{"report_id":"ab36e79b-698b-4e43-ac12-57b1cdce50c7","version":6,"status":"done","tags":[],"date":"2026-04-08T22:46:10Z","url":{"schema":"http","addr":"hentaicovid.vip/upload/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"title":"HentaiCovid — image — RIDf9DzOScJgFtg-NHDTC-184_s.jpg","dom":{"size":149638,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (31463)","md5":"db52e7b3b655ba48e6dc010c57d4cd3d","sha1":"1d312d551bcffc9ed8db28cdd8c36af161036645","sha256":"05983e7b3c6dcbce5a42f09994263c6c667adbc30c50bd5c9c4354ad887d4be0","sha512":"da5fb794e40ae1184caf7a72363a56a25785bfc722db2ce9f129b45fc52dc4998255b232f3887e04e4bd1527fb033a63e3faa80a3c6caf01cf373d59462a1e6a","ssdeep":"3072:HI8v45HKUI6fe25zDEzTH6gUbCjrtF/Z7yho0g7BuEE:HIk45qse25zDE3NrtpZ7yho0g7BuEE","tlshash":"abe30822a281503b715382493af1e7487af5815bfd530ca87aece2c05fcbeda4d77265","dom_hash":"domhashb23f0eba516cacbdaa0aa69f425f4d42","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"hentaicovid.vip/upload/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-13T22:46:10Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":5}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-08T22:45:46Z","timestamp":1775688346,"ip_dst":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":34896,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M1","source":"{\"timestamp\":\"2026-04-08T22:45:46.166750+0000\",\"flow_id\":84051882569878,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.5\",\"src_port\":34896,\"dest_ip\":\"104.21.75.45\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029707,\"rev\":9,\"signature\":\"ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M1\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2020_03_23\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_03_28\"]}},\"tls\":{\"sni\":\"hentaicovid.vip\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":2611,\"start\":\"2026-04-08T22:45:46.159894+0000\"}}"}],"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"u3y8v8u4.aucdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-04-05T22:35:26.697622Z","alert_count":0,"request_count":1,"received_data":80768,"sent_data":423,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-04-05T22:33:08.106483Z","alert_count":0,"request_count":1,"received_data":103227,"sent_data":462,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"s.pemsrv.com","ip":{"addr":"95.211.229.248","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2023-08-01","domain_rank":104334,"first_seen":"2023-08-04T13:10:46Z","last_seen":"2026-04-02T04:58:20.596962Z","alert_count":0,"request_count":1,"received_data":251,"sent_data":439,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"hentaicovid.vip","ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-02-24","domain_rank":0,"first_seen":"2026-03-18T05:48:41.412836Z","last_seen":"2026-04-04T07:36:01.988011Z","alert_count":0,"request_count":25,"received_data":2124383,"sent_data":30372,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Clipboard.js","description":"","website":"https://clipboardjs.com/","common_platform_enumeration":"","icon":"Clipboard.js.svg","categories":["JavaScript libraries"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"jQuery:3.6.0","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"SweetAlert2:11","description":"SweetAlert2 is a JavaScript library that provides customisable, visually appealing, and responsive alert and modal dialog boxes for web applications.","website":"https://sweetalert2.github.io/","common_platform_enumeration":"","icon":"SweetAlert2.svg","categories":["JavaScript libraries"]}]},{"fqdn":"s.magsrv.com","ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2023-08-01","domain_rank":47665,"first_seen":"2023-08-04T12:48:00Z","last_seen":"2026-04-03T03:48:25.345536Z","alert_count":29,"request_count":29,"received_data":89129,"sent_data":24173,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"a.magsrv.com","ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"domain_registered":"2023-08-01","domain_rank":51490,"first_seen":"2023-08-04T16:18:00Z","last_seen":"2026-04-01T23:42:16.745129Z","alert_count":20,"request_count":10,"received_data":1889470,"sent_data":4150,"comment":"","tags":null,"fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}]},{"fqdn":"pagead2.googlesyndication.com","ip":{"addr":"142.250.178.66","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2003-01-21","domain_rank":610,"first_seen":"2012-05-21T07:15:40Z","last_seen":"2026-04-06T16:07:23.922146Z","alert_count":0,"request_count":1,"received_data":162143,"sent_data":471,"comment":"","tags":null,"fingerprints":null},{"fqdn":"a.pemsrv.com","ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"domain_registered":"2023-08-01","domain_rank":181476,"first_seen":"2023-08-05T12:08:36Z","last_seen":"2026-04-04T13:25:47.606933Z","alert_count":0,"request_count":1,"received_data":122790,"sent_data":416,"comment":"","tags":null,"fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}]},{"fqdn":"code.jquery.com","ip":{"addr":"151.101.66.