","last_seen":"2026-10-10T22:03:35.779038Z","times_seen":10954,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":19,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.chem17.com/mystat.aspx?u=yangyikeji","fqdn":"www.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"163.181.131.243","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.776Z","timestamp":1790657409776,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /mystat.aspx?u=yangyikeji HTTP/1.1\r\nHost: www.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ESA\r\ncontent-type: text/html; charset=utf-8\r\nset-cookie: acw_tc=9b66334617906574099415997e9cb215da397f7f6fd464e06e676a53ca;path=/;HttpOnly;Max-Age=3600\ncdn_sec_tc=9b66334617906574099415997e9cb215da397f7f6fd464e06e676a53ca;path=/;HttpOnly;Max-Age=3600\nASP.NET_SessionId=na3tqov34hl1rehmzjoctrww; path=/; HttpOnly; SameSite=Lax\nmtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720; domain=.chem17.com; path=/; HttpOnly\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\ncache-control: no-cache\r\ncontent-encoding: gzip\r\ndate: Tue, 29 Sep 2026 04:50:10 GMT\r\nexpires: -1\r\nvary: Accept-Encoding\r\nvia: ens-cache74.l2eo166-17[37,0,DP], ens-cache26.l2hk12[73,0,DP], ens-cache5.l2sg9[111,0,DP], ens-cache15.de7[282,0,DP], ens-cache15.de7[286,0]\r\nx-site-cache-status: DYNAMIC\r\npragma: no-cache\r\nx-aspnet-version: 4.0.30319\r\nx-powered-by: ASP.NET-hg4.22\r\ncontent-security-policy: default-src * 'unsafe-inline' 'unsafe-eval' data: blob:;\r\ntiming-allow-origin: *\r\neagleid: 9b66334617906574099415997e\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"acw_tc","value":"9b66334617906574099415997e9cb215da397f7f6fd464e06e676a53ca","quoted":false,"path":"/","max_age":3600,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"acw_tc=9b66334617906574099415997e9cb215da397f7f6fd464e06e676a53ca;path=/;HttpOnly;Max-Age=3600"},{"name":"cdn_sec_tc","value":"9b66334617906574099415997e9cb215da397f7f6fd464e06e676a53ca","quoted":false,"path":"/","max_age":3600,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"cdn_sec_tc=9b66334617906574099415997e9cb215da397f7f6fd464e06e676a53ca;path=/;HttpOnly;Max-Age=3600"},{"name":"ASP.NET_SessionId","value":"na3tqov34hl1rehmzjoctrww","quoted":false,"path":"/","secure":false,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"ASP.NET_SessionId=na3tqov34hl1rehmzjoctrww; path=/; HttpOnly; SameSite=Lax"},{"name":"mtcached_mtsession_na3tqov34hl1rehmzjoctrww","value":"10.115.3.112:9720","quoted":false,"path":"/","domain":".chem17.com","secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720; domain=.chem17.com; path=/; HttpOnly"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}],"data":{"size":1361,"size_decoded":1666,"mime_type":"text/html; charset=utf-8","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"101d58b4c03a7e7e4cd64412afe83634","sha1":"91dd40195a72cc48cfa70702278bcf815742ffd3","sha256":"f2f861fa295abfe57e32d8aa6250b5940cac190a6ab77aebe1a1e1e7b741da1c","sha512":"0679067dcad3002ef9fba58d8eb894de4b35fb5aa3f66544f62b42e083b5935806d1cb5761b906d45aab479416461065dbfec954721da63a4486c28498780b95","ssdeep":"","tlshash":"ea214d541d06c0a4bc39713d89b7c13cd2b11a273865d73678cca9088f78fa525deeea","first_seen":"2026-09-29T04:51:11.984025Z","last_seen":"2026-09-29T04:51:11.984025Z","times_seen":1,"resource_available":true,"data":null}},"time_used":498,"timings":{"blocked":-1,"dns":143,"connect":20,"send":0,"wait":309,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img52.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea4a3c41fd171b40e6d40c5ab089124fcb4305f3f294bfc6c_280_280_5.png","fqdn":"img52.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.815Z","timestamp":1790657409815,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea4a3c41fd171b40e6d40c5ab089124fcb4305f3f294bfc6c_280_280_5.png HTTP/1.1\r\nHost: img52.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img52.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea4a3c41fd171b40e6d40c5ab089124fcb4305f3f294bfc6c_280_280_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":848,"timings":{"blocked":713,"dns":91,"connect":21,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/nav_line.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.850Z","timestamp":1790657410850,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/nav_line.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/nav_line.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":352,"timings":{"blocked":192,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/footico4.