{"report_id":"a6da6eb8-64c8-48c0-9e90-7b52ba710e1a","version":0,"status":"done","tags":[],"date":"2026-08-22T18:30:56Z","url":{"schema":"http","addr":"824246.lol/","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":0,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"57z0uk.584644.com/?key=diversion","fqdn":"57z0uk.584644.com","domain":"584644.com","tld":"com"},"title":"线路检测","dom":{"size":92769,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (54106)","md5":"673f453040cb9a98c11fe9a49117b1b2","sha1":"b246ab9fc1fd4992966350775074283f0fecd7c2","sha256":"1688d1adcae946624e1d908b383972f7cbe071b78e48766d60e3888350aaeebb","sha512":"6b79f75327afb7adaad69ad68d06304f802807fc81a08a0b2b3e7fa28d8c4e2ab878f10c62352f7ec4912518391d10e3927f3e590dcf550826d4237f782149f0","ssdeep":"1536:I4r7ZCfLm7pHqP2KLCeEP8vJf3dP50+cvG4XgKzkL9fBTXbZVsDipR0qSiXUYDky:ZZC6wCHPklXc4KzkL95eipdU2ktIRsHK","tlshash":"7593e7c4b5d529c20d298576a6ef1b5f216602ff890b9c4936bc130e6f3c9f28f9990d","dom_hash":"domhashd81273caa3b2c304142647095bd966f3","first_seen":"2026-08-22T18:31:06.663893Z","last_seen":"2026-08-22T18:31:06.663893Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"824246.lol/","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":0,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-26T18:30:56Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"824246.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"jsonbfq21.hzlgxs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"mstatic21.hzlgxs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"mstatic21.hzlgxs.com","ip":{"addr":"154.23.238.14","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-07-15","domain_rank":0,"first_seen":"2026-03-29T04:11:27.367414Z","last_seen":"2026-05-09T06:55:00.385464Z","alert_count":1,"request_count":1,"received_data":82572,"sent_data":596,"comment":"","tags":null,"fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]},{"fqdn":"57z0uk.584644.com","ip":{"addr":"166.117.59.163","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":2,"received_data":93503,"sent_data":1060,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"824246.lol","ip":{"addr":"207.57.107.15","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2026-06-22","domain_rank":0,"first_seen":"2026-08-22T18:30:56.722056Z","last_seen":"2026-08-22T18:30:56.722056Z","alert_count":9,"request_count":9,"received_data":187906,"sent_data":3927,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"crypto-js","description":"crypto-js is a JavaScript library of crypto standards.","website":"https://github.com/brix/crypto-js","common_platform_enumeration":"","icon":"default.svg","categories":["JavaScript libraries"]}]},{"fqdn":"jsonbfq21.hzlgxs.com","ip":{"addr":"154.23.238.16","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-07-15","domain_rank":0,"first_seen":"2026-05-09T06:54:58.10914Z","last_seen":"2026-06-13T01:06:28.581597Z","alert_count":1,"request_count":1,"received_data":3478,"sent_data":609,"comment":"","tags":null,"fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"824246.lol/js/qrcode.min.js","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"517b55d3688ce9ef1085a3d9632bcb97","sha1":"2d06c1f823f34c19981c6ae0b0eb0f5861c5e14b","sha256":"c541ef06327885a8415bca8df6071e14189b4855336def4f36db54bde8484f36","sha512":"08d80845e706a3b9e985b799d3849cd7791ad3ba5aa9d793bb4591d4833890d7299810144874905f416c94d8530da74be0ee520066a91ade05a1da8bf0ccb498","ssdeep":"384:WRQ2kvcAAdTRhQLThP2yO9/9G84U5xOiKQYHHHsglDep9m1yfB8dKLMyA+LyUyy9:xThP2V/9N4U/gQYPXa8CAPLyrZ","tlshash":"8c92c7e4f36542f6915e6cd4283f104b64a0a4636c1490acbfb5c1e6a9f8fe0647af74","size":19927,"data":"","first_seen":"2023-03-07T01:14:56Z","last_seen":"2026-08-22T20:29:00.255762Z","times_seen":66707,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"824246.lol/js/crypto-js.min.js","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2ca03ad87885ab983541092b87adb299","sha1":"1a17f60bf776a8c468a185c1e8e985c41a50dc27","sha256":"8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762","sha512":"13c412bd66747822c6938926de1c52b0d98659b2ed48249471ec0340f416645ea9114f06953f1ae5f177db03a5d62f1fb5d321b2c4eb17f3a1c865b0a274dc5c","ssdeep":"768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS","tlshash":"19231ac5a19c605152a774c40d7f704b7463352a070d8aacf668e9eeecfcaea9039d7c","size":48316,"data":"","first_seen":"2023-03-07T01:31:53Z","last_seen":"2026-08-22T18:56:04.905562Z","times_seen":153778,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"824246.lol/js/aes.min.js","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"ce3b52ddc7392c9313a3f7b1c9ba4ca9","sha1":"a78160730d3aa94ac4255874eed67fd351ae41e6","sha256":"3993db466045330cb9979b2b5c4dfdf250b9eb0033e7afc0d5130d52cae679c8","sha512":"e1bd737de3ae242cbc07fb2e08c18