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2005-12-10","domain_rank":4915,"first_seen":"2012-05-21T17:28:02Z","last_seen":"2026-04-05T23:05:20.049371Z","alert_count":0,"request_count":1,"received_data":90137,"sent_data":423,"comment":"","tags":null,"fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"s3t3d2y1.afcdn.net","ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"domain_registered":"2022-06-27","domain_rank":0,"first_seen":"2025-11-21T12:51:16.33547Z","last_seen":"2026-04-04T07:36:01.940154Z","alert_count":37,"request_count":37,"received_data":8874356,"sent_data":19233,"comment":"","tags":null,"fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.251.38.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-04-05T22:16:34.770209Z","alert_count":0,"request_count":3,"received_data":131913,"sent_data":1650,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-04-05T22:20:18.514512Z","alert_count":0,"request_count":2,"received_data":38714,"sent_data":955,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"u3y8v8u4.aucdn.net","ip":{"addr":"95.173.205.15","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"domain_registered":"2022-06-27","domain_rank":57444,"first_seen":"2022-08-08T13:30:47Z","last_seen":"2026-04-04T03:44:53.098577Z","alert_count":1,"request_count":1,"received_data":3932783,"sent_data":550,"comment":"","tags":null,"fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"de7507ad26c6c904109c87dd5dfac288","sha1":"952cae1ce6ce1e74b010b31b4357424c12a5960c","sha256":"09f81a5c463b570b389ce0b118a29bf489353d0ae7d47eefee9b9e7b703e0e02","sha512":"bf1e05b722c1990f20aba1abe8aa7bedeb660957e0adc012e757cfa9cd9b4d13b39d5f7d0688bc341f7d630b28c160b3e22dacc0ac0f9f37ed22230e6ffe68b1","ssdeep":"","tlshash":"fba002353403501e20265c517d266a0cf84e9475e198345707070470d0e3c4b5d004c7","size":59,"data":"","first_seen":"2023-03-07T01:02:10Z","last_seen":"2026-04-09T01:51:18.599724Z","times_seen":11501,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/vendor/libs/jquery/jquery.min.js","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","size":89501,"data":"","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-04-09T01:36:24.334373Z","times_seen":447096,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/vendor/libs/bootstrap/bootstrap.bundle.min.js","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"74d375bb9f1208a67546d7b1b9e7b73c","sha1":"11aad571327ebccf184e62ec03b32c67a028846f","sha256":"8f27c2a51f4f713efda3881de03697fdce7a5022874d94d5256e106e0322d598","sha512":"459019069586a628c3a957ed609bc77a7d08c3258cfa6d7d9eeeeea6b46b29d9703e3f2682123ef09a7807079b35dacf522136d39377ce412d6fb83466c42701","ssdeep":"1536:tp+1ZTPR2t4tXbih05ve8/pwgrEpc9t0vSAIAxCH:MFRIpk0vSAW","tlshash":"5673d7493254b87309ee55a68037460bf3255994b14b802cb9bdadde2b3dc8272b7f78","size":78695,"data":"","first_seen":"2023-03-07T12:10:33Z","last_seen":"2026-04-08T22:46:20.077043Z","times_seen":397,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"41eece0da217398b6f4d4ee2f01b6245","sha1":"72f2098b0520b07dd3c6874646c920a3d367a4e2","sha256":"62bba8c2295a14bb2d007a3f7f8730fd10cef7348a6474f3f832c99ca6795d35","sha512":"1009ef0076bfb735c9b40fa3b106c8de414943b27fd74cfd315265ad768592a9d3eaf408c2392269659fb5af26c32f454d8f8a86fe0044d5a0c46ef424ebe207","ssdeep":"","tlshash":"dec09b3d110413fedfd5359ddc05667d1811b1b1d1918cb04715d527605de144cf3801","size":134,"data":"","first_seen":"2023-03-07T01:02:10Z","last_seen":"2026-04-09T01:53:00.730886Z","times_seen":11727,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/vendor/libs/toastr/toastr.min.js","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"57b703726fe13ac3579b559e7dfc7a46","sha1":"9691d795cfa6c5c4af45f1439a9b3f3782e6ee6e","sha256":"7fe565f3385448e1ec8d57dc2c1639d723561