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.902Z","timestamp":1790657411902,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/footico4.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:15 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 1844278658737637649\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img53.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ecd0ed31dbe9302d96f54048ff53053c1993ce7dd2bb00be4_340_340_5.png","fqdn":"img53.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.810Z","timestamp":1790657409810,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ecd0ed31dbe9302d96f54048ff53053c1993ce7dd2bb00be4_340_340_5.png HTTP/1.1\r\nHost: img53.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img53.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ecd0ed31dbe9302d96f54048ff53053c1993ce7dd2bb00be4_340_340_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":1097,"timings":{"blocked":712,"dns":345,"connect":19,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img45.chem17.com/gxhpic_4c8bb56aa0/10569a3e6f9b134c174d3668d905454924a8c00e2413b2cbc7ae4e585646006b850dbc8e442951aa_340_340_5.png","fqdn":"img45.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.732Z","timestamp":1790657410732,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/10569a3e6f9b134c174d3668d905454924a8c00e2413b2cbc7ae4e585646006b850dbc8e442951aa_340_340_5.png HTTP/1.1\r\nHost: img45.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:10 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img76.chem17.com/gxhpic_4c8bb56aa0/3b96d8b43fb45b271403fb38ccbe080269a526f92780435fcf9868d2029ae449a136b5dbf3e1a856_280_280_5.png","fqdn":"img76.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.733Z","timestamp":1790657410733,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/3b96d8b43fb45b271403fb38ccbe080269a526f92780435fcf9868d2029ae449a136b5dbf3e1a856_280_280_5.png HTTP/1.1\r\nHost: img76.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:10 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/banner5.jpg","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.851Z","timestamp":1790657410851,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/banner5.jpg HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/banner5.jpg\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":259,"timings":{"blocked":80,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/fx.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.989Z","timestamp":1790657410989,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/fx.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/fx.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":525,"timings":{"blocked":347,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/mulu3.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.566Z","timestamp":1790657411566,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/mulu3.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:14 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 4132500576176353134\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img53.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ecd0ed31dbe9302d96f54048ff53053c1993ce7dd2bb00be4_280_280_5.png","fqdn":"img53.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.816Z","timestamp":1790657409816,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ecd0ed31dbe9302d96f54048ff53053c1993ce7dd2bb00be4_280_280_5.png HTTP/1.1\r\nHost: img53.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img53.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ecd0ed31dbe9302d96f54048ff53053c1993ce7dd2bb00be4_280_280_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":1098,"timings":{"blocked":712,"dns":345,"connect":19,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img57.chem17.com/gxhpic_4c8bb56aa0/25880edbb8a6ac95e13c8d2ac7e8fa910d9b2b95e8be822f99125b1ff209196763eb530ef19ffa33_340_340_5.png","fqdn":"img57.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.686Z","timestamp":1790657410686,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/25880edbb8a6ac95e13c8d2ac7e8fa910d9b2b95e8be822f99125b1ff209196763eb530ef19ffa33_340_340_5.png HTTP/1.1\r\nHost: img57.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:11 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/pro_hover.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.916Z","timestamp":1790657410916,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/pro_hover.