d70490c710910fbf8d0e8794921a6151af83667274fbdda7b198d02b9155b3694b135516ac1302696cd9fb4a4a40c8f6fb4","ssdeep":"","tlshash":"bc4141ebeeac90f2597a0d9c1c7fd8b32521fa11261ac91dc351b2ed418a8efc18553d","size":2389,"data":"","first_seen":"2023-03-07T23:13:46Z","last_seen":"2026-08-22T18:31:06.675714Z","times_seen":70,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"824246.lol/js/enc-utf8.min.js","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b51e5945c7a56f1ce4a8b176e52d5840","sha1":"0260ecad3e8ae5ef1b9b12832f9d74473cec0a7e","sha256":"d7508e492e66dfd8a8a6b2ef5309624dbd8889ee7c74f8bdaf64177ead978000","sha512":"5ed8c2a8657fbe779de6be639e75491247d37443588ae6c4fa527ad342c16f0be6fae5334a50c10456bf3b8989976389e0657aa737ea07120e4fe4fb52862bd0","ssdeep":"","tlshash":"8fd0220b3860ba8162630120022f9c0fb4b2cc730088080127948aeaaea054f0ba3aaa","size":195,"data":"","first_seen":"2024-06-29T21:31:21Z","last_seen":"2026-08-22T18:31:06.665503Z","times_seen":20,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"824246.lol/js/cdnAuth.js","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"89aaa8d8cd4df11e8855ea59e13b7d95","sha1":"83e8fd817d5d7e1658750266914f21acf1c58068","sha256":"f4289030ae3d7f2938d887bd81f6d6fc69b56c573cc50adcddf34dfb3e4d9d9b","sha512":"590ba3eb506a712175c1c7a1743594433741a90170e4332389694ff92457a8d23deac7d5137ed12bfb953b2e19deb7fcaf7515c12c13f4370a6c981499a7ed33","ssdeep":"","tlshash":"8a3154c53ea27411a613753046dee57d6032ea010099de51b50ccd052facd6f737abec","size":1458,"data":"","first_seen":"2026-07-08T12:19:54.33749Z","last_seen":"2026-08-22T18:31:06.666238Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"824246.lol/config.js","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"d6cac085f9ef6da0b60d7133a183d329","sha1":"9abd56527c1e4440c96e3df78fe6398cef6559ef","sha256":"6cc2f1ab9e771d6513e5c6f14a13c7f10dd0b2423ae774d64e978d4a0bfe2891","sha512":"0ad53a1ea46ec9097e694e1b29c3b438b058fe4e5a72e311e1c9470a0856482dfdbc0c2075028189931ba11dd9b7fd8fcb8863b65d6f072d0fb7217d02bfe7e8","ssdeep":"","tlshash":"d9e026af88c0145982a462ead30e3704bd478f58099b10458236d0047bae7730a2aaf0","size":338,"data":"","first_seen":"2026-08-22T18:31:06.667793Z","last_seen":"2026-08-22T18:31:06.667793Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"824246.lol/","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"47866de32ecd9448d303ada338fdfeb1","sha1":"7a135f921aee9cdc3dfb19bd52c9c4469103c3bd","sha256":"96ca77cb57e62dba0b73219078d465da1bfdcfeea3e1fedfccd081a7699a6210","sha512":"805559631015e920d83c13427733c628557e9c5ee8e6a806bfa7310f77e7f1563fc948399654c5673afa1b77d8175ad87b46396f4b8db9661105cf58be82aaa0","ssdeep":"192:PoD4mpXBqLlDaCDkUflkrqCB/mH8l9Xe0ZfV6YKmUmrye:wDklhkUWrq89lZRUYKmUA","tlshash":"2a121e993de36525069bb06d6b5fb0046134d823254dce09fa4d47400fa2eadb2b6bde","size":9431,"data":"","first_seen":"2026-07-08T12:19:54.463125Z","last_seen":"2026-08-22T18:31:06.686265Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"57z0uk.584644.com/?key=diversion","fqdn":"57z0uk.584644.com","domain":"584644.com","tld":"com"},"ip":{"addr":"166.117.59.163","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"41f94b7e71a8dd89a962ce396f86710e","sha1":"74bb77b41dd77ce8164c911311f36dfd37b29afd","sha256":"cc9472b78145bfb088048b11c503132f7e11876cb69b6653cb592c38104d1ba1","sha512":"e4c1c7e570e3139af0028f3603dd5569181e383106e7d58738e902386f8e6a39fa62a86eafcb8a9c8e7035b8803cc352cd86fb6ee26163eada4f517054b14535","ssdeep":"1536:x7ZCfLm7pHqP2KLCeEP8vJf3dP50+cvG4XgKzkL9fBTXbZVsDipR0qSiXUYDkbRT:FZC6wCHPklXc4KzkL95eipdU2ktIRi","tlshash":"396396c4b5d42dc30d288a77a1ee1b9f217a06fd595b5c9a42b4134f623caf28f9d80d","size":71259,"data":"","first_seen":"2026-08-22T18:31:06.686985Z","last_seen":"2026-08-22T18:31:06.686985Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"57z0uk.584644.com/?key=diversion","fqdn":"57z0uk.584644.com","domain":"584644.com","tld":"com"},"ip":{"addr":"166.117.59.163","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"fc37a1f22d0180610c057e08f67fc753","sha1":"9621135172d01587a6945841d5b0fa65bf16ef57","sha256":"02162b9ef460c12710959cb2134abe474341b732eae7039421c68f44e45016df","sha512":"bd1af9cefaede1ec39c48767c5330aa102e9dac05a0c82cf55a91dadd1dceb3303dad8fcdb5cb55023156acdb6f476d24981ed483646f5287017f6cb056739ab","ssdeep":"192:Bl3IJPTPxHERHX01aT5GOoisxDjo3VyxMtitnwqVhFpV1wyD:iPrE3D5AVqiVVJ","tlshash":"6222946b68e7207005e3747edb9fa10877368103090ee9007d1d9341afd5a1a8bbafed","size":10023,"data":"","first_seen":"2026-07-25T00:52:33.374151Z","last_seen":"2026-08-22T18:31:06.688282Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"824246.lol/js/jquery.min.js","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"04169da38e42b7f704e72fce3a957e33","sha1":"a8c8a5caf9765b4ccb90d708045518e219a9af5d","sha256":"1f0a1183d9ed