f1aabc2e3d547e284bbf9f9b073","sha512":"c6e60b917e6d285befafa3bd2bfb144a8b1bb8344418498ff86d1c54ff459ee288ef9f9520b03995ff3005094f077edd823134575a63bf7cb159aa899c335a1a","ssdeep":"96:OdCZR1JHduRv75dR+FIEHXX9oxNDP9mA1UZsEyHGJAcCwV02tfrS:O4BtcvvRqIQcNa74c7rS","tlshash":"b2b18384b220b78b1bb31079919f140b937673b2ccce5440763aa9987e7082c97a7fdd","size":5217,"data":"","first_seen":"2023-03-07T12:25:14Z","last_seen":"2026-04-08T22:46:20.10198Z","times_seen":231,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","size":188413,"data":"","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"de7507ad26c6c904109c87dd5dfac288","sha1":"952cae1ce6ce1e74b010b31b4357424c12a5960c","sha256":"09f81a5c463b570b389ce0b118a29bf489353d0ae7d47eefee9b9e7b703e0e02","sha512":"bf1e05b722c1990f20aba1abe8aa7bedeb660957e0adc012e757cfa9cd9b4d13b39d5f7d0688bc341f7d630b28c160b3e22dacc0ac0f9f37ed22230e6ffe68b1","ssdeep":"","tlshash":"fba002353403501e20265c517d266a0cf84e9475e198345707070470d0e3c4b5d004c7","size":59,"data":"","first_seen":"2023-03-07T01:02:10Z","last_seen":"2026-04-09T01:51:18.599724Z","times_seen":11501,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"dff932eb62b0ddaac2211366b4b01ebc","sha1":"9dab4d6ec387b84659b55330837eb7377f8d4f90","sha256":"6a95709e3e4f44a0dc86ff470f0d2bb12eb97af1cbd52c67542c43e693392bb6","sha512":"b60004f4b5caf487000de2d2f7ad7844afe6153f3d487d0ad001e009daf990122e3bcdce29b9cc80502df28d3429f0d3fab8fa22923f9f37efdef6cba77f1c54","ssdeep":"","tlshash":"1a9002da71c371009653326c407f188d613988e5288c4940915094922c6503491269ac","size":53,"data":"","first_seen":"2025-01-25T20:39:32.065702Z","last_seen":"2026-04-08T22:46:20.106966Z","times_seen":1348,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/vendor/libs/simplebar/simplebar.min.js","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"bf2b0f78573ead4df6e17118b903a511","sha1":"c77999cef664c81938a5ddfb278b6cb217392d7d","sha256":"39c3c7a018149bfa70ac78df0f5d49a74c909da2aed3c7c9ae24a5592e9bbff9","sha512":"012f6b6590dd6fecb85b695c9a4346c1fe2cc26ebad3b5c96293524f59a434151f04191af1bb40ea68119a1a0543d526cbc363fdf839e38e3e4a094b1dba30b8","ssdeep":"1536:yo1qP3bArH8Ci4oO0RFs6e8KllDr9Im0nhOwEz+2/5f+Nh8cQBibzd+QfhanKrHf:yWqPrArH5XoNs6yDvMz2/5fkh8cQBibD","tlshash":"1543d8cdb292b07203e76266803f410af33a59a9750e4098f67dd9e97cb89495277f3c","size":58168,"data":"","first_seen":"2023-03-07T12:57:00Z","last_seen":"2026-04-08T22:46:20.065943Z","times_seen":194,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","size":188413,"data":"","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"de7507ad26c6c904109c87dd5dfac288","sha1":"952cae1ce6ce1e74b010b31b4357424c12a5960c","sha256":"09f81a5c463b570b389ce0b118a29bf489353d0ae7d47eefee9b9e7b703e0e02","sha512":"bf1e05b722c1990f20aba1abe8aa7bedeb660957e0adc012e757cfa9cd9b4d13b39d5f7d0688bc341f7d630b28c160b3e22dacc0ac0f9f37ed22230e6ffe68b1","ssdeep":"","tlshash":"fba002353403501e20265c517d266a0cf84e9475e198345707070470d0e3c4b5d004c7","size":59,"data":"","first_seen":"2023-03-07T01:02:10Z","last_seen":"2026-04-09T01:51:18.599724Z","times_seen":11501,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"de7507ad26c6c904109c87dd5dfac288","sha1":"952cae1ce6ce1e74b010b31b4357424c12a5960c","sha256":"09f81a5c463b570b389ce0b118a29bf489353d0ae7d47eefee9b9e7b703e0e02","sha512":"bf1e05b722c1990f20aba1abe8aa7bedeb660957e0adc012e757cfa9cd9b4d13b39d5f7d0688bc341f7d630b28c160b3e22dacc0ac0f9f37ed22230e6ffe68b1","ssdeep":"","tlshash":"fba002353403501e20265c517d266a0cf84e9475e198345707070470d0e3c4b5d004c7","size":59,"data":"","first_seen":"2023-03-07T01:02:10Z","last_seen":"2026-04-09T01:51:18.599724Z","times_seen":11501,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"de7507ad26c6c904109c87dd5dfac288","sha1":"952cae1ce6ce1e74b010b31b4357424c12a5960c","sha256":"09f81a5c463b570b389ce0b118a29bf489353d0ae7d47eefee9b9e7b703e0e02","sha512":"bf1e05b722c1990f20aba1abe8aa7bedeb660957e0adc012e757cfa9cd9b4d13b39d5f7d0688bc341f7d630b28c160b3e22dacc0ac0f9f37ed22230e6ffe68b1","ssdeep":"","tlshash":"fba002353403501e20265c517d266a0cf84e9475e198345707070470d0e3c4b5d004c7","size":59,"data":"","first_seen":"2023-03-07T01:02:10Z","last_seen":"2026-04-09T01:51:18.599724Z","times_seen":11501,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/js/application.4936becb62852bad09281e60fb01ab7b.js","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"33aa175c8756312b95d34b618c66b939","sha1