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/pro_hover.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":466,"timings":{"blocked":296,"dns":0,"connect":0,"send":0,"wait":170,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img47.chem17.com/gxhpic_4c8bb56aa0/a10e47f466ff8fb57d4238b8e5df530690a2cb8c40e01bba6324ee9c60bb6c6f4752131ca7fb3b78_280_280_5.png","fqdn":"img47.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.117Z","timestamp":1790657411117,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/a10e47f466ff8fb57d4238b8e5df530690a2cb8c40e01bba6324ee9c60bb6c6f4752131ca7fb3b78_280_280_5.png HTTP/1.1\r\nHost: img47.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:11 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/ys3.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.121Z","timestamp":1790657411121,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/ys3.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/more.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.712Z","timestamp":1790657411712,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/more.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:14 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 13551425470800425274\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hzyangyi.cn/skins/274521/images/news_ico.png","fqdn":"www.hzyangyi.cn","domain":"hzyangyi.cn","tld":"cn"},"ip":{"addr":"1.56.98.184","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.743Z","timestamp":1790657411743,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hzyangyi.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 02:11:38 GMT","end":"Mon, 19 Oct 2026 02:11:37 GMT"},"fingerprint":{"sha1":"C5:68:60:CA:2B:44:61:11:9E:42:24:AE:1A:F4:37:3D:8C:C9:E9:C3","sha256":"89:2D:D4:24:14:49:F1:9F:2E:06:C8:5C:DB:93:68:59:55:78:31:20:50:B6:DA:FB:3D:FE:5E:C3:B7:51:CD:29"}}},"request":{"raw":"GET /skins/274521/images/news_ico.png HTTP/1.1\r\nHost: www.hzyangyi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:50:14 GMT\r\nContent-Type: text/html\r\nAge: 0\r\nContent-Length: 146\r\nX-NWS-LOG-UUID: 17244839739214588997\r\nConnection: keep-alive\r\nX-Cache-Lookup: Cache Miss, Cache Miss\r\nStrict-Transport-Security: max-age=31536000;includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/footico2.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.983Z","timestamp":1790657410983,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/footico2.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:31 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/footico2.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":899,"timings":{"blocked":720,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/nav_bg1.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.849Z","timestamp":1790657410849,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/nav_bg1.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/nav_bg1.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":310,"timings":{"blocked":128,"dns":0,"connect":0,"send":0,"wait":182,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"img80.chem17.com/gxhpic_4c8bb56aa0/3b96d8b43fb45b271403fb38ccbe08022052807a68046b4fdf1dcab1cea25b7d897e051e68cd0bfb_280_280_5.png","fqdn":"img80.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.829Z","timestamp":1790657409829,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/3b96d8b43fb45b271403fb38ccbe08022052807a68046b4fdf1dcab1cea25b7d897e051e68cd0bfb_280_280_5.png HTTP/1.1\r\nHost: img80.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img80.chem17.com/gxhpic_4c8bb56aa0/3b96d8b43fb45b271403fb38ccbe08022052807a68046b4fdf1dcab1cea25b7d897e051e68cd0bfb_280_280_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":1096,"timings":{"blocked":711,"dns":344,"connect":19,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img72.chem17.com/gxhpic_4c8bb56aa0/5f8c4cffcfd3c26a1ee7a860f46297dd471924a25a4685ca8511d4a354d15a32d2c2139ad09d80a0_280_280_5.jpg","fqdn":"img72.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.820Z","timestamp":1790657409820,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/5f8c4cffcfd3c26a1ee7a860f46297dd471924a25a4685ca8511d4a354d15a32d2c2139ad09d80a0_280_280_5.jpg HTTP/1.1\r\nHost: img72.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img72.chem17.com/gxhpic_4c8bb56aa0/5f8c4cffcfd3c26a1ee7a860f46297dd471924a25a4685ca8511d4a354d15a32d2c2139ad09d80a0_280_280_5.jpg\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":1097,"timings":{"blocked":711,"dns":345,"connect":19,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img56.