40fa1e0cf8a29a6b3eca8c288a6f5c36e16813550c4f8b938636","sha512":"6107abece49faac96618b06c8d9b62be3577a533af39dc3a3d5b69c985c4ad19120d60b517d6ae02800fd428b48caa12cccc24131ce10dba4d720acba5aeda41","ssdeep":"1536:s6IzxETpavYSGaW4snuHEk/yosnSFngC/VEEG0vd0KO4emAp2LSEMBoviR+I1z58:O+vIklosn/BLXjxzMhsSd","tlshash":"f493f8ed73c6717243ab30ae40af610ef1365869280d8410f129e8f9bc79a499277f7d","size":93637,"data":"","first_seen":"2023-03-10T04:37:42Z","last_seen":"2026-08-22T18:31:06.685622Z","times_seen":85,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"824246.lol/localConfig.js","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e60a765bb7f287b0a548d3d6d7c00d6f","sha1":"760eb943332e717c4e9dda1bd8dc50392b5ec95e","sha256":"025500577a67ef5d004c862d920f5156f0dcc9c0d366b33d58c2765e3cbc91b3","sha512":"0bdd29bb12656bb51d04c75e4fd728c16a152048e7c8aaa440eebb0039d1f49c5db1ed69653cf03d963820da5421b928622df95e9e8a6023ec3b3ebaacf91f48","ssdeep":"","tlshash":"c1f046bd945482c30ee88b88b1e27446a84c4e0b2bb93618438b4c8003eeb13f1b61de","size":530,"data":"","first_seen":"2025-11-29T08:43:22.112915Z","last_seen":"2026-08-22T18:31:06.668972Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"map[actor:server1.conn0.watcher17.process7//obj31 class:Object extensible:true frozen:false isError:false ownPropertyLength:26 preview:map[kind:Object ownProperties:map[createDept:map[configurable:true enumerable:true value:map[type:null] writable:true] createTime:map[configurable:true enumerable:true value:2024-10-31 00:22:29 writable:true] createUser:map[configurable:true enumerable:true value:map[type:null] writable:true] id:map[configurable:true enumerable:true value:1851660955770757122 writable:true] isDeleted:map[configurable:true enumerable:true value:0 writable:true] status:map[configurable:true enumerable:true value:1 writable:true] tenantId:map[configurable:true enumerable:true value:1 writable:true] updateTime:map[configurable:true enumerable:true value:2026-08-21 10:11:16 writable:true] updateUser:map[configurable:true enumerable:true value:1834452975386099713 writable:true] webSiteId:map[configurable:true enumerable:true value:4 writable:true]] ownPropertiesLength:26] sealed:false type:object]","filename":"https://824246.lol/","line_number":368,"column_number":37},{"level":"log","text":"map[actor:server1.conn0.watcher17.process7//obj32 class:Object extensible:true frozen:false isError:false ownPropertyLength:2 preview:map[kind:Object ownProperties:map[jumpDomain:map[configurable:true enumerable:true value:https://*.584644.com writable:true] num:map[configurable:true enumerable:true value:0 writable:true]] ownPropertiesLength:2] sealed:false type:object]","filename":"https://824246.lol/","line_number":496,"column_number":17}]},"http":[{"url":{"schema":"https","addr":"824246.lol/js/enc-utf8.min.js","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://824246.lol/","date":"2026-08-22T18:30:27.710Z","timestamp":1787423427710,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"983622.lol","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 17:41:50 GMT","end":"Wed, 07 Oct 2026 17:41:49 GMT"},"fingerprint":{"sha1":"C5:B0:C8:A6:4D:10:37:08:56:CA:1A:68:7A:91:EB:7C:C0:18:70:27","sha256":"8A:D0:A0:54:37:29:B5:D3:79:28:6F:7D:76:A3:F3:F6:78:84:BF:43:C0:5C:40:16:4D:98:E5:3B:55:7B:D8:DE"}}},"request":{"raw":"GET /js/enc-utf8.min.js HTTP/1.1\r\nHost: 824246.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://824246.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-origin: *\r\ncontent-type: application/javascript\r\ndate: Sat, 22 Aug 2026 17:16:09 GMT\r\netag: \"6a6f16f8-c3\"\r\nexpires: Sat, 22 Aug 2026 19:16:09 GMT\r\nlast-modified: Sat, 22 Aug 2026 17:16:09 GMT\r\nserver: openresty\r\nx-cache: HIT, policy, disk\r\ncontent-length: 195\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":195,"size_decoded":698,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with no line terminators","md5":"b51e5945c7a56f1ce4a8b176e52d5840","sha1":"0260ecad3e8ae5ef1b9b12832f9d74473cec0a7e","sha256":"d7508e492e66dfd8a8a6b2ef5309624dbd8889ee7c74f8bdaf64177ead978000","sha512":"5ed8c2a8657fbe779de6be639e75491247d37443588ae6c4fa527ad342c16f0be6fae5334a50c10456bf3b8989976389e0657aa737ea07120e4fe4fb52862bd0","ssdeep":"","tlshash":"8fd0220b3860ba8162630120022f9c0fb4b2cc730088080127948aeaaea054f0ba3aaa","first_seen":"2024-06-29T21:31:21Z","last_seen":"2026-08-22T18:31:06.665503Z","times_seen":20,"resource_available":true,"data":null}},"time_used":601,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":601,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"824246.