":"3494c3161d13bcefe2df8bc52ad7d6562795d59a","sha256":"6ae8e944bdf76655a23f9818a20e8e2b66e1665540f97c742558aa7061b6f64b","sha512":"8266651c5cb83cfe77bb15b0e5f6ef3bd113c9dcd9e53ba321cd7b870034aaf3bd1a01ebf718818e7436d2122fabb53ee3e7442470e0acd0cc18a1963540b8ff","ssdeep":"768:XOoBV4qELGCWnqe0C8UbbY8HEzkpP2nluCY:XcqEKqe5/2nEh","tlshash":"e013b71ab5f119749267b1a5896f8608b270522b8d0add043c2cd6c94f6cc7c57fbbec","size":44337,"data":"","first_seen":"2024-08-19T18:10:16.695944Z","last_seen":"2026-04-08T22:46:20.085036Z","times_seen":37,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","size":188413,"data":"","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"a.pemsrv.com/popunder1000.js","fqdn":"a.pemsrv.com","domain":"pemsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"8b4068331d16fce51c286cc6e411facd","sha1":"bf02d30fb1fe9693af3f72a2e41cac284c44fd0c","sha256":"c74f376507b893d47c70f03562cabd6bc5135e6e13d8689878c8f8a0b2844b76","sha512":"f44effa59dc95ec29631f207ba1aaa6287489f47ed94029942bc14fc676dafa03943c73ff0fceee53b75f4f3d0e456eadb1c586363563751115f166666a81d88","ssdeep":"3072:drCqGR9VdpPtCgzTNiQ4n8701l21bMp1qk:XGjVdhdQQOe+p4k","tlshash":"28c35140210748e521e2e67ed56fb0993c24a823f5e9cda76c05e7c1f8dec99069bde3","size":122256,"data":"","first_seen":"2026-04-02T16:18:07.313899Z","last_seen":"2026-04-09T01:51:18.589896Z","times_seen":45,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"4d4c6ddda391c260d53369f60a054f25","sha1":"878b27c68da4ef9150052914091c91776851bd00","sha256":"090b4c07e151a213476b758c78a66ada0a6ccadbbde9cb28ab83ce6e763c1e4b","sha512":"115b96149e6ff6214ce3ec34ccabf947b2767be1bc931467a8ade7cc20d59772c39cd67ce1cb38d02f4234e2b289cad85d8dddefa9531be5da808ee226c894ff","ssdeep":"","tlshash":"1801467b70f2287111a3e4708d5b0493313084270443e474b49cc2884f69bf598d7ee7","size":658,"data":"","first_seen":"2024-08-19T18:10:16.696558Z","last_seen":"2026-04-08T22:46:20.107524Z","times_seen":21,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"de7507ad26c6c904109c87dd5dfac288","sha1":"952cae1ce6ce1e74b010b31b4357424c12a5960c","sha256":"09f81a5c463b570b389ce0b118a29bf489353d0ae7d47eefee9b9e7b703e0e02","sha512":"bf1e05b722c1990f20aba1abe8aa7bedeb660957e0adc012e757cfa9cd9b4d13b39d5f7d0688bc341f7d630b28c160b3e22dacc0ac0f9f37ed22230e6ffe68b1","ssdeep":"","tlshash":"fba002353403501e20265c517d266a0cf84e9475e198345707070470d0e3c4b5d004c7","size":59,"data":"","first_seen":"2023-03-07T01:02:10Z","last_seen":"2026-04-09T01:51:18.599724Z","times_seen":11501,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/js/extra/extra.js","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1ea368b0d1884c14d0ef31525ede5718","sha1":"4f2324cba8533195f596b6b4b27dba75cce31c02","sha256":"d5e2cfc10e90c257761d93ea813670288980565c75ecb14efe3e2851a6bf76a7","sha512":"b80159f0328b03269f12b1708dd92076c15999e581be51f62d012591f1ff78a8401c3a8d0a258b926767cff44a63bcafb7808ad3ff6055851a7d62f5c7027157","ssdeep":"","tlshash":"4331e11e32ba947d80b7706a5abf9d093931044b1608fe087f5c77a05f445eea9f27c6","size":1646,"data":"","first_seen":"2023-03-14T16:40:15Z","last_seen":"2026-04-08T22:46:20.074429Z","times_seen":64,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/vendor/libs/clipboard/clipboard.min.js","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"274d5f6334c31fdb1b0464a912fa7f15","sha1":"35cff8543a2d61e22eaa1c565b3457675c04571a","sha256":"261ffa06f381039cf7d18984d1364c59f3c2b9b60b1fa05d5f9c8c152e4d5be5","sha512":"380bc3817f49c8557c68892de13bc5859af1db49e8d13f1d31e2397f353afc119d5b87aabea1360f66a0d4f2524ba5325ba9dde8b14a05fe3a3ce57a9736b9e0","ssdeep":"192:iJBFlYPHiG9JyHc4LyAahpBv/hjMwsfkApXMdgmkpj:i9yKG9JWzihZjM9/XMmmkpj","tlshash":"59126599b291b0b15ad731a8412f920ff3766869708b90d0d239d4f0acbcdde4863f2d","size":9031,"data":"","first_seen":"2023-03-07T12:25:14Z","last_seen":"2026-04-09T01:39:11.081431Z","times_seen":2118,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","size":188413,"data":"","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"41eece0da217398b6f4d4ee2f01b6245","sha1":"72f2098b0520b07dd3c6874646c920a3d367a4e2","sha256":"62bba8c2295a14bb2d007a3f7f8730fd10cef7348a6474f3f832c99ca6795d35","sha512":"1009ef0076bfb735c9b40fa3b106c8de414943b27fd74cfd315265ad768592a9d3eaf408c2392269659fb5af26c32f454d8f8a86fe0044d5a0c46ef424ebe207","ssdeep":"","tlshash":"dec09b3d110413fedfd5359ddc05667d1811b1b1d1918cb04715d527605de144cf3801","size":134,"data":