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea60a8c93c95f5a608856ad530550efa81ba786ff56e7c5ed_280_280_5.png","fqdn":"img56.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.828Z","timestamp":1790657409828,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea60a8c93c95f5a608856ad530550efa81ba786ff56e7c5ed_280_280_5.png HTTP/1.1\r\nHost: img56.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img56.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0ea60a8c93c95f5a608856ad530550efa81ba786ff56e7c5ed_280_280_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":976,"timings":{"blocked":936,"dns":5,"connect":17,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img50.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a171ef84a2c4f1f1102da910c1db42eeca3bc18c14c969f9b57_280_280_5.png","fqdn":"img50.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.728Z","timestamp":1790657410728,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a171ef84a2c4f1f1102da910c1db42eeca3bc18c14c969f9b57_280_280_5.png HTTP/1.1\r\nHost: img50.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:11 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img58.chem17.com/gxhpic_4c8bb56aa0/6ac6407af06454921e30a86636d0d8e1b1a11cc5d41f90f237444a547877e59c4bb5e7e281817c20_340_340_5.jpg","fqdn":"img58.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.118Z","timestamp":1790657411118,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/6ac6407af06454921e30a86636d0d8e1b1a11cc5d41f90f237444a547877e59c4bb5e7e281817c20_340_340_5.jpg HTTP/1.1\r\nHost: img58.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:11 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/banner3.jpg","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.852Z","timestamp":1790657410852,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/banner3.jpg HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:31 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/banner3.jpg\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":721,"timings":{"blocked":545,"dns":0,"connect":0,"send":0,"wait":176,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/mulu1.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.895Z","timestamp":1790657410895,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/mulu1.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/mulu1.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":435,"timings":{"blocked":255,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/js/qq.js","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.787Z","timestamp":1790657409787,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/js/qq.js HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:29 GMT\r\nContent-Type: application/javascript;charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nX-Powered-By: PHP/5.4.41\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1694,"size_decoded":859,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"b165bcd3f323ed7df6d36630f5d7aeab","sha1":"b90d52cfe33d1f2935a4fafc0d5db25d4eeddb0a","sha256":"0ede023b10cadd81266e82f0ef09e13d926e4f26eebeb4639dcee41326d4fc41","sha512":"61e4d22373ca062b479f153a0b873ff6d6204438b18c9e65ba4e979fb20f1672d4ebbc1ccc97e88cabae5dd902fea7427eaa0d41527109af2199f5981cfee63f","ssdeep":"","tlshash":"3531acd8f78e152150f5b27d993fd7cd313e2023b853a857ac6d88b808b867b1625d98","first_seen":"2023-05-22T11:49:21Z","last_seen":"2026-09-29T04:51:11.985398Z","times_seen":16,"resource_available":true,"data":null}},"time_used":184,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":184,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"img41.chem17.com/gxhpic_4c8bb56aa0/e896eca9769be1d4027ef2358ca1b957816f3dc81aedb83737db7896d3a537524edeaa0bc442b7f5_340_340_5.png","fqdn":"img41.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.804Z","timestamp":1790657409804,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/e896eca9769be1d4027ef2358ca1b957816f3dc81aedb83737db7896d3a537524edeaa0bc442b7f5_340_340_5.png HTTP/1.1\r\nHost: img41.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img41.chem17.com/gxhpic_4c8bb56aa0/e896eca9769be1d4027ef2358ca1b957816f3dc81aedb83737db7896d3a537524edeaa0bc442b7f5_340_340_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":890,"timings":{"blocked":713,"dns":137,"connect":19,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img58.chem17.com/gxhpic_4c8bb56aa0/6ac6407af06454921e30a86636d0d8e1b1a11cc5d41f90f237444a547877e59c4bb5e7e281817c20_340_340_5.jpg","fqdn":"img58.