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"824246.lol/js/cdnAuth.js","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://824246.lol/","date":"2026-08-22T18:30:27.711Z","timestamp":1787423427711,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"983622.lol","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 17:41:50 GMT","end":"Wed, 07 Oct 2026 17:41:49 GMT"},"fingerprint":{"sha1":"C5:B0:C8:A6:4D:10:37:08:56:CA:1A:68:7A:91:EB:7C:C0:18:70:27","sha256":"8A:D0:A0:54:37:29:B5:D3:79:28:6F:7D:76:A3:F3:F6:78:84:BF:43:C0:5C:40:16:4D:98:E5:3B:55:7B:D8:DE"}}},"request":{"raw":"GET /js/cdnAuth.js HTTP/1.1\r\nHost: 824246.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://824246.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 22 Aug 2026 17:16:09 GMT\r\netag: W/\"6a6f16f7-5b2\"\r\nexpires: Sat, 22 Aug 2026 19:16:09 GMT\r\nlast-modified: Sat, 22 Aug 2026 17:16:09 GMT\r\nserver: openresty\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 771\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1458,"size_decoded":1302,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"89aaa8d8cd4df11e8855ea59e13b7d95","sha1":"83e8fd817d5d7e1658750266914f21acf1c58068","sha256":"f4289030ae3d7f2938d887bd81f6d6fc69b56c573cc50adcddf34dfb3e4d9d9b","sha512":"590ba3eb506a712175c1c7a1743594433741a90170e4332389694ff92457a8d23deac7d5137ed12bfb953b2e19deb7fcaf7515c12c13f4370a6c981499a7ed33","ssdeep":"","tlshash":"8a3154c53ea27411a613753046dee57d6032ea010099de51b50ccd052facd6f737abec","first_seen":"2026-07-08T12:19:54.33749Z","last_seen":"2026-08-22T18:31:06.666238Z","times_seen":3,"resource_available":true,"data":null}},"time_used":600,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":600,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"824246.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"824246.lol/config.js","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://824246.lol/","date":"2026-08-22T18:30:27.713Z","timestamp":1787423427713,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"983622.lol","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 17:41:50 GMT","end":"Wed, 07 Oct 2026 17:41:49 GMT"},"fingerprint":{"sha1":"C5:B0:C8:A6:4D:10:37:08:56:CA:1A:68:7A:91:EB:7C:C0:18:70:27","sha256":"8A:D0:A0:54:37:29:B5:D3:79:28:6F:7D:76:A3:F3:F6:78:84:BF:43:C0:5C:40:16:4D:98:E5:3B:55:7B:D8:DE"}}},"request":{"raw":"GET /config.js HTTP/1.1\r\nHost: 824246.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://824246.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-type: application/javascript\r\ndate: Sat, 22 Aug 2026 17:13:58 GMT\r\netag: \"6a7dd1b3-152\"\r\nexpires: Sat, 22 Aug 2026 19:13:58 GMT\r\nlast-modified: Sat, 22 Aug 2026 17:13:58 GMT\r\nserver: openresty\r\nx-cache: HIT, policy, disk\r\ncontent-length: 338\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":338,"size_decoded":646,"mime_type":"application/javascript","magic":"ASCII text","md5":"d6cac085f9ef6da0b60d7133a183d329","sha1":"9abd56527c1e4440c96e3df78fe6398cef6559ef","sha256":"6cc2f1ab9e771d6513e5c6f14a13c7f10dd0b2423ae774d64e978d4a0bfe2891","sha512":"0ad53a1ea46ec9097e694e1b29c3b438b058fe4e5a72e311e1c9470a0856482dfdbc0c2075028189931ba11dd9b7fd8fcb8863b65d6f072d0fb7217d02bfe7e8","ssdeep":"","tlshash":"d9e026af88c0145982a462ead30e3704bd478f58099b10458236d0047bae7730a2aaf0","first_seen":"2026-08-22T18:31:06.667793Z","last_seen":"2026-08-22T18:31:06.667793Z","times_seen":1,"resource_available":true,"data":null}},"time_used":598,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":598,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"824246.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"824246.lol/localConfig.js","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://824246.lol/","date":"2026-08-22T18:30:27.714Z","timestamp":1787423427714,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"983622.lol","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 17:41:50 GMT","end":"Wed, 07 Oct 2026 17:41:49 GMT"},"fingerprint":{"sha1":"C5:B0:C8:A6:4D:10:37:08:56:CA:1A:68:7A:91:EB:7C:C0:18:70:27","sha256":"8A:D0:A0:54:37:29:B5:D3:79:28:6F:7D:76:A3:F3:F6:78:84:BF:43:C0:5C:40:16:4D:98:E5:3B:55:7B:D8:DE"}}},"request":{"raw":"GET /localConfig.js HTTP/1.1\r\nHost: 824246.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://824246.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-origin: *\r\ncontent-type: application/javascript\r\ndate: Sat, 22 Aug 2026 17:16:09 GMT\r\netag: \"6a6f16f7-212\"\r\nexpires: Sat, 22 Aug 2026 19:16:09 GMT\r\nlast-modified: Sat, 22 Aug 2026 17:16:09 GMT\r\nserver: openresty\r\nx-cache: HIT, policy, disk\r\ncontent-length: 530\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":530,"size_decoded":1034,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text","md5":"e60a765bb7f287b0a548d3d6d7c00d6f","sha1":"760eb943332e717c4e9dda1bd8dc50392b5ec95e","sha256":"025500577a67ef5d004c862d920f5156f0dcc9c0d366b33d58c2765e3cbc91b3","sha512":"0bdd29bb12656bb51d04c75e4fd728c16a152048e7c8aaa440eebb0039d1f49c5db1ed69653cf03d963820da5421b928622df95e9e8a6023ec3b3ebaacf91f48","ssdeep":"","tlshash":"c1f046bd945482c30ee88b88b1e27446a84c4e0b2bb93618438b4c8003eeb13f1b61de","first_seen":"2025-11-29T08:43:22.112915Z","last_seen":"2026-08-22T18:31:06.668972Z","times_seen":2,"resource_available":true,"data":null}},"time_used":597,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":597,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"824246.