{"report_id":"a962aa96-ccff-4716-8835-4f02ec51ea23","version":6,"status":"done","tags":[],"date":"2025-12-20T07:45:18Z","url":{"schema":"https","addr":"fefaewfaew.top/","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"172.67.159.239","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"fefaewfaew.top/h5/#/","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"title":"fefaewfaew.top/h5/#/","dom":{"size":320391,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (40058)","md5":"34754673f51d30ddb05c384defdd99c8","sha1":"f34856440190651584f948464004937219fe08b5","sha256":"e267af00bdac56b20837bb2905bcadbf33d4bd8deedcc601b5a3bd5a590173c4","sha512":"da724b9b73d1037fad5eb5df3bd816f9fafc86e5b989096395519396da66383771f5c697c61480659fd1aeb2cb23b8c639d8a3f118de609d388c315987eba148","ssdeep":"1536:iRo4pe2s+Z28Y7SrW3YeWXA1u9w4HCe/l4zUg2fqME4jQ378OaiZkW1Yu8e2Je4L:vP8jhIfaGBqTBIDcV","tlshash":"6664a912ab57105ea12bce59e1c0b7bc7f2ac323c5225ae7fa51371dcbd25861253a0f","dom_hash":"domhash20c15ab91b4a834371862ac50300528c","first_seen":"2025-12-20T06:58:35.357915Z","last_seen":"2025-12-22T07:29:25.403602Z","times_seen":10,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"fefaewfaew.top/","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"172.67.159.239","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-24T07:45:18Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"ggj.nidnw-12.shop","ip":{"addr":"154.94.239.103","port":443,"asn":44559,"as":"It Hostline Ltd","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2025-12-20T06:58:25.625157Z","last_seen":"2025-12-20T06:58:25.625157Z","alert_count":0,"request_count":6,"received_data":18148,"sent_data":3228,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fefaewfaew.top","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-12-19","domain_rank":0,"first_seen":"2025-12-20T06:58:25.623775Z","last_seen":"2025-12-20T06:58:25.623775Z","alert_count":80,"request_count":20,"received_data":4374919,"sent_data":10380,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdn.dcloud.net.cn","ip":{"addr":"106.54.228.253","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"domain_registered":"2013-07-17","domain_rank":296858,"first_seen":"2018-09-15T09:18:08Z","last_seen":"2025-12-15T07:33:28.123624Z","alert_count":0,"request_count":1,"received_data":579,"sent_data":445,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"fefaewfaew.top/h5/","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"3f2d197beaf98df3efbdc135a00fb58b","sha1":"d4e4468e0427a0334ae35f30859eec1a2012b330","sha256":"6d0ea4c5dc42443fcc73852f752eaa96441521376bf5ff26c714b24c5fcdbd31","sha512":"dc8d4c49306f8df895a7f6286bda6e05739f4db416a5e60a95e8728fd9b6f7d6dcaabf589c5d25319bb16f6ae1b9998bb0e963b3a857bcf33737ebfb9636b39e","ssdeep":"","tlshash":"9b216693f0d114985117814920a3e77e7ebf44225b420d763cde3b7c6baaed3d4a8994","size":1358,"data":"","first_seen":"2025-12-20T06:58:35.377367Z","last_seen":"2025-12-22T07:29:25.433353Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/static/js/chunk-vendors.b0970d1d.js","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f53f355284ba1195899f76b2b8e3287b","sha1":"1adaf435b7b40f6ae8a1568b94df0ded1a0b2cae","sha256":"093a3b4da11bef97b081cd128e96284d91260af91f391501d56719c2004ece86","sha512":"518904f9c38d4dba4ef1c2894710cda6bd0924af8b9e2ccf3001c782d850d56bdcf8392da7819506a16611776e466c440bb0850790e4dec857f8eaa4530cd4d4","ssdeep":"12288:3LnCY+aN1VTcknFzvEs+fPaHUQY5F3ZJE2ZL/o5EidDedd9HL:3LnCY+s11cks8Uv5Fp+iL/o5EixUd9HL","tlshash":"e8755c8973c7b07647e3a1b4106f210bb33b5a69a8098098f675e4d9ad7990d133bf3d","size":1677962,"data":"","first_seen":"2025-11-21T02:11:19.030646Z","last_seen":"2025-12-22T07:29:25.434147Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/static/js/index.7bde564a.js","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"306fd9d7134758a6a7a2c6f4650ff7e7","sha1":"071085b6750fbaa8ca22511baab55ebf4170482b","sha256":"44dd389d3a997edc608d002f5fce8004e72fc0e43905e5d46c69a6869a810de2","sha512":"aee0c8d05d02a171012f9d3742739e3947f8b77bc2b559d67ee2d6f06e8b51ff4cc251bed3b5d4a004e606326c0c3860a7872291ded129e90808a2e8aaae9bdc","ssdeep":"12288:GrCGzn4C8j+u2/tmW/we/dpQ53cBs+bjOLsSMeEYKhUdYmr2yzA3/KvrBAtRJUzM:YT9s+q4Udo1","tlshash":"a48509a731cc96b5fbc92f816256085c376d0d9f4504f08662ce996db78fb1cb089bb2","size":1714218,"data":"","first_seen":"2025-12-20T06:58:35.379694Z","last_seen":"2025-12-22T07:29:25.434836Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/static/js/pages-login-index.b9714036.js","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2b610832eaf76ad64b3887e2b3ae8b8c","sha1":"77e23067d90df61b84a23d6b9e130b84ac0370ca","sha256":"5f493e88ea64954f029e907f074aeacaaa4fe5c3d061925d8ca377351ea48d10","sha512":"4a2e68c389559468705d8a93e6ffaa912d27876d629e72c29cf800788df326d9dbb1bae695a22f328ac718b0e15e9979a2125daf5db28e47e68bf0feac87a459","ssdeep":"384:Ny0ZoajzhuDGkaC3kNb9Av7RyVG11cFsS4zLdF1XjxEe5zhUh:Eq9M13kNb9ADR/1HSuL71XjxEazh4","tlshash":"bbd22c4cb1c7f0599567e0b0001f1125f1367a79e409d8c6fb75dbe16eaa98e232ab3c","size":28654,"data":"","first_seen":"2025-12-20T06:58:35.362235Z","last_seen":"2025-12-22T07:29:25.432085Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"3d5272693eb411e5b8b13a243f76c720","sha1":"6a586ab8e0a4bf12bbc60eea6ca9f2418625a22c","sha256":"9582f31f9eb892b8823a780e579d464d54e26d97d65dc327d2b2bdd92d47c4b8","sha512":"03fc5614f48fc9a2e3c4a30626fdbacde74c1fda09ffa9d1cde0393d31cd5fe1588e270c241f4cedb473c6e5cc224ff16c141468a29519ea6159accf3e3a18f1","ssdeep":"","tlshash":"a4c08c8350e2080c8210861b848880050b8808b04f9308a22cd85b7ecc9ae88c8f804c","size":148,"data":"","first_seen":"2023-03-07T01:10:06Z","last_seen":"2026-06-07T08:18:02.151537Z","times_seen":15899,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"ggj.nidnw-12.shop/user/areaList?lang=ru","fqdn":"ggj.nidnw-12.shop","domain":"nidnw-12.shop","tld":"shop"},"ip":{"addr":"154.94.239.103","port":443,"asn":44559,"as":"It Hostline Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:58.779Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ggj.nidnw-12.