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.805Z","timestamp":1790657409805,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/6ac6407af06454921e30a86636d0d8e1b1a11cc5d41f90f237444a547877e59c4bb5e7e281817c20_340_340_5.jpg HTTP/1.1\r\nHost: img58.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img58.chem17.com/gxhpic_4c8bb56aa0/6ac6407af06454921e30a86636d0d8e1b1a11cc5d41f90f237444a547877e59c4bb5e7e281817c20_340_340_5.jpg\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":1100,"timings":{"blocked":712,"dns":346,"connect":21,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img59.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0e49952decbf04fde14fa6d630f50d8aa40caff494d6230ed8_340_340_5.png","fqdn":"img59.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.811Z","timestamp":1790657409811,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0e49952decbf04fde14fa6d630f50d8aa40caff494d6230ed8_340_340_5.png HTTP/1.1\r\nHost: img59.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img59.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5b27a7e06f4e59d0e49952decbf04fde14fa6d630f50d8aa40caff494d6230ed8_340_340_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":1096,"timings":{"blocked":713,"dns":344,"connect":17,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img58.chem17.com/3/20260923/639257807753621649631.jpg","fqdn":"img58.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.832Z","timestamp":1790657409832,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /3/20260923/639257807753621649631.jpg HTTP/1.1\r\nHost: img58.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img58.chem17.com/3/20260923/639257807753621649631.jpg\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"image/webp","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":1096,"timings":{"blocked":709,"dns":346,"connect":19,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/mulu_tlt.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.894Z","timestamp":1790657410894,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/mulu_tlt.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/mulu_tlt.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":392,"timings":{"blocked":214,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img60.chem17.com/gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a17556864754f223514c620b0e20d903cf64571899d6401b6f3_280_280_5.png","fqdn":"img60.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.720Z","timestamp":1790657410720,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/12eb4942705bfae5abe30e1ce1042a17556864754f223514c620b0e20d903cf64571899d6401b6f3_280_280_5.png HTTP/1.1\r\nHost: img60.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:10 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"img49.chem17.com/gxhpic_4c8bb56aa0/62cb8b98dc5a045e41d52a77885feba732425d840e68bb89e021f880d41ef762e2588179cd3f8f83_340_340_5.png","fqdn":"img49.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.802Z","timestamp":1790657409802,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gxhpic_4c8bb56aa0/62cb8b98dc5a045e41d52a77885feba732425d840e68bb89e021f880d41ef762e2588179cd3f8f83_340_340_5.png HTTP/1.1\r\nHost: img49.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nContent-Type: text/html; charset=utf-8\r\nLocation: https://img49.chem17.com/gxhpic_4c8bb56aa0/62cb8b98dc5a045e41d52a77885feba732425d840e68bb89e021f880d41ef762e2588179cd3f8f83_340_340_5.png\r\nDate: Tue, 29 Sep 2026 04:50:10 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":1100,"timings":{"blocked":714,"dns":345,"connect":19,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/ys2.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.821Z","timestamp":1790657409821,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/ys2.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:30 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/ys2.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":1049,"timings":{"blocked":889,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/index_cache.html","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:09.835Z","timestamp":1790657409835,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /index_cache.html HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img75.chem17.com/gxhpic_4c8bb56aa0/5f8c4cffcfd3c26a1ee7a860f46297ddc0ea95c593d9b87c584223cbbabf136d19813cfefb4dc14d_280_280_5.jpg","fqdn":"img75.chem17.com","domain":"chem17.