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"824246.lol/","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-22T18:30:25.983Z","timestamp":1787423425983,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"983622.lol","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 17:41:50 GMT","end":"Wed, 07 Oct 2026 17:41:49 GMT"},"fingerprint":{"sha1":"C5:B0:C8:A6:4D:10:37:08:56:CA:1A:68:7A:91:EB:7C:C0:18:70:27","sha256":"8A:D0:A0:54:37:29:B5:D3:79:28:6F:7D:76:A3:F3:F6:78:84:BF:43:C0:5C:40:16:4D:98:E5:3B:55:7B:D8:DE"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 824246.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\ncontent-type: text/html\r\ndate: Sat, 22 Aug 2026 18:13:51 GMT\r\netag: W/\"6a75e909-4142\"\r\nexpires: Sat, 22 Aug 2026 19:13:51 GMT\r\nlast-modified: Sat, 22 Aug 2026 18:13:51 GMT\r\nserver: openresty\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"crypto-js","description":"crypto-js is a JavaScript library of crypto standards.","website":"https://github.com/brix/crypto-js","common_platform_enumeration":"","icon":"default.svg","categories":["JavaScript libraries"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16706,"size_decoded":5568,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"3929feda7ce0d9e9a00aa397ee4353ae","sha1":"b591d274c0d7ac5a605e105bb138a7344416d4e5","sha256":"f47a177628d63bd2b5d4002b52a6d701faffece9152bc3b46f4f8d2cd797ccee","sha512":"227d5b933cfd3e46a101595d11db73102507717fb5e599510ac5fb45f9691e6945c30450d9b82568ff6d59d7dbc9010fbb347f0f760cf6a3394887dddb138451","ssdeep":"384:6PiGFnXHO/rrFDklhkUWrq89lZRUYKmUj:6PiGFnXHO/rrFYhkPPg","tlshash":"e772745a6df364466587e07c2bbbb2043174d403914dcd1dbb8d93908f82ee8a9b6bcc","first_seen":"2026-08-22T18:31:06.670132Z","last_seen":"2026-08-22T18:31:06.670132Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1344,"timings":{"blocked":-1,"dns":125,"connect":302,"send":0,"wait":303,"receive":0,"ssl":613},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"824246.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"824246.lol/js/crypto-js.min.js","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://824246.lol/","date":"2026-08-22T18:30:27.707Z","timestamp":1787423427707,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"983622.lol","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 17:41:50 GMT","end":"Wed, 07 Oct 2026 17:41:49 GMT"},"fingerprint":{"sha1":"C5:B0:C8:A6:4D:10:37:08:56:CA:1A:68:7A:91:EB:7C:C0:18:70:27","sha256":"8A:D0:A0:54:37:29:B5:D3:79:28:6F:7D:76:A3:F3:F6:78:84:BF:43:C0:5C:40:16:4D:98:E5:3B:55:7B:D8:DE"}}},"request":{"raw":"GET /js/crypto-js.min.js HTTP/1.1\r\nHost: 824246.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://824246.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 22 Aug 2026 17:16:09 GMT\r\netag: W/\"6a6f16f8-bcbc\"\r\nexpires: Sat, 22 Aug 2026 19:16:09 GMT\r\nlast-modified: Sat, 22 Aug 2026 17:16:09 GMT\r\nserver: openresty\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":48316,"size_decoded":18844,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (48316), with no line terminators","md5":"2ca03ad87885ab983541092b87adb299","sha1":"1a17f60bf776a8c468a185c1e8e985c41a50dc27","sha256":"8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762","sha512":"13c412bd66747822c6938926de1c52b0d98659b2ed48249471ec0340f416645ea9114f06953f1ae5f177db03a5d62f1fb5d321b2c4eb17f3a1c865b0a274dc5c","ssdeep":"768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS","tlshash":"19231ac5a19c605152a774c40d7f704b7463352a070d8aacf668e9eeecfcaea9039d7c","first_seen":"2023-03-07T01:31:53Z","last_seen":"2026-08-22T18:56:04.905562Z","times_seen":153778,"resource_available":true,"data":null}},"time_used":603,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":603,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"824246.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"824246.lol/js/aes.min.js","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://824246.lol/","date":"2026-08-22T18:30:27.709Z","timestamp":1787423427709,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"983622.lol","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 17:41:50 GMT","end":"Wed, 07 Oct 2026 17:41:49 GMT"},"fingerprint":{"sha1":"C5:B0:C8:A6:4D:10:37:08:56:CA:1A:68:7A:91:EB:7C:C0:18:70:27","sha256":"8A:D0:A0:54:37:29:B5:D3:79:28:6F:7D:76:A3:F3:F6:78:84:BF:43:C0:5C:40:16:4D:98:E5:3B:55:7B:D8:DE"}}},"request":{"raw":"GET /js/aes.min.js HTTP/1.1\r\nHost: 824246.