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 12 Dec 2025 22:39:43 GMT","end":"Thu, 12 Mar 2026 22:39:42 GMT"},"fingerprint":{"sha1":"B3:6F:4C:2C:A5:21:CF:2A:09:5B:14:D2:96:5A:7C:C7:1E:45:44:20","sha256":"C6:7D:17:E7:23:4C:3C:75:53:25:EF:65:D6:88:7D:98:17:06:DD:70:F0:E3:25:C2:1F:95:5A:D6:31:92:79:BA"}}},"request":{"raw":"OPTIONS /user/areaList?lang=ru HTTP/1.1\r\nHost: ggj.nidnw-12.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type\r\nReferer: https://fefaewfaew.top/\r\nOrigin: https://fefaewfaew.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:44:59 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Requested-With, Content-Type, Accept, Authorization, User_id\r\naccess-control-allow-credentials: true\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T01:07:07.99671Z","times_seen":17753107,"resource_available":true,"data":null}},"time_used":1281,"timings":{"blocked":501,"dns":1,"connect":259,"send":0,"wait":249,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/static/index.2da1efab.css","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:57.968Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET /h5/static/index.2da1efab.css HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/h5/\r\nCookie: think_lang=en; PHPSESSID=9abef883750e1805e5a9e74edbcbf33b\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 20 Dec 2025 07:44:57 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Mon, 15 Dec 2025 12:28:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"693fff07-178f9\"\r\nexpires: Sat, 20 Dec 2025 18:58:03 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 2814\r\ncf-cache-status: HIT\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JMBWbgGAMZv%2F8G6o3Y8zKt8jhKmC%2F4Gk86u0Rt7g7Im3q%2BviUf7Tq6ToQczewEIK2gJi5Z5BEkTDrBuNtb4du%2BKfie13e2XI0hlZ1A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b0d847a4c9056af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":96505,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"73ae6c583d02d78f81e3f18860a2899a","sha1":"07df9233fc11dddc34fbf519b891d40b2ac29c0f","sha256":"e97de9a247807f12d74101e9f736250b2410be4e1ed3d17ed875e4b08cf66c83","sha512":"da54ba9dbe06d8d763f3cfd64cf5babb54e761e3208c7a2f23e845290c48db8c115bb86c24262cd6c9a96ff2e51674c6d86439e1814baf2de7980f5c06349921","ssdeep":"1536:OlIApuK7hmVmb2RS1Wu3xdynGJ7eh/nKhlvbc:VApuK7hmVrS1Wu3iG41nKPI","tlshash":"1893f73719012e39e52bcd26b6c1ab5a1e61c033e15307adfba47628cbcf9c9167b345","first_seen":"2024-01-02T00:07:11Z","last_seen":"2026-08-06T07:55:10.605498Z","times_seen":6416,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/static/js/index.7bde564a.js","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:57.972Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET /h5/static/js/index.7bde564a.js HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/h5/\r\nCookie: think_lang=en; PHPSESSID=9abef883750e1805e5a9e74edbcbf33b\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 20 Dec 2025 07:44:57 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Mon, 15 Dec 2025 12:28:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"693fff07-1a282a\"\r\nexpires: Sat, 20 Dec 2025 18:58:03 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 2814\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GiNp5z4Um5qNBxl5JMUIsGRhrVPhZMEcDPXP8QSdm%2BLQNjxikR9v3MZ1eGa5xQ%2BIGL2DlwACAtc1LpiHL4NLc9bej7jnbIR5u%2FwKDQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b0d847a4c9856af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1714218,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (54433), with no line terminators","md5":"e4e2f77a477235a76e05d325ac621a40","sha1":"e2ffac39cbe162e71e3251888e8d19a49d25fe71","sha256":"addaa77342b7feec605f955d0278ab307bd110afa6eaf8038736913138f3bd43","sha512":"6ec128413319547d83e48585512406bf29ed7d37fbdddb44983b0ae43575f27b71eaad68771429e683dd51d679229dd7f1b0355337aff0fa1b5b110e07e06ff4","ssdeep":"12288:GrCGzn4C8j+u2/tmW/we/dpQ53cBs+bjOLsSMeEYKX:YT9s+qm","tlshash":"4b451bab32cc94b9fbc52f816256086c376d0daa4505f0c662cd9d6d878ff1cb185bb2","first_seen":"2025-12-20T07:45:23.442287Z","last_seen":"2025-12-20T19:45:35.908169Z","times_seen":2,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/static/js/pages-login-index.b9714036.js","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:58.604Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET /h5/static/js/pages-login-index.b9714036.js HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/h5/\r\nCookie: think_lang=en; PHPSESSID=9abef883750e1805e5a9e74edbcbf33b\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 20 Dec 2025 07:44:58 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Mon, 15 Dec 2025 12:28:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"693fff07-6fee\"\r\nexpires: Sat, 20 Dec 2025 18:58:06 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 2812\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pQes0FdTBzDIysDPnfRZYvB67yQqRLPabK3ogOsx6M9aNBLtl8E9pb4A8T%2FkZ7KY8JWeUaGY6O3b54AcMHQKnNuv%2FtcHbTyCUNKpjw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b0d847e4f3d56af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28654,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (17130)","md5":"2b610832eaf76ad64b3887e2b3ae8b8c","sha1":"77e23067d90df61b84a23d6b9e130b84ac0370ca","sha256":"5f493e88ea64954f029e907f074aeacaaa4fe5c3d061925d8ca377351ea48d10","sha512":"4a2e68c389559468705d8a93e6ffaa912d27876d629e72c29cf800788df326d9dbb1bae695a22f328ac718b0e15e9979a2125daf5db28e47e68bf0feac87a459","ssdeep":"384:Ny0ZoajzhuDGkaC3kNb9Av7RyVG11cFsS4zLdF1XjxEe5zhUh:Eq9M13kNb9ADR/1HSuL71XjxEazh4","tlshash":"bbd22c4cb1c7f0599567e0b0001f1125f1367a79e409d8c6fb75dbe16eaa98e232ab3c","first_seen":"2025-12-20T06:58:35.362235Z","last_seen":"2025-12-22T07:29:25.432085Z","times_seen":10,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/static/images/dq.png","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:58.765Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET /h5/static/images/dq.png HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/h5/\r\nCookie: think_lang=en; PHPSESSID=9abef883750e1805e5a9e74edbcbf33b\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 20 Dec 2025 07:44:58 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Mon, 15 Dec 2025 12:28:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"693fff07-23ba\"\r\nexpires: Mon, 19 Jan 2026 06:58:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 2811\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aXVzJc5ELUGLP5zySv2%2FtGd%2FvwBomwKDFn0CcduaPutrLeMNGeTWHN9brw%2BE6WGcBgVQBeeidBHHkf5hoX%2F9Tq%2BitrMZ3BLpokV2oQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b0d847f3fe956af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9146,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"4f2e616aab2c9f97a3e70ebfbd865409","sha1":"885cad2f526bc7f63ce8580fabc1f7b34df124a7","sha256":"7417182b835d5a75313370e34bd737d1dad261577e44c8a7f60e742087cbcf84","sha512":"15a51734f79cde33ed0e0afba30ce54ef29c01e7bdefa1775fef962836356421e661b973ed02a029c06f12be1cc771e8c214bb83b28e1f13dad98229126faad3","ssdeep":"192:xYxGr0/D7LG8cOE399JNuMhn7CNFHgp/HjWbqUgrmYoDeg0V4pOu3hIHHy:xYxGwqNOEN9GWn7CNeBDqgS9hhE5HS","tlshash":"be12ae76ae90522032d640575ab57bb7c4efe0881e108179bbb4e6531b7ee3cc0d6a12","first_seen":"2023-05-16T23:56:59Z","last_seen":"2026-06-27T22:54:16.38815Z","times_seen":91,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/static/icons/r3.png","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:58.770Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET /h5/static/icons/r3.png HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/h5/\r\nCookie: think_lang=en; PHPSESSID=9abef883750e1805e5a9e74edbcbf33b\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 20 Dec 2025 07:44:58 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Mon, 15 Dec 2025 12:28:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"693fff07-118ac\"\r\nexpires: Mon, 19 Jan 2026 06:58:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 2811\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8I%2Buf8LX%2F%2Bfcr4yYy6nLa2KUFISUu4YlUxkw%2FIisKtSCFhp%2B7X1fO%2FT57kT8YlnhrWkAnwhao8%2BY2QVIVUA6jtsurOtKiKuZCswsxA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b0d847f3fed56af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":71852,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1419 x 1252, 8-bit colormap, non-interlaced","md5":"9710f95f525e4bf25917abe7bce219b2","sha1":"cc87902caaffbea2c27600b40a51ab017f9e49d6","sha256":"d2088e8b9d48804f8167cd2aa7c4440e6121783e338909c4c02e042cd61d012d","sha512":"b8c5353b3d43792076a3cd20db2f41ad98559193ed552cd67088b8535ae64a7b7055a5f3ffc4cb3fc97a9441a5de9aa6a1187c134e42b5309020349d11be73d6","ssdeep":"1536:qdgnvYE2iKgVQ4tpVubIJyVs3aZtWmLvW4wmftJBmpt67P0P:Nvd2iKgV9zV0IJL3ZH6XmssP","tlshash":"9c63022eae461d87f2a690f9e5ad1652c073e0e11af5e1bc24b04600ff837465b0caf7","first_seen":"2025-11-21T02:11:19.019958Z","last_seen":"2025-12-22T07:29:25.420261Z","times_seen":12,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ggj.nidnw-12.shop/user/config?lang=ru","fqdn":"ggj.nidnw-12.shop","domain":"nidnw-12.shop","tld":"shop"},"ip":{"addr":"154.94.239.103","port":443,"asn":44559,"as":"It Hostline Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:58.773Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ggj.nidnw-12.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 12 Dec 2025 22:39:43 GMT","end":"Thu, 12 Mar 2026 22:39:42 GMT"},"fingerprint":{"sha1":"B3:6F:4C:2C:A5:21:CF:2A:09:5B:14:D2:96:5A:7C:C7:1E:45:44:20","sha256":"C6:7D:17:E7:23:4C:3C:75:53:25:EF:65:D6:88:7D:98:17:06:DD:70:F0:E3:25:C2:1F:95:5A:D6:31:92:79:BA"}}},"request":{"raw":"OPTIONS /user/config?lang=ru HTTP/1.1\r\nHost: ggj.nidnw-12.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type\r\nReferer: https://fefaewfaew.top/\r\nOrigin: https://fefaewfaew.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:44:59 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Requested-With, Content-Type, Accept, Authorization, User_id\r\naccess-control-allow-credentials: true\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T01:07:07.99671Z","times_seen":17753107,"resource_available":true,"data":null}},"time_used":1215,"timings":{"blocked":473,"dns":0,"connect":241,"send":0,"wait":249,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/static/area/cn.svg","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:58.774Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET /h5/static/area/cn.svg HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/h5/\r\nCookie: think_lang=en; PHPSESSID=9abef883750e1805e5a9e74edbcbf33b\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 20 Dec 2025 07:44:58 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Mon, 15 Dec 2025 12:28:55 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000\r\nage: 2811\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WwIioQmVMv%2BF1Apod0MEjM57LWAvtjSvn83RtfB5S9A%2BKzgQQdmsJ29FYnbivwLxFynzhAHDvFehen3wPoC0kqQag4o702%2BEHu5wug%3D%3D\"}]}\r\netag: W/\"693fff07-32d\"\r\ncontent-encoding: br\r\ncf-ray: 9b0d847f4ff056af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":813,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"347824ed3b1806718c8881e7e2f13697","sha1":"6a132cb7d0c5fb1fd90fc5857a15057dad164fcf","sha256":"981da9bdf82d48e31691f20578cefcb26cf7d0bd95e4ebd5c0df00bdfe988c1a","sha512":"1358e73681de4250ddd64c6a4fea379c37ff51d01ce8bcad00715e2f8b57ce59120dd8486267ff36aaa0ef65fa3d39c3f4c4b154286506979278c46b88187707","ssdeep":"","tlshash":"d501c211f105900cca094740c1acfd8ca746e0e26397444bfe34259d413de6f59ebbce","first_seen":"2023-08-14T19:59:08Z","last_seen":"2026-08-06T08:57:34.603345Z","times_seen":654,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/favicon.ico","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:59.199Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/h5/\r\nCookie: think_lang=en; PHPSESSID=9abef883750e1805e5a9e74edbcbf33b\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 