"","first_seen":"2023-03-07T01:02:10Z","last_seen":"2026-04-09T01:53:00.730886Z","times_seen":11727,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"de7507ad26c6c904109c87dd5dfac288","sha1":"952cae1ce6ce1e74b010b31b4357424c12a5960c","sha256":"09f81a5c463b570b389ce0b118a29bf489353d0ae7d47eefee9b9e7b703e0e02","sha512":"bf1e05b722c1990f20aba1abe8aa7bedeb660957e0adc012e757cfa9cd9b4d13b39d5f7d0688bc341f7d630b28c160b3e22dacc0ac0f9f37ed22230e6ffe68b1","ssdeep":"","tlshash":"fba002353403501e20265c517d266a0cf84e9475e198345707070470d0e3c4b5d004c7","size":59,"data":"","first_seen":"2023-03-07T01:02:10Z","last_seen":"2026-04-09T01:51:18.599724Z","times_seen":11501,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"5f4f87e368f94555357d00f9b7e8ed4c","sha1":"db0173149e571a755cef6a33bb0063382f1b1ba9","sha256":"f997368baa677bfcf69257707de671a58de76eee3cf27855226cc417ec78dad8","sha512":"c99aaf4acc8b400f38f613df5373af1ee8c03a0b51ff5486bff9c2229d600506a00e9292ce6903a830108e5819b4d84509c8792e39d42df9c628110d70169c59","ssdeep":"","tlshash":"2d8004d535c3500447d3115400571cd45034c57115444d404054dc511d55034711545c","size":37,"data":"","first_seen":"2023-08-05T22:12:59Z","last_seen":"2026-04-08T22:46:20.108494Z","times_seen":1181,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"de7507ad26c6c904109c87dd5dfac288","sha1":"952cae1ce6ce1e74b010b31b4357424c12a5960c","sha256":"09f81a5c463b570b389ce0b118a29bf489353d0ae7d47eefee9b9e7b703e0e02","sha512":"bf1e05b722c1990f20aba1abe8aa7bedeb660957e0adc012e757cfa9cd9b4d13b39d5f7d0688bc341f7d630b28c160b3e22dacc0ac0f9f37ed22230e6ffe68b1","ssdeep":"","tlshash":"fba002353403501e20265c517d266a0cf84e9475e198345707070470d0e3c4b5d004c7","size":59,"data":"","first_seen":"2023-03-07T01:02:10Z","last_seen":"2026-04-09T01:51:18.599724Z","times_seen":11501,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","size":188413,"data":"","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","size":188413,"data":"","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"de7507ad26c6c904109c87dd5dfac288","sha1":"952cae1ce6ce1e74b010b31b4357424c12a5960c","sha256":"09f81a5c463b570b389ce0b118a29bf489353d0ae7d47eefee9b9e7b703e0e02","sha512":"bf1e05b722c1990f20aba1abe8aa7bedeb660957e0adc012e757cfa9cd9b4d13b39d5f7d0688bc341f7d630b28c160b3e22dacc0ac0f9f37ed22230e6ffe68b1","ssdeep":"","tlshash":"fba002353403501e20265c517d266a0cf84e9475e198345707070470d0e3c4b5d004c7","size":59,"data":"","first_seen":"2023-03-07T01:02:10Z","last_seen":"2026-04-09T01:51:18.599724Z","times_seen":11501,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","size":188413,"data":"","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"e59886778973beecdc17c286ea339456","sha1":"a87a8f991d858a1139331c6d8a0633e78f29ba5a","sha256":"94740512660e7406147daabe8b62f19b9d05cace57418437678add09754a7fb6","sha512":"4d618a83ba643ee37f1f3a10f058324ced4dae15f1c506857344fe293c40848482076d4d945dac3c0930aee4110ddd77a36c953eaf9c65336db6bd9f56a0897e","ssdeep":"","tlshash":"02f0614774542c924353168640fb1046561124b78d173c7a3b0ed2c53f6f52f68f344c","size":439,"data":"","first_seen":"2026-03-18T05:48:46.248868Z","last_seen":"2026-04-08T22:46:20.109069Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"0fd7ea23933a0d012e0f790673ac5845","sha1":"b8200c76509f3f5ead9ca853f159adaecc5e8802","sha256":"76b0340e3257a7d52d0d64fd10e65a1e07b9e284b46b110ff8a5cae9ae4cf361","sha512":"eab21347362e4968c27d48aa7aec17a762d59c0395a9e9099b9cfde6c02404d1c109ead8b74743fe577d125ba3fa77b15a4e80f431be0ad798fcf40db5bc69ee","ssdeep":"","tlshash":"f021591eb7f757807623b125d9ab840ce9364a87141c5f14bdacb1d07f64e3c04a9bb4","size":1274,"data":"","first_seen":"2025-05-31T20:41:36.395948Z","last_seen":"2026-04-08T22:46:20.109638Z","times_seen":20,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","size":188413,"data":"","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"ed08ae4579d68913113552abc3ddf7d6","sha1":"4af2ed6d85d0fedc375211bbf1ea2fc15d547fd5","sha256":"934e588e9ba2f1d134206ed77b5811954d3fe68fc058cd14a9678a712e21f715","sha512":"08f144b53cc4743169a9a4a1768a68af8cf10cf6446015b60084c6e130d58b0f7425eaa5d0bdc8737984fe8d670f1dd4d2b7c1aec4874ed4dd41fca185ed4a67","ssdeep":"","tlshash":"c6b09213049a9ca312a8acc9c182c417ce040bba2015b83578bdf186af0584d90b2651","size":114,"data":"","first_seen":"2023-03-09T03:55:40Z","last_seen":"2026-04-08T22:46:20.110561Z","times_seen":89,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.6.0.