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://824246.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 22 Aug 2026 17:16:09 GMT\r\netag: W/\"6a6f16f8-955\"\r\nexpires: Sat, 22 Aug 2026 19:16:09 GMT\r\nlast-modified: Sat, 22 Aug 2026 17:16:09 GMT\r\nserver: openresty\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 1120\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2389,"size_decoded":1652,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2389), with no line terminators","md5":"ce3b52ddc7392c9313a3f7b1c9ba4ca9","sha1":"a78160730d3aa94ac4255874eed67fd351ae41e6","sha256":"3993db466045330cb9979b2b5c4dfdf250b9eb0033e7afc0d5130d52cae679c8","sha512":"e1bd737de3ae242cbc07fb2e08c18d70490c710910fbf8d0e8794921a6151af83667274fbdda7b198d02b9155b3694b135516ac1302696cd9fb4a4a40c8f6fb4","ssdeep":"","tlshash":"bc4141ebeeac90f2597a0d9c1c7fd8b32521fa11261ac91dc351b2ed418a8efc18553d","first_seen":"2023-03-07T23:13:46Z","last_seen":"2026-08-22T18:31:06.675714Z","times_seen":70,"resource_available":true,"data":null}},"time_used":602,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":602,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"824246.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"824246.lol/js/qrcode.min.js","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://824246.lol/","date":"2026-08-22T18:30:27.706Z","timestamp":1787423427706,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"983622.lol","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 17:41:50 GMT","end":"Wed, 07 Oct 2026 17:41:49 GMT"},"fingerprint":{"sha1":"C5:B0:C8:A6:4D:10:37:08:56:CA:1A:68:7A:91:EB:7C:C0:18:70:27","sha256":"8A:D0:A0:54:37:29:B5:D3:79:28:6F:7D:76:A3:F3:F6:78:84:BF:43:C0:5C:40:16:4D:98:E5:3B:55:7B:D8:DE"}}},"request":{"raw":"GET /js/qrcode.min.js HTTP/1.1\r\nHost: 824246.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://824246.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 22 Aug 2026 17:16:09 GMT\r\netag: W/\"6a6f16f8-4dd7\"\r\nexpires: Sat, 22 Aug 2026 19:16:09 GMT\r\nlast-modified: Sat, 22 Aug 2026 17:16:09 GMT\r\nserver: openresty\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19927,"size_decoded":8234,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (19927), with no line terminators","md5":"517b55d3688ce9ef1085a3d9632bcb97","sha1":"2d06c1f823f34c19981c6ae0b0eb0f5861c5e14b","sha256":"c541ef06327885a8415bca8df6071e14189b4855336def4f36db54bde8484f36","sha512":"08d80845e706a3b9e985b799d3849cd7791ad3ba5aa9d793bb4591d4833890d7299810144874905f416c94d8530da74be0ee520066a91ade05a1da8bf0ccb498","ssdeep":"384:WRQ2kvcAAdTRhQLThP2yO9/9G84U5xOiKQYHHHsglDep9m1yfB8dKLMyA+LyUyy9:xThP2V/9N4U/gQYPXa8CAPLyrZ","tlshash":"8c92c7e4f36542f6915e6cd4283f104b64a0a4636c1490acbfb5c1e6a9f8fe0647af74","first_seen":"2023-03-07T01:14:56Z","last_seen":"2026-08-22T20:29:00.255762Z","times_seen":66707,"resource_available":true,"data":null}},"time_used":604,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":604,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"824246.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"jsonbfq21.hzlgxs.com/oss/pages/nav/1/4/1/result.json?auth_key_sigh=1787423428-58d730acdca9426fb87cc46c64a76fc1-0-4cc9d2952343620b3607a1da172719c57c48e7e1a81a8022b222a79837acd979","fqdn":"jsonbfq21.hzlgxs.com","domain":"hzlgxs.com","tld":"com"},"ip":{"addr":"154.23.238.16","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://824246.lol/","date":"2026-08-22T18:30:28.382Z","timestamp":1787423428382,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hzlgxs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Jul 2026 09:28:06 GMT","end":"Fri, 09 Oct 2026 09:28:05 GMT"},"fingerprint":{"sha1":"75:A0:C2:1A:6A:81:A3:C3:CB:D5:0A:ED:D7:8F:0E:15:45:21:2C:3D","sha256":"47:A3:DE:9E:10:07:C4:BC:0B:FA:AC:CE:F3:C7:B7:FA:4E:56:22:A0:8F:2D:15:E4:F4:07:9B:19:38:7E:5B:AB"}}},"request":{"raw":"GET /oss/pages/nav/1/4/1/result.json?auth_key_sigh=1787423428-58d730acdca9426fb87cc46c64a76fc1-0-4cc9d2952343620b3607a1da172719c57c48e7e1a81a8022b222a79837acd979 HTTP/1.1\r\nHost: jsonbfq21.hzlgxs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://824246.lol/\r\nOrigin: https://824246.lol\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 68\r\ncontent-disposition: inline\r\ncontent-type: application/json; charset=utf-8\r\ndate: Sat, 22 Aug 2026 18:29:21 GMT\r\netag: \"201c0a077c15b96238fd62ba587c30c2\"\r\nlast-modified: Sat, 22 Aug 2026 18:29:21 GMT\r\nserver: BFQ-GW-3\r\nvary: Accept-Encoding\r\nw-a-3: w-a-3\r\nw-a-3-hits: skipped\r\nx-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nx-amz-replication-status: COMPLETED\r\nx-amz-request-id: 