20 Dec 2025 07:44:59 GMT\r\ncontent-type: image/x-icon\r\nserver: cloudflare\r\nlast-modified: Thu, 13 Nov 2025 07:58:56 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000\r\nage: 2812\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Alr6y6P1oDinUzGWzHXs1fXhBFcrWOFRZlzMVQJZarTOz7UNFHgDKM7mlZkhiu7BlvaMhSPfG%2BqDuj8yfakaSMJs%2B4OioLBe1bgHzg%3D%3D\"}]}\r\netag: W/\"69158fc0-10be\"\r\ncontent-encoding: br\r\ncf-ray: 9b0d8481f95656af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4286,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"815bc7ed661e0465a634d68bc244fdd7","sha1":"f96287876e82185d9e09d08cfecae434c6375e4c","sha256":"ef181e9b6a58d8f36ebfc6acd589d2f94d371af0cb2c68e17032edebdaed99a0","sha512":"2ad3ec06ff944966902d1e51b454fbba4c6ed586a5b3856535b91eba853fca1070be4b3de4b8bbb25cb8d64f4bd8ead0b245d57d5b6d96f3674a328ab5894749","ssdeep":"24:su58nn0hdrsFtG4m5Lk0wutL2nJM0RR3FyUt2Ni:64V/h5o9aqnJb3Ic2Ni","tlshash":"489191ce8204c051f2a856f8c10e5a41c3b63f7be5aaa9471581bc703abe1f75737817","first_seen":"2023-05-01T23:59:39Z","last_seen":"2026-08-06T09:38:42.713025Z","times_seen":17147,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/static/tabBar/icon-home.png","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:58.610Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET /h5/static/tabBar/icon-home.png HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/h5/\r\nCookie: think_lang=en; PHPSESSID=9abef883750e1805e5a9e74edbcbf33b\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 20 Dec 2025 07:44:58 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Mon, 15 Dec 2025 12:28:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"693fff07-12b9a\"\r\nexpires: Mon, 19 Jan 2026 06:58:06 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 2812\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=c4j6QfV0nedvaS%2B3CbBE5DEy3CChNeVre3bBlIBmPSuAuUFyo%2BcLtYeiQIEaqiN%2FC8fLZXKZVk67lc99v8J0%2FphfDo7ZDndBaoDhbw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b0d847e4f4456af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":76698,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1419 x 1252, 8-bit colormap, non-interlaced","md5":"377d7b30b4cbbdb70c24cdfd235953aa","sha1":"5f824a89f0b581a76ed37d37a9b210c591c867cd","sha256":"181c466b710ba30743c04f06dfc33ced5bffe8222094c3187c6055103e8865d7","sha512":"8c890d85404e10f53653fff1724d652006d2c8d05577b99bb9a349cab15d92b57156c86eace8f6856dae83849e9bf780568f84bbe9f42292cf56bdf62f8b4dc5","ssdeep":"1536:xok/QxR4tlekmu0wacvKFe91ik+tk0vU6qaXX34FhLwoELY+1aF1KfXUFp:xjoxR4tUkmu0wdKE91ik4zxqaXH4/LbV","tlshash":"da7302e14f820f78d2a29fb0eb241c6cc47c4a7855dbeeecc54894356e85ed1b625c8b","first_seen":"2025-11-21T02:11:19.028742Z","last_seen":"2025-12-22T07:29:25.417043Z","times_seen":12,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/static/tabBar/icon-service.png","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:58.628Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET /h5/static/tabBar/icon-service.png HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/h5/\r\nCookie: think_lang=en; PHPSESSID=9abef883750e1805e5a9e74edbcbf33b\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 20 Dec 2025 07:44:59 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Mon, 15 Dec 2025 12:28:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"693fff07-11ff9\"\r\nexpires: Mon, 19 Jan 2026 07:44:59 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qOqkXpGBO9gWw3Vv7iktfw%2Bny2nSPNdDzm8cXvGdS3ql9pP6Ze2NAks%2FXwSyRO5cFoaDNiZg66BdjPQV101NNXQ5eYsmJury%2BuC4aA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b0d847e6f5756af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":73721,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1419 x 1252, 8-bit colormap, non-interlaced","md5":"6a3682f9e2b07711d02bb43c04f9b50f","sha1":"a8347f3c43a203eefc52e8c1a9eb66894f2380ad","sha256":"1ce72833a1d414e37e3fccfa60409d30c3359487d875a1eecea6a66f545b7a9a","sha512":"a4848bd0ff4b7641e74647724e0db2a9daed1e43e09170afee0b7b04384487a973bb56edd713717fd5c8bda386d971592115358cfc381623c0c7fddc035928dc","ssdeep":"1536:QCxanGJgPei6f1ZUzku+HWEsoY1NORWfzf3Qk10:3anGJgPeHUzBEWkWT3Qk10","tlshash":"d573026a52cfcfd4c94ca23fdc09cbe665f981483b3e80de6d66524c79a7e31608189d","first_seen":"2025-11-21T02:11:19.000411Z","last_seen":"2025-12-22T07:29:25.427698Z","times_seen":12,"resource_available":false,"data":null}},"time_used":1356,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1071,"receive":285,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/static/images/rgbg.png","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:58.777Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET /h5/static/images/rgbg.png HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/h5/\r\nCookie: think_lang=en; PHPSESSID=9abef883750e1805e5a9e74edbcbf33b\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 20 Dec 2025 07:44:58 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Mon, 15 Dec 2025 12:28:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"693fff07-30eb2\"\r\nexpires: Mon, 19 Jan 2026 06:58:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 2811\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F6g6j%2BjtNi%2FOk2vH6I9MVANdu6zk7I%2Be4KTuk7or5mbuajd5aaKY4CUQckrZgJPz2t6i7tpuYZtqitOgtAFvvTE5xtCZEf1XGP%2FDWg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b0d847f4ff356af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":200370,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1124 x 632, 8-bit colormap, non-interlaced","md5":"f706a7fd48dd442d262fb4285ff98a78","sha1":"5116a9e5d499e7f67d56633a9151d9c23aa39f22","sha256":"8efb64246c70c434bd653ad2d1282c732a354bc6c8b6b4fb812365772f7c3ba9","sha512":"f697f561a0f83adaab6dc4291cb59fd04b688f1c24ec232324c6d74e691e712d26ccc0bc9f49593076dd907d57933c42516b5db3cb14ae8f77784a5a9043ae7f","ssdeep":"3072:OxAdZ5W5ycU+FxrbwJk1Qa13C0nJE4mB+XyxG5DxmhIKCaPsFk:OG5WrU+XbIkQa184mB+iE5gIKCa0Fk","tlshash":"f61423cbd25278685d639c3507dfd28285898bcec8dcbf33d5a9e9943eca06462701bd","first_seen":"2025-11-21T02:11:18.987602Z","last_seen":"2025-12-22T07:29:25.429184Z","times_seen":11,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ggj.nidnw-12.shop/user/config?lang=ru","fqdn":"ggj.nidnw-12.shop","domain":"nidnw-12.shop","tld":"shop"},"ip":{"addr":"154.94.239.103","port":443,"asn":44559,"as":"It Hostline Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:59.578Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ggj.nidnw-12.