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.66.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","size":89501,"data":"","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-04-09T01:36:24.334373Z","times_seen":447096,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/sweetalert2@11","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e8f033d3c7a50e4abe3d98ac65234d13","sha1":"caf431ea6dc8567be010d07f4f7d5798163821de","sha256":"7506c8f4d85e4707ab46f9858f0c6e65e3316b9d2f122dcf485b9dbf39d5a7ac","sha512":"ecad9d89ce602e5121c97135933a33122f0d9b32c15b43949d5fbe51fe576da069e9a416772117eb4666d8354b685046c0d7a3e086f669fffa488e2f05ff0ba3","ssdeep":"1536:iw46xylPIZSKcO355lcVU/SZ2DUdzI8bRj:PxYIvTlcVU/62mI8d","tlshash":"e173f8916a00f03776bb45ae65d1e7047ae99405fcb34894f42cc8804fe7d4f26b7aba","size":79991,"data":"","first_seen":"2026-03-20T09:57:21.567576Z","last_seen":"2026-04-09T00:01:31.957174Z","times_seen":693,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"6f2863a5c69d962639db1c21645c5d6b","sha1":"b34a230efe017323a7bf494d54e248eeb0adb623","sha256":"fca2940afb38832622722a45c6d14906f5aa41871beceb4a4642d129b482c702","sha512":"79a7476e25bdfe40b0fd1b14acec0840be35fc6d78337c9bf742dcb3ed0bfa2ee5b7a56c9599da240874d7a7bb218e3baa5756bb155d9555c611a7ae2cdb886a","ssdeep":"","tlshash":"1f1108144208abdb9f96a7d554522e0146ae23b3c0de2d88efac0c585ef0b52793729f","size":874,"data":"","first_seen":"2023-03-07T12:25:14Z","last_seen":"2026-04-08T22:46:20.111181Z","times_seen":204,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"de7507ad26c6c904109c87dd5dfac288","sha1":"952cae1ce6ce1e74b010b31b4357424c12a5960c","sha256":"09f81a5c463b570b389ce0b118a29bf489353d0ae7d47eefee9b9e7b703e0e02","sha512":"bf1e05b722c1990f20aba1abe8aa7bedeb660957e0adc012e757cfa9cd9b4d13b39d5f7d0688bc341f7d630b28c160b3e22dacc0ac0f9f37ed22230e6ffe68b1","ssdeep":"","tlshash":"fba002353403501e20265c517d266a0cf84e9475e198345707070470d0e3c4b5d004c7","size":59,"data":"","first_seen":"2023-03-07T01:02:10Z","last_seen":"2026-04-09T01:51:18.599724Z","times_seen":11501,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"604f502fe4c6456d6bb265cb2284fb27","sha1":"d89e9070dbf98e6fd3d11a55c0670a7ff04c25c1","sha256":"a2410b14d75875d471b0d06e322fd6aaf2b5c467db9dc1fc0fcf60114246a47e","sha512":"face901557c168234f5fc0c4f0e2766401909aa1cc334c3bb42f415580aa28f7f773f0673f63f5579069699039b71991df2ad8b52246cc38307b14081bcff9d9","ssdeep":"","tlshash":"a0f0d81e70566164057b64b20e1f6409b933581f6a4a9c24bc0cc5e06f97569d1e736c","size":649,"data":"","first_seen":"2026-04-04T07:36:06.944361Z","last_seen":"2026-04-08T22:46:20.111605Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","size":188413,"data":"","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","size":188413,"data":"","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null},"http":[{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.6.0.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.66.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.825Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Thu, 12 Jun 2025 00:00:00 GMT","end":"Fri, 26 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"56:36:FB:D3:E0:9E:71:88:98:A4:C9:34:94:9B:43:3A:C4:C5:1E:BE","sha256":"9A:64:20:6F:F5:DC:F1:8A:D6:B2:D0:93:C2:7E:62:86:0B:1A:D5:24:CF:CE:4A:9F:4C:0D:F1:FB:F2:A0:A8:1E"}}},"request":{"raw":"GET /jquery-3.6.0.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-15d9d\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\nage: 1358962\r\nx-served-by: cache-lga21931-LGA, cache-hel1410026-HEL\r\nx-cache: HIT, HIT\r\nx-cache-hits: 71, 423380\r\nx-timer: S1775688347.848202,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 30875\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":89501,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-04-09T01:36:24.334373Z","times_seen":447096,"resource_available":true,"data":null}},"time_used":96,"timings":{"blocked":16,"dns":1,"connect":18,"send":0,"wait":13,"receive":7,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/940460/e859c1ed80b2fbfed84e5716274ac1d2b5649628.mp4","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:48.021Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/940460/e859c1ed80b2fbfed84e5716274ac1d2b5649628.mp4 HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 271106\r\nlast-modified: Tue, 06 May 2025 18:22:17 GMT\r\netag: \"681a5359-42302\"\r\nexpires: Wed, 06 May 2026 18:42:24 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap01-sec02-prg1-1\r\nx-77-nzt: k+ni6BrV8MS9hObRb2qy/Isgk3aSWBFuBNccTuHhDUBFTzTFP5QYhtnwPIZQgiEb0T8/yJU\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad6694658c834\r\nx-77-cache: HIT\r\nx-77-age: 29050615\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\ncontent-range: bytes 0-271105/271106\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":271106,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"0218e5495479c26a92ca8d038bd9e8a5","sha1":"e859c1ed80b2fbfed84e5716274ac1d2b5649628","sha256":"c7ae51578cf521ff61cdad300dc1be900e665ee52e3ae7aabb203465d0f59b79","sha512":"a378452b3d8b61442acd714cf0586042bf209803668006e02a03e6b839662d920feb8d3666759b82dd7272086f6817966ab09241c3ecd10d29be527e14ece02b","ssdeep":"6144:OLUBCOfa4Mm2DGqv3n/5I5BgpJdazPBtrGbgCJK/VRS:c8Z9QyLBtrKgZ90","tlshash":"774401486f3410e6fa15037c5cb7c70abb72c650672a914b17407696fdba3c1dee0ae9","first_seen":"2025-08-17T20:59:03.552958Z","last_seen":"2026-04-08T22:46:20.056031Z","times_seen":62,"resource_available":false,"data":null}},"time_used":47,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/319620/f2c68402a775092274c1e344575ca09028967560.mp4","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:48.037Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/319620/f2c68402a775092274c1e344575ca09028967560.mp4 HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 355699\r\nlast-modified: Thu, 25 Sep 2025 15:50:13 GMT\r\netag: \"68d564b5-56d73\"\r\nexpires: Tue, 06 Apr 2027 15:45:55 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\naccess-control-expose-headers: Content-Range\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap02-sec01-prg1-1\r\nx-77-nzt: k7mUXpP++0qiopCpFshU7DFaloCjtCTdjjlUytVHuCgnrWRn6nmes/WdgeSg\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad669dc07a037\r\nx-77-cache: HIT\r\nx-77-age: 197992\r\ncontent-range: bytes 0-355698/355699\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":355699,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"e5d404764e6b69da143508bb0b9cfbac","sha1":"f2c68402a775092274c1e344575ca09028967560","sha256":"5e4b7c7d1eb4d6067db008840471bfd0f3292a95e700b16848902001a3a5e622","sha512":"dd77355bbcd0ab773573fc4f1b503d54a1b950054d08e4ed1c075da6bcf875ddebb755528985c917af384484b4cf61d5c3a67c4ef956b58e90a51759faccf72f","ssdeep":"6144:bv4OKFWfeIOAEy8rdyUNKXRUy9iEl7ycQcRekn9pATyoPBuD:bv4FgOJRNKSy9HyWRekn90PPBuD","tlshash":"8b74234c25c6249fe6bea1fbd15a71b6cc85e680589beff38458ceb900d41c96ce05bc","first_seen":"2025-09-26T03:32:59.403074Z","last_seen":"2026-04-08T23:23:59.081943Z","times_seen":73,"resource_available":false,"data":null}},"time_used":96,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":86,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/vendor/libs/clipboard/clipboard.min.js","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.833Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/assets/vendor/libs/clipboard/clipboard.min.js HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Tue, 29 Jun 2021 20:03:06 GMT\r\nvary: Accept-Encoding\r\netag: \"60db7c7a-2347\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=J7c9i%2FVt9NrRnrbeUwJc0gGNbMvb9pS9w2gH7S5ksXszss2Vt0nwhRMUEQmC%2B4HuK%2FD0jtHo69RFz8TE5xw7W1hnIxikDHJQJXasrkRSjqmFkf5hOnYXO%2BARgJfpO4WxFRs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e94cde78b5db4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9031,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (8939)","md5":"274d5f6334c31fdb1b0464a912fa7f15","sha1":"35cff8543a2d61e22eaa1c565b3457675c04571a","sha256":"261ffa06f381039cf7d18984d1364c59f3c2b9b60b1fa05d5f9c8c152e4d5be5","sha512":"380bc3817f49c8557c68892de13bc5859af1db49e8d13f1d31e2397f353afc119d5b87aabea1360f66a0d4f2524ba5325ba9dde8b14a05fe3a3ce57a9736b9e0","ssdeep":"192:iJBFlYPHiG9JyHc4LyAahpBv/hjMwsfkApXMdgmkpj:i9yKG9JWzihZjM9/XMmmkpj","tlshash":"59126599b291b0b15ad731a8412f920ff3766869708b90d0d239d4f0acbcdde4863f2d","first_seen":"2023-03-07T12:25:14Z","last_seen":"2026-04-09T01:39:11.081431Z","times_seen":2118,"resource_available":true,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQW2oDMQy8Si8QM7Jlr53vfrfQ0gM43t12P/IgCUsKOnwlp5TSejAIa0aasYdPG/AG+YHyluOWBynkChx7R5Hl6flFmORjOlzr0o7rMrp1OUmgkjykZJ/IC6F4ZJaYc9BSIrKkjBR1ACHGAmMxJAgUPgZmqxxImQPk7fWxX1LouIRbArS27TKo1Do+40bwppxyyTXyiKbcyJ7meWh+mmsDpTHPSsc/z7jDcabY9+