18CE3413BAC33C9A\r\nx-amz-version-id: 63b2b0be-7aa5-4dcf-bb69-92b02e1b3041\r\nx-cache: HIT, policy, disk\r\nx-content-type-options: nosniff\r\nx-customize-tag: 1.1\r\nx-ratelimit-limit: 50000\r\nx-ratelimit-remaining: 50000\r\nx-xss-protection: 1; mode=block\r\ncontent-length: 2702\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":2702,"size_decoded":3478,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"201c0a077c15b96238fd62ba587c30c2","sha1":"8e179fb2ab873967c860dbb88f8af24f212d2c8a","sha256":"ea632a8e4648894b22dac8b2cea3deea9b685e714293a895c56631c971405b05","sha512":"0612f0c579ae3a16505d88bc6d10ebd74c59ee23452b2ce15b7371ea932b67b409e9038645a401655dd42ed7de17a642a05f3803ae916df87e39143df81273d9","ssdeep":"","tlshash":"3e514cc28d346f463d8e1ed844dfc31294752150e517823ab54a1cfea2b54a5f78339d","first_seen":"2026-08-22T18:31:06.677826Z","last_seen":"2026-08-22T18:31:06.677826Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1438,"timings":{"blocked":0,"dns":250,"connect":291,"send":0,"wait":294,"receive":11,"ssl":592},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"jsonbfq21.hzlgxs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mstatic21.hzlgxs.com/oss/media-admin/upload/20260224/38473d4206379dafcbb57a2f1aba89ac.js","fqdn":"mstatic21.hzlgxs.com","domain":"hzlgxs.com","tld":"com"},"ip":{"addr":"154.23.238.14","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://824246.lol/","date":"2026-08-22T18:30:29.875Z","timestamp":1787423429875,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hzlgxs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Jul 2026 09:28:06 GMT","end":"Fri, 09 Oct 2026 09:28:05 GMT"},"fingerprint":{"sha1":"75:A0:C2:1A:6A:81:A3:C3:CB:D5:0A:ED:D7:8F:0E:15:45:21:2C:3D","sha256":"47:A3:DE:9E:10:07:C4:BC:0B:FA:AC:CE:F3:C7:B7:FA:4E:56:22:A0:8F:2D:15:E4:F4:07:9B:19:38:7E:5B:AB"}}},"request":{"raw":"GET /oss/media-admin/upload/20260224/38473d4206379dafcbb57a2f1aba89ac.js HTTP/1.1\r\nHost: mstatic21.hzlgxs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://824246.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 0\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Sat, 22 Aug 2026 18:25:35 GMT\r\netag: \"ae01df02c26053c9683a8806474794c6\"\r\nlast-modified: Sat, 22 Aug 2026 18:25:35 GMT\r\nserver: BFQ-GW-3\r\nvary: Accept-Encoding\r\nw-a-3: w-a-3\r\nw-a-3-hits: skipped\r\nx-amz-id-2: 4363627f4419424109ef399ca1e88c5a118779c76067d8a8a5ba1e3b1556d606\r\nx-amz-request-id: 18CE33DF38E393CD\r\nx-amz-version-id: 63fda292-d29f-4921-96bc-2b119dad3af7\r\nx-cache: HIT, policy, disk\r\nx-content-type-options: nosniff\r\nx-customize-tag: 1.1\r\nx-ratelimit-limit: 12500\r\nx-ratelimit-remaining: 12500\r\nx-xss-protection: 1; mode=block\r\ncontent-length: 81856\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":81856,"size_decoded":82572,"mime_type":"application/javascript; charset=utf-8","magic":"data","md5":"bbc29e29303505100b7407a04fd00383","sha1":"67cc8945e3d1d6affcc4d3cfd996b1c3fa3e8e1f","sha256":"3a33ffceb9751a576b74cc849e9d1ab55451d65f5a75124c4a2edfb6ce6563f9","sha512":"03f4e4d32a979bfc6d0911312763322d881ee7a29d50a7417fe084d63665f3b4e38adc3f233bfdb712ca48ade8454c5327626cb5e2ca103b22aa5d576064d148","ssdeep":"3072:gs2NBwYvK6XJpyKtRKzNfo15Apsi4iQFpKEeCvtSkTjJhF:GbwYvNhtRQoDbZBWytSkTjJhF","tlshash":"25c3cf029252e3b0e1ec11f5895747dcf621ab08f2cdaa45c71491f03aaa31fb65fdb6","first_seen":"2026-08-22T18:31:06.678853Z","last_seen":"2026-08-22T18:31:06.678853Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1656,"timings":{"blocked":0,"dns":50,"connect":285,"send":0,"wait":285,"receive":746,"ssl":289},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"mstatic21.hzlgxs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"57z0uk.584644.com/?key=diversion","fqdn":"57z0uk.584644.com","domain":"584644.com","tld":"com"},"ip":{"addr":"166.117.59.163","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-22T18:30:35.891Z","timestamp":1787423435891,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"584644.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 21:38:45 GMT","end":"Wed, 18 Nov 2026 21:38:44 GMT"},"fingerprint":{"sha1":"9D:8E:67:DA:44:7F:81:65:7F:EB:26:85:A6:E1:3D:C7:67:1A:3D:22","sha256":"95:39:DC:C5:4E:08:CF:CC:A8:98:26:98:3D:38:E0:97:C9:DB:1C:F6:95:7F:2A:10:25:CC:AB:7B:EF:51:5B:79"}}},"request":{"raw":"GET /?key=diversion HTTP/1.1\r\nHost: 57z0uk.584644.