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 12 Dec 2025 22:39:43 GMT","end":"Thu, 12 Mar 2026 22:39:42 GMT"},"fingerprint":{"sha1":"B3:6F:4C:2C:A5:21:CF:2A:09:5B:14:D2:96:5A:7C:C7:1E:45:44:20","sha256":"C6:7D:17:E7:23:4C:3C:75:53:25:EF:65:D6:88:7D:98:17:06:DD:70:F0:E3:25:C2:1F:95:5A:D6:31:92:79:BA"}}},"request":{"raw":"POST /user/config?lang=ru HTTP/1.1\r\nHost: ggj.nidnw-12.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/json\r\nContent-Length: 22\r\nOrigin: https://fefaewfaew.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":22,"data":"{\"keyword\":\"telegram\"}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:44:59 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Requested-With, Content-Type, Accept, Authorization, User_id\r\naccess-control-allow-credentials: true\r\nset-cookie: think_lang=ru; path=/\nthink_var=ru; path=/\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":67,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9c6474793c3fd27666c94825e4868ed4","sha1":"3ee21071857ee82787de049684501ea31f871ba3","sha256":"18afb42fef1698eb9f7f112276e205e51d4e187729be8e21e3dd3386100d983a","sha512":"6531700d66676c9626804e069b9b55dcd9e7ec4023b30c4294c45a9608b650fceeffedcd8d88e9b7afb972cafd8c4920056ead5f360a0f73d1099e1b6efc4a87","ssdeep":"","tlshash":"05a022a082c80a8a002af82200083fca8288a083200ca3208accca2a80ac88c3003032","first_seen":"2025-12-20T07:45:23.447851Z","last_seen":"2025-12-20T07:45:23.447851Z","times_seen":1,"resource_available":false,"data":null}},"time_used":260,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":260,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ggj.nidnw-12.shop/user/areaList?lang=ru","fqdn":"ggj.nidnw-12.shop","domain":"nidnw-12.shop","tld":"shop"},"ip":{"addr":"154.94.239.103","port":443,"asn":44559,"as":"It Hostline Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:59.580Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ggj.nidnw-12.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 12 Dec 2025 22:39:43 GMT","end":"Thu, 12 Mar 2026 22:39:42 GMT"},"fingerprint":{"sha1":"B3:6F:4C:2C:A5:21:CF:2A:09:5B:14:D2:96:5A:7C:C7:1E:45:44:20","sha256":"C6:7D:17:E7:23:4C:3C:75:53:25:EF:65:D6:88:7D:98:17:06:DD:70:F0:E3:25:C2:1F:95:5A:D6:31:92:79:BA"}}},"request":{"raw":"POST /user/areaList?lang=ru HTTP/1.1\r\nHost: ggj.nidnw-12.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/json\r\nContent-Length: 2\r\nOrigin: https://fefaewfaew.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":2,"data":"{}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:44:59 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Requested-With, Content-Type, Accept, Authorization, User_id\r\naccess-control-allow-credentials: true\r\nset-cookie: think_lang=ru; path=/\nthink_var=ru; path=/\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15129,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (14466), with no line terminators","md5":"9e7432fbafedbcbe71150995fec9ce0e","sha1":"b3a0d3c1fd5a117707e6211bcb8108baf0c3e5bc","sha256":"e0e140a768725e7e68471f9f27b8d17ef37d31bcb749a74128ed0debbc88deb7","sha512":"c28b2a7361f760230245698706ded1e3a348f0b59ceb6ec0d0fb846cef73e769ec50a18afb9a795e159fc05ff962f7f565c8eed7520ac7909abc43f0a4db5e82","ssdeep":"96:gnBzSspG6u1IsnqU+qcnz+HaH/iMYotaLQPiE4mYz+YeOAqp:gnBzS+AIGqnZ+yXJWQqiYzeOlp","tlshash":"8862293b78ae8e1efc3a12c97867b9d15a79441e9705ae0f3a904f1c4525e8cf4143af","first_seen":"2025-12-20T07:45:23.448778Z","last_seen":"2025-12-20T07:45:23.448778Z","times_seen":1,"resource_available":false,"data":null}},"time_used":268,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":268,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/static/area/00.svg","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:59.839Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET /h5/static/area/00.svg HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/h5/\r\nCookie: think_lang=en; PHPSESSID=9abef883750e1805e5a9e74edbcbf33b\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Sat, 20 Dec 2025 07:45:00 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=J0X3dX2ttl0HoW%2BLkHkLhaCBzu4SbARhDCdzcC8DiB%2F2we3NQ1UVALvYMPC0%2FzVfYXeJDMAWP3C6t7O0%2FoP9ttc8Z%2BzJRZkxdKBXBw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9b0d8485fb9756af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":146,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-08-07T00:55:29.406258Z","times_seen":547009,"resource_available":true,"data":null}},"time_used":821,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":821,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-20T07:44:56.712Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET /h5 HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: think_lang=en; PHPSESSID=9abef883750e1805e5a9e74edbcbf33b\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ndate: Sat, 20 Dec 2025 07:44:57 GMT\r\ncontent-type: text/html\r\nlocation: https://fefaewfaew.top/h5/\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8ToaS2%2FJFa%2FAmlRQvcHaVKuQqY3jLeab%2FEnAsr4ojRkDSPI8AqV%2BSOyM6FrohqupawiJ0tBr4xPBrXjXfjokc%2BA%2FE6x4tsWgFUNlgQ%3D%3D\"}]}\r\ncf-ray: 9b0d84727f9a569f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1823,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T01:07:07.99671Z","times_seen":17753107,"resource_available":true,"data":null}},"time_used":771,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":771,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/static/js/chunk-vendors.b0970d1d.js","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:57.970Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET /h5/static/js/chunk-vendors.b0970d1d.js HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/h5/\r\nCookie: think_lang=en; PHPSESSID=9abef883750e1805e5a9e74edbcbf33b\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 20 Dec 2025 07:44:57 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Mon, 15 Dec 2025 12:28:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"693fff07-199a8a\"\r\nexpires: Sat, 20 Dec 2025 18:58:03 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 2814\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Cw1kgYPgyFALzWngMc1irGtKG4DqBTDvO1z%2ByqpFOlhv81RgkRL1XInejiTLr2Jk30aumG3uAD5AtYv672Ogl3I0r0kOJolq%2BPfHqQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b0d847a4c9556af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1677962,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65406), with no line terminators","md5":"a0ca84141b7919e8e8833ff9e41529dc","sha1":"4cdba4cfd442cb5495771604d09caad00d4a09a8","sha256":"888aa1b5ae56b57c24557f99652a0e806341c2202fec42cc9bc88d8574b013c4","sha512":"8886e4af10c065dec9618a5a46232458fe12b50cf05bf556ba23d39adf736c54f1e304b7230de8143757db0ee43720e7561e19c639a813d11b088b2acadcab24","ssdeep":"6144:JpMORxDwQSbY41CsA/KPfaN1IDATcknFzvEs/oT9JEsLtzCD8GUDcF4d5+:3LnCY+aN1VTcknFzvEs+fPaHUQY5+","tlshash":"a0254c897383707653a3a1b450af250bb3369b69980540acf675f8cd9db990d132bf3e","first_seen":"2025-11-21T02:11:19.015289Z","last_seen":"2025-12-22T06:42:35.244577Z","times_seen":10,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/static/tabBar/icon-order.png","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:58.624Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET /h5/static/tabBar/icon-order.png HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/h5/\r\nCookie: think_lang=en; PHPSESSID=9abef883750e1805e5a9e74edbcbf33b\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 20 Dec 2025 07:44:58 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Mon, 15 Dec 2025 12:28:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"693fff07-fc8b\"\r\nexpires: Mon, 19 Jan 2026 06:58:06 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 2812\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8FEtH5nWPSc427CNS06s7CJ2XuHc1pIlqlNHFfTpMj3k%2FO6ZaJ3GNQkVEEq%2BR0MfbhNDsXOmZuyKXI2GaijtQVoQVAM5o8b%2FAFfzXA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b0d847e5f4f56af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":64651,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1017 x 1017, 8-bit colormap, non-interlaced","md5":"2e11bbf0e122e2dcf8261d107b884809","sha1":"cdd5dc0fedb06dcc342ac1d36da7669d782df87d","sha256":"5cc3ccdac085c73cbea5d21bce6317126ebb1e3876dc3bdf7df5eb5a552ce595","sha512":"d473b2d7c13b72df28f02a8b77a95a25be67b166e386c5571b71fb6783e1c369797129dbc425b8c94697c0e574714fbffbffad25e45f31478d5de673b873bf59","ssdeep":"1536:h+68hKGHszfuv4rQNBQ7iyYtQ+rPaUl2SrfbJ5nu0:knNYfI422eQ+rSA2SLbJj","tlshash":"1553021a4d87a5e3900c61a7de986d937edf3a28934da0105356b3cc6703cd369d717e","first_seen":"2025-11-21T02:11:19.008897Z","last_seen":"2025-12-22T07:29:25.405646Z","times_seen":12,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/static/tabBar/icon-user.png","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:58.629Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET /h5/static/tabBar/icon-user.png HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/h5/\r\nCookie: think_lang=en; PHPSESSID=9abef883750e1805e5a9e74edbcbf33b\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 20 Dec 2025 07:44:58 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Mon, 15 Dec 2025 12:28:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"693fff07-1494a\"\r\nexpires: Mon, 19 Jan 2026 06:58:06 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 2812\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aeu4zWswQfor%2FBuKYc5ZH3Eb77TzWi9I8ZgpVL06Qtn2i%2BHmPd%2BTBuASUnk1Oi%2FCQeHh9ci8wFcfbTwOAy%2FGO7Y7E79ViccY2ZApEw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b0d847e6f5956af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":84298,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1391 x 1252, 8-bit colormap, non-interlaced","md5":"bc5f04d6ba992165aa6d6db93a778152","sha1":"6f779ec92a35f47906ba46d623dd7ddb6b729bde","sha256":"b62196664b698b0e7d55c4ea09cc27776a8f67ac13ffcfd021399f2f7a27f9a9","sha512":"d60a69a00e6299e82bcae1a9b821ff2abc21f3cd0f19386ba6933f77d7cb3ea69d7737c52e6cd847cf8f5bb3e1918bffb4b272e5bb35866e41789904b6b9bc75","ssdeep":"1536:LgE62opFkrG1nnJPIHjplmCnGhKUfGKrmRIzEDQPmc:LgE66G1JPennGI62IzEDQ+c","tlshash":"188312ed873527defde859328f61e5ba496fc3bc400ef74c40717a2da46094e208656b","first_seen":"2025-11-21T02:11:19.017622Z","last_seen":"2025-12-22T07:29:25.408209Z","times_seen":12,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ggj.nidnw-12.shop/user/config?lang=ru","fqdn":"ggj.nidnw-12.shop","domain":"nidnw-12.shop","tld":"shop"},"ip":{"addr":"154.94.239.103","port":443,"asn":44559,"as":"It Hostline Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:59.532Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ggj.nidnw-12.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 12 Dec 2025 22:39:43 GMT","end":"Thu, 12 Mar 2026 22:39:42 GMT"},"fingerprint":{"sha1":"B3:6F:4C:2C:A5:21:CF:2A:09:5B:14:D2:96:5A:7C:C7:1E:45:44:20","sha256":"C6:7D:17:E7:23:4C:3C:75:53:25:EF:65:D6:88:7D:98:17:06:DD:70:F0:E3:25:C2:1F:95:5A:D6:31:92:79:BA"}}},"request":{"raw":"POST /user/config?lang=ru HTTP/1.1\r\nHost: ggj.nidnw-12.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/json\r\nContent-Length: 18\r\nOrigin: https://fefaewfaew.