AHG+MH4uDVmB5If66Xz0MT+UU0xB7DbJjqb/eOEL4DovSYPZk1Lm5f3y/n1bXjXp9M7sxJMQbrF631vNTrcjz0rklkHGsApkJzCAS1ybs8t2FXyE9hF8sXTcLx5sUBAAA=\u0026cb=e2e_69d6da9b923433.46800366","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.920Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQW2oDMQy8Si8QM7Jlr53vfrfQ0gM43t12P/IgCUsKOnwlp5TSejAIa0aasYdPG/AG+YHyluOWBynkChx7R5Hl6flFmORjOlzr0o7rMrp1OUmgkjykZJ/IC6F4ZJaYc9BSIrKkjBR1ACHGAmMxJAgUPgZmqxxImQPk7fWxX1LouIRbArS27TKo1Do+40bwppxyyTXyiKbcyJ7meWh+mmsDpTHPSsc/z7jDcabY9+AHG+MH4uDVmB5If66Xz0MT+UU0xB7DbJjqb/eOEL4DovSYPZk1Lm5f3y/n1bXjXp9M7sxJMQbrF631vNTrcjz0rklkHGsApkJzCAS1ybs8t2FXyE9hF8sXTcLx5sUBAAA=\u0026cb=e2e_69d6da9b923433.46800366 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:48 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":204,"timings":{"blocked":113,"dns":0,"connect":0,"send":0,"wait":91,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/940460/25c1dc642284f5298cd68d00b2b52ea863378c24.mp4","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:48.026Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/940460/25c1dc642284f5298cd68d00b2b52ea863378c24.mp4 HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 292113\r\nlast-modified: Tue, 06 May 2025 18:10:23 GMT\r\netag: \"681a508f-47511\"\r\nexpires: Wed, 06 May 2026 18:42:24 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap02-sec02-prg1-1\r\nx-77-nzt: kwxFxaZhm3b0nooPmQC61JFh8tTfZDeQlKsParEjylVnqPKaIgivLN/0NAKlC3A6lH5uuTg\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad6697e5b7e36\r\nx-77-cache: HIT\r\nx-77-age: 29049619\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\ncontent-range: bytes 0-292112/292113\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":292113,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"9aece9cd6fb58b6ba5004850fa50581b","sha1":"25c1dc642284f5298cd68d00b2b52ea863378c24","sha256":"f6df6d8826940c5e47e9615037190bc19410cda64e7f6fd3379519d447945b43","sha512":"0f2ceb33ce907fa67f684abc7ab7162ff02261719b6091942f47d7e8111275360a1be3d00a7b4eda1e0cf13d20263fdd5492b5ab8e3c539ca5400579ad5f251f","ssdeep":"6144:V4GLN72/+7ESm9uNnyr5KUdso7aGTFyQ6Kd6CihBQ7B4bwbLqwPh:V4GNK/+muklKUao+kUfiSfQ7BSA","tlshash":"c45402145f3054d6f465137d0efbc3527b22e9922b0baa83a7427224fdb92f9db911e0","first_seen":"2025-07-19T12:49:35.966408Z","last_seen":"2026-04-08T22:46:20.05893Z","times_seen":52,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/vendor/libs/toastr/toastr.min.css","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.806Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/assets/vendor/libs/toastr/toastr.min.css HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 28 Dec 2021 20:27:24 GMT\r\nvary: Accept-Encoding\r\netag: \"61cb732c-18c3\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dw9N4AWJGQnGnsgNdSuGI73ChF4xeamGccw%2Bhu0l%2F3m0Uvelpv1nmPZYgKR6M9wBJNfpiwadVZEz46aZrZkmpL%2BZjE5EUvnSHYNbSDa9AnJH2NIhFRWwDn4rju3Zy0cRecc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e94cde75b3db4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6339,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (6339), with no line terminators","md5":"52a658235dcc70c2c4f238dc7a2d92be","sha1":"821c1bfccd3d992e48f9775586077764a528c486","sha256":"a34df602208737c03a159949be4f22ed4c843ce4dbd5a0211ae34ec190fd6403","sha512":"ccafbe6d6d82d756b10599d8af43a46808c28515220204c8ad12b1e94ba018bff528e115ca4bee1d678f5fec73421e61d0cb5b22f34cbb89baea77ae50707850","ssdeep":"96:2EuN8VY1Sq9ocE8IpWQ78GhJZCjtypWP+zLmlDopWKG8CzyipWVMz2LDQwtH:2j8VY1SqS8DY8syvttjG9VMWD5H","tlshash":"93d183319b41362dfdd3811ae419260a1d17e177e6ee1cae651fb2acd2c6bd06c33284","first_seen":"2023-04-05T22:03:02Z","last_seen":"2026-04-08T22:46:20.059518Z","times_seen":154,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":109,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.251.38.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.201Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 16 Mar 2026 08:38:40 GMT","end":"Mon, 08 Jun 2026 08:38:39 GMT"},"fingerprint":{"sha1":"93:71:51:4C:A3:35:66:7B:96:98:73:5F:8A:D5:61:38:29:33:E3:58","sha256":"A7:C2:55:50:7A:01:61:98:C7:16:8F:8D:72:97:DD:77:B2:9D:D8:18:29:80:41:DE:61:95:42:E5:0F:79:FE:EF"}}},"request":{"raw":"GET /s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 43136\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 03 Apr 2026 21:23:23 GMT\r\nexpires: Sat, 03 Apr 2027 21:23:23 GMT\r\