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:10.730Z","timestamp":1790657410730,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.chem17.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Fri, 30 Jan 2026 03:48:59 GMT","end":"Mon, 01 Mar 2027 03:48:58 GMT"},"fingerprint":{"sha1":"BC:1B:56:74:1F:D2:AD:8C:7B:18:74:39:16:F7:F9:FA:A4:04:D2:1B","sha256":"38:26:45:68:08:DD:6E:E5:CF:E0:F2:F5:57:2B:D9:F4:CE:AB:A9:2C:1C:DF:60:78:A7:38:7F:7A:44:1A:9C:79"}}},"request":{"raw":"GET /gxhpic_4c8bb56aa0/5f8c4cffcfd3c26a1ee7a860f46297ddc0ea95c593d9b87c584223cbbabf136d19813cfefb4dc14d_280_280_5.jpg HTTP/1.1\r\nHost: img75.chem17.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.langsunggas.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: mtcached_mtsession_na3tqov34hl1rehmzjoctrww=10.115.3.112:9720\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html\r\ndate: Tue, 29 Sep 2026 04:50:10 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-cache: BYPASS, Status: 403\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.langsunggas.com/skins/274521/images/mulu3.png","fqdn":"www.langsunggas.com","domain":"langsunggas.com","tld":"com"},"ip":{"addr":"23.231.42.6","port":80,"asn":62904,"as":"AS62904","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:11.137Z","timestamp":1790657411137,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /skins/274521/images/mulu3.png HTTP/1.1\r\nHost: www.langsunggas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/skins/274521/css/style.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Tue, 29 Sep 2026 04:48:31 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.4.41\r\nLocation: https://www.hzyangyi.cn/skins/274521/images/mulu3.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"PHP:5.4.41","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":423,"timings":{"blocked":257,"dns":0,"connect":0,"send":0,"wait":166,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-29","alert":"Phishing Block","trigger":"www.langsunggas.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"www.langsunggas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"collect-v6.51.la/v6/collect?dt=4","fqdn":"collect-v6.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"43.159.107.113","port":80,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.langsunggas.com/","date":"2026-09-29T04:50:12.085Z","timestamp":1790657412085,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /v6/collect?dt=4 HTTP/1.1\r\nHost: collect-v6.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 319\r\nOrigin: http://www.langsunggas.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.langsunggas.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":472,"data":"\u001f‹\b\u0000„C»j\u0000\u0003]P½NÃ0\u0018|•*#­í:±Ý\u0007\u0000‰\r!\u00166'vSÔ4©š¸\u0011R%Ā\u0018€\u0005Qэ±À†T†ª/CRñ\u0016ôKÛ¥“O÷¿ïsí´jÎQÄÎ.˜8è\u001d_vlx˜8û5g­\u0026„K친\u0011Š9[‘\u0019ŽàMÏ-'£b1-ßGå÷Ãïì³XÜ^Ãó6/'÷ã§âî£xœ¡âëµ|ùYΟ—Ó1líæ°\u0000N·(]›P\\6‡\tr)£È•D!Á\\ŠÚ‚J-}Å…Ö \u000f,¨;YÖo5\u001ayž×#\u0015‡©ÃP¥õ é5@Ô¯DUŽ\b\u0010¡\u0002ï\u0011L\u0019Pð\u0001H\u0013£Ó“je\u0015ËÆÝ8É+GCpD`b¶\u0000\u0018\n\u001d¤U\t\u0018\"\f6À\u000eÓ`£³ë0Æ\u0017˜5ƒ\u0000\u0019Î\rr\rñ‘âT#O+êcƒ¥P\u0012.ÙönÍòæ\u001fv-¬Ž–\u0001\u0000\u0000"}},"response":{"raw":"HTTP/1.1 210 Unknown Status\r\nVary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nAccess-Control-Allow-Origin: http://www.langsunggas.com\r\nAccess-Control-Allow-Credentials: true\r\nServer: TencentEdgeOne\r\nContent-Length: 0\r\nConnection: keep-alive\r\nDate: Tue, 29 Sep 2026 04:50:12 GMT\r\nEO-LOG-UUID: 18117717119148834272\r\nEO-Cache-Status: MISS\r\n\r\n","headers":null,"cookies":null,"status_code":"210","status_text":"","fingerprints":[{"name":"EdgeOne","description":"EdgeOne is an edge-service platform that delivers global content distribution, network acceleration, and integrated security protections for distributed applications.","website":"https://edgeone.ai","common_platform_enumeration":"","icon":"EdgeOne.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":1090,"mime_type":"text/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T15:43:35.306156Z","times_seen":19031085,"resource_available":true,"data":null}},"time_used":284,"timings":{"blocked":0,"dns":3,"connect":19,"send":0,"wait":262,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}