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":18,"data":"{\"keyword\":\"kefu\"}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:44:59 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Requested-With, Content-Type, Accept, Authorization, User_id\r\naccess-control-allow-credentials: true\r\nset-cookie: think_lang=ru; path=/\nthink_var=ru; path=/\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":63,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"985bf22b6f72a73b157a3f71d9a960f6","sha1":"ceb85fdb06314c13147d89f0b03593cd6aa78d8f","sha256":"dcea23ce56599ea931dcd2a3163f36e7866f33167b21d23ecee528c22c0ce11e","sha512":"ebade21618b53d02304503c24f0355205176cfc4665e5e27ca180c65ec49f99795284061f265c2034f966e2f6f8a5186067da39d7b2cc4cf8a83a53530ff0868","ssdeep":"","tlshash":"02a022a080c88b8a000af808080cafc08a8800c3200883208acc8a28800c08c3002030","first_seen":"2025-12-20T07:45:23.451942Z","last_seen":"2025-12-20T07:45:23.451942Z","times_seen":1,"resource_available":false,"data":null}},"time_used":258,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":258,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.dcloud.net.cn/img/shadow-grey.png","fqdn":"cdn.dcloud.net.cn","domain":"dcloud.net.cn","tld":"net.cn"},"ip":{"addr":"106.54.228.253","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:45:01.079Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dcloud.net.cn","organization":""},"issuer":{"commonName":"Certum Domain Validation CA SHA2","organization":"Unizeto Technologies S.A."},"validity":{"start":"Tue, 26 Aug 2025 11:47:17 GMT","end":"Fri, 25 Sep 2026 11:47:16 GMT"},"fingerprint":{"sha1":"47:A7:6C:09:6B:1D:CA:2D:7D:39:2E:C1:7F:15:DE:5D:F2:C4:0F:77","sha256":"EA:73:37:83:D0:38:44:D9:3C:0B:26:F0:DD:D1:22:2F:36:F7:F2:86:A1:B0:58:52:DE:4E:0A:21:D6:89:E7:3E"}}},"request":{"raw":"GET /img/shadow-grey.png HTTP/1.1\r\nHost: cdn.dcloud.net.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:45:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 136\r\nlast-modified: Thu, 06 Jun 2019 06:42:07 GMT\r\netag: \"5cf8b5bf-88\"\r\nexpires: Sat, 20 Dec 2025 15:45:01 GMT\r\ncache-control: max-age=28800\r\nset-cookie: __uni__uid=rBEQg2lGU/1zLsUxA5W5Ag==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1 x 6, 4-bit colormap, non-interlaced","md5":"5a962adf74d92ae702467b3f47976547","sha1":"36f74049375584e3fa69b5ef87e9572336ff9e7a","sha256":"ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f","sha512":"4ace23fe7ec6c7271710030fd423aace13eafac68ac3e76366ce4ce9bdc702caf71c9bdc2fb6a32c8e9791546098617cc0259decd8bb8489afdbce43e1b53a73","ssdeep":"","tlshash":"47c09bf3a615dc754a0d153b42e98271f429511e07046d0e5a13c216741e3448d56793","first_seen":"2023-04-15T10:50:30Z","last_seen":"2026-08-06T10:33:00.039255Z","times_seen":20158,"resource_available":false,"data":null}},"time_used":1303,"timings":{"blocked":527,"dns":1,"connect":249,"send":0,"wait":248,"receive":0,"ssl":275},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-20T07:44:55.555Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Sat, 20 Dec 2025 07:44:56 GMT\r\ncontent-type: text/html; charset=utf-8\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Requested-With, Content-Type, Accept, Authorization, User_id\r\naccess-control-allow-credentials: true\r\nlocation: /h5\r\ncache-control: no-cache,must-revalidate\r\nset-cookie: think_lang=en; path=/\nPHPSESSID=9abef883750e1805e5a9e74edbcbf33b; expires=Sun, 21-Dec-2025 07:44:56 GMT; Max-Age=86400; path=/\r\nstrict-transport-security: max-age=31536000\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ssF6bDVUdxy63kreOk1WR%2FeezR9mJwkYEt49n%2FF59ykosAqFWlrV47WKnK5I7dbTtVRNg8WC5V192gmPZThn49EJZo4oUycPeDpVtw%3D%3D\"}]}\r\ncf-ray: 9b0d846d7cb2569f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1823,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T01:07:07.99671Z","times_seen":17753107,"resource_available":true,"data":null}},"time_used":1518,"timings":{"blocked":361,"dns":350,"connect":1,"send":0,"wait":788,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-20T07:44:57.488Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET /h5/ HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: think_lang=en; PHPSESSID=9abef883750e1805e5a9e74edbcbf33b\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 20 Dec 2025 07:44:57 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Mon, 15 Dec 2025 12:28:55 GMT\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000\r\ncf-cache-status: DYNAMIC\r\npriority: u=1,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5GFWNpmrZiVLlTyqLMJrGfKQzrYweSHf7KCADa7yF%2FpSHytEwkpNXy69xImHPJtKo7rjOuKiYC0S8MAUl5%2BkoZLrCe8g%2F%2BH%2FLLiPeQ%3D%3D\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9b0d847749b456af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1823,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (318), with CRLF line terminators","md5":"12d576506f345a16cc4a102e21466634","sha1":"b291db41dd70490bc2cf1b7faab49d42bb5a0f35","sha256":"9c8739de6d5ce83642178339c36d498cdf967fa4d09096ddffe8e43ed41883fb","sha512":"766b2c252ab42d57d592ffecd21aac429ea565e24a4cfccd8da02c5ad90dd0923e266ec474882805525c3b340b566f221114386dc55298517cca986b8ac992a7","ssdeep":"","tlshash":"b131cdc3e89050891662825434b2f73eaebf44225b404d363ddd3bbc6ba5fc789b9854","first_seen":"2025-12-20T06:58:35.366109Z","last_seen":"2025-12-22T07:29:25.424536Z","times_seen":10,"resource_available":false,"data":null}},"time_used":267,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":267,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/static/tabBar/icon-record.png","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:58.622Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET /h5/static/tabBar/icon-record.png HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/h5/\r\nCookie: think_lang=en; PHPSESSID=9abef883750e1805e5a9e74edbcbf33b\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 20 Dec 2025 07:44:58 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Mon, 15 Dec 2025 12:28:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"693fff07-1603b\"\r\nexpires: Mon, 19 Jan 2026 06:58:06 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 2812\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=55OKkWRNucKE2xeAUifhpATSpigMdJ%2FQIknCs9WiFzN%2Bf5WIYkaKQ1z6kXul37sNeSE1WLvCdqacBByEA2Vrh6cZazIKHpKW%2Fp7VNg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b0d847e5f4a56af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":90171,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1419 x 1252, 8-bit colormap, non-interlaced","md5":"5884440b72700aa573fb941003b5e401","sha1":"d212938223c341d7dc3b233dc208951d3853914f","sha256":"771721ee968f10372b6cb27741354f8df56a91688d2e996620368ebf0c629ba7","sha512":"7fd69f2acabe9aefae8ea0916da41f2cbe52767f4ef8cde56e436baf41086d6353dfb971cded3a5dec6722215233f1814ff731564e33ec4b633a846f849f88a3","ssdeep":"1536:Pgrpm+cSEK9RuqQ42hJpH8XY31DIQynfcoYJYWwZ91vCNqQPJZ9U1R0LWA:PIL7qfzDIQifcoYu1vkqQhPQaWA","tlshash":"1893126b42518044de9112bfd5597ecc1ab2528fa1cb98e019cbce322b77b89b643d1f","first_seen":"2025-11-21T02:11:19.006219Z","last_seen":"2025-12-22T07:29:25.432724Z","times_seen":12,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/static/images/logo.png","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:58.767Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET /h5/static/images/logo.png HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/h5/\r\nCookie: think_lang=en; PHPSESSID=9abef883750e1805e5a9e74edbcbf33b\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 20 Dec 2025 07:44:58 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Mon, 15 Dec 2025 12:28:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"693fff07-13365\"\r\nexpires: Mon, 19 Jan 2026 06:58:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 2811\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vyZBmZz4GIbfQCH%2FbkqQev8753N6ZXWaURHp4KXl9XYCXS56lA82scnvOtKes7sy38ECdBAxWXIQIGFCg8RzCD8vYux%2BGoTwDQ9myA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b0d847f3fea56af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":78693,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit colormap, non-interlaced","md5":"cd33e26712df5b8b8495c41d9086b289","sha1":"fa4ae5cc71db84635cbfbb3b803abab642f7b854","sha256":"937978ab196d02082bf08b3f72f20d67a41f669a6e94cfec49b15f19984bde55","sha512":"8bc420fd4851d2d1873b842f08d601b05ae9e128efead3cbf0b0697655533f54ab2e16e5dfc0e624c69141b33f6fe0953c30a2fba8dd0cd8842953d49679c924","ssdeep":"1536:yHb2hRf24Mu7ENVhIOdR0ImMA8Eqe540Rhi/rq9M6Q59l8T3w0CvwF:yHif24MugNVhFdR0IbA8/e54Gorqbe9c","tlshash":"c27312a4f848de86cf3d8839efb80d81b5b2d7b85956bed04d8cd3611876a25c8b1913","first_seen":"2025-12-20T06:58:35.375714Z","last_seen":"2025-12-22T07:29:25.419554Z","times_seen":11,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fefaewfaew.top/h5/static/icons/r2.png","fqdn":"fefaewfaew.top","domain":"fefaewfaew.top","tld":"top"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:58.769Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fefaewfaew.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 03:47:19 GMT","end":"Thu, 19 Mar 2026 04:36:59 GMT"},"fingerprint":{"sha1":"FA:7F:2F:15:BA:C1:DE:E5:BB:87:52:7F:D0:66:82:AC:06:01:B6:79","sha256":"8B:30:E4:34:F8:19:81:9A:7D:00:C2:08:52:04:D0:94:FA:DC:09:DC:8D:EF:EB:3A:5A:17:CB:57:B1:76:DC:89"}}},"request":{"raw":"GET /h5/static/icons/r2.png HTTP/1.1\r\nHost: fefaewfaew.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fefaewfaew.top/h5/\r\nCookie: think_lang=en; PHPSESSID=9abef883750e1805e5a9e74edbcbf33b\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 20 Dec 2025 07:44:58 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Mon, 15 Dec 2025 12:28:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"693fff07-140cb\"\r\nexpires: Mon, 19 Jan 2026 06:58:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 2811\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vOPcH%2Bznp4IiyGB4zX%2F5EJEASo8hoFeRFKiXkyUpH2E56xIyF4baX5eWopplVpC75Q1e58WUbOB5vDiPpzLhn1uU2wH8qiKrxhEcbg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b0d847f3fec56af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":82123,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1419 x 1252, 8-bit colormap, non-interlaced","md5":"9acddb3b389cd6603b2ad5d6919678f1","sha1":"d3f9b27f46c002f579de6d6d528c9b74657317cc","sha256":"c73fd68ae3369a16cbbe4889403541b9642ca2f93bf6a9e1a214b169b4d4d5c4","sha512":"18b47070fbaa24bb878982c15cc327eaa5fb77be72a7f1711a903471270072eec08840b854c6782fec41fd87d1a05c67a8723b76b6eb66f911d3f89acb57f0bd","ssdeep":"1536:rytK5elakd1/xP7K3Ccl2K0ijJPSC17R9nWCGuUaYjF+ggzgYnJ3cjJzR8/9+:rytKKaEhW3h10U7R8CGFZByvJ32K/9+","tlshash":"1e8302649ed23acbd1b95e23f579ae11530744b7cbee80caeb60903090bf73d1242e21","first_seen":"2025-11-21T02:11:19.018835Z","last_seen":"2025-12-22T07:29:25.418455Z","times_seen":12,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"fefaewfaew.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"fefaewfaew.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ggj.nidnw-12.shop/user/config?lang=ru","fqdn":"ggj.nidnw-12.shop","domain":"nidnw-12.shop","tld":"shop"},"ip":{"addr":"154.94.239.103","port":443,"asn":44559,"as":"It Hostline Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://fefaewfaew.top/h5/","date":"2025-12-20T07:44:58.776Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ggj.nidnw-12.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 12 Dec 2025 22:39:43 GMT","end":"Thu, 12 Mar 2026 22:39:42 GMT"},"fingerprint":{"sha1":"B3:6F:4C:2C:A5:21:CF:2A:09:5B:14:D2:96:5A:7C:C7:1E:45:44:20","sha256":"C6:7D:17:E7:23:4C:3C:75:53:25:EF:65:D6:88:7D:98:17:06:DD:70:F0:E3:25:C2:1F:95:5A:D6:31:92:79:BA"}}},"request":{"raw":"OPTIONS /user/config?lang=ru HTTP/1.1\r\nHost: ggj.nidnw-12.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type\r\nReferer: https://fefaewfaew.top/\r\nOrigin: https://fefaewfaew.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:44:59 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Requested-With, Content-Type, Accept, Authorization, User_id\r\naccess-control-allow-credentials: true\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T01:07:07.99671Z","times_seen":17753107,"resource_available":true,"data":null}},"time_used":1224,"timings":{"blocked":478,"dns":0,"connect":245,"send":0,"wait":248,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}