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://824246.lol/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: no-cache, max-age=0, s-maxage=600, must-revalidate, public, max-age=3600\r\ncontent-encoding: gzip\r\ncontent-type: text/html;charset=utf-8\r\ndate: Sat, 22 Aug 2026 18:30:37 GMT\r\nserver: openresty\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-cache: UPDATING\r\nx-powered-by: Nuxt\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":92768,"size_decoded":49331,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (54115)","md5":"60d146c036baf21855526dfce1c57a48","sha1":"ba4579eb38644fce491001421cd9cace2afe5f42","sha256":"9fe59b1022a49b05cbd5f9c4b52bfe14935cfd85c94ae5fde055c2b0a509bb17","sha512":"4df6ed68a60f501bb5a61860402e3a1a8dd86c1ecd1b8b34cc90f8a9398805e12d5ff1c33fdb3e6fef4b9ec3c93bf89290db596a88f317a44cbe1d111c8cd491","ssdeep":"1536:sDo7ZCfLm7pHqP2KLCeEP8vJf3dP50+cvG4XgKzkL9fBTXbZVsDipR0qSiXUYDkA:3ZC6wCHPklXc4KzkL95eipdU2ktIRsH4","tlshash":"b793e7c4b5d529c20d29857666ef1b4f216602ff890b9c4936bc130e6f7caf18f9990d","first_seen":"2026-08-22T18:31:06.680041Z","last_seen":"2026-08-22T18:31:06.680041Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1259,"timings":{"blocked":-1,"dns":609,"connect":1,"send":0,"wait":230,"receive":0,"ssl":419},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"57z0uk.584644.com/favicon.ico","fqdn":"57z0uk.584644.com","domain":"584644.com","tld":"com"},"ip":{"addr":"166.117.59.163","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://57z0uk.584644.com/?key=diversion","date":"2026-08-22T18:30:37.269Z","timestamp":1787423437269,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"584644.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 21:38:45 GMT","end":"Wed, 18 Nov 2026 21:38:44 GMT"},"fingerprint":{"sha1":"9D:8E:67:DA:44:7F:81:65:7F:EB:26:85:A6:E1:3D:C7:67:1A:3D:22","sha256":"95:39:DC:C5:4E:08:CF:CC:A8:98:26:98:3D:38:E0:97:C9:DB:1C:F6:95:7F:2A:10:25:CC:AB:7B:EF:51:5B:79"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: 57z0uk.584644.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://57z0uk.584644.com/?key=diversion\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: no-cache, max-age=0, s-maxage=600, must-revalidate, public, max-age=3600\r\ncontent-type: image/x-icon\r\ndate: Sat, 22 Aug 2026 18:30:37 GMT\r\nserver: openresty\r\nvary: Accept-Encoding\r\nx-cache: BYPASS, Cache-Control: no-cache, max-age=0, s-maxage=600, must-revalidate\r\ncontent-length: 78\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":78,"size_decoded":413,"mime_type":"image/x-icon","magic":"ASCII text, with no line terminators","md5":"b9a31d3949b1882a09ed2f8508d538f3","sha1":"1c4fb4a004ac374ae735c210f8560be0dce354ac","sha256":"560a481d94b94be28e45a6ee498682f92b2eb99f8f6f5956c9aad969f61ee5e5","sha512":"2f13bac82a699ecd16af4049fa8c5f35ff85b736025f576ca5a8a690c561e4803d85578fe449b18a95cfca2791200a3a6ebb9602d7d12219975bedb48360e1ee","ssdeep":"","tlshash":"18a002f215eb78c74d4d2c20d44d93559d49085fd27587d0dc6603664ad5845a57e438","first_seen":"2023-05-08T15:22:04Z","last_seen":"2026-08-22T18:31:06.685044Z","times_seen":7139,"resource_available":false,"data":null}},"time_used":211,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":211,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"824246.lol/js/jquery.min.js","fqdn":"824246.lol","domain":"824246.lol","tld":"lol"},"ip":{"addr":"207.57.107.15","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://824246.lol/","date":"2026-08-22T18:30:27.704Z","timestamp":1787423427704,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"983622.lol","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 17:41:50 GMT","end":"Wed, 07 Oct 2026 17:41:49 GMT"},"fingerprint":{"sha1":"C5:B0:C8:A6:4D:10:37:08:56:CA:1A:68:7A:91:EB:7C:C0:18:70:27","sha256":"8A:D0:A0:54:37:29:B5:D3:79:28:6F:7D:76:A3:F3:F6:78:84:BF:43:C0:5C:40:16:4D:98:E5:3B:55:7B:D8:DE"}}},"request":{"raw":"GET /js/jquery.min.js HTTP/1.1\r\nHost: 824246.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://824246.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 22 Aug 2026 17:16:09 GMT\r\netag: W/\"6a6f16f7-16dc5\"\r\nexpires: Sat, 22 Aug 2026 19:16:09 GMT\r\nlast-modified: Sat, 22 Aug 2026 17:16:09 GMT\r\nserver: openresty\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":93637,"size_decoded":38023,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65483)","md5":"04169da38e42b7f704e72fce3a957e33","sha1":"a8c8a5caf9765b4ccb90d708045518e219a9af5d","sha256":"1f0a1183d9ed40fa1e0cf8a29a6b3eca8c288a6f5c36e16813550c4f8b938636","sha512":"6107abece49faac96618b06c8d9b62be3577a533af39dc3a3d5b69c985c4ad19120d60b517d6ae02800fd428b48caa12cccc24131ce10dba4d720acba5aeda41","ssdeep":"1536:s6IzxETpavYSGaW4snuHEk/yosnSFngC/VEEG0vd0KO4emAp2LSEMBoviR+I1z58:O+vIklosn/BLXjxzMhsSd","tlshash":"f493f8ed73c6717243ab30ae40af610ef1365869280d8410f129e8f9bc79a499277f7d","first_seen":"2023-03-10T04:37:42Z","last_seen":"2026-08-22T18:31:06.685622Z","times_seen":85,"resource_available":true,"data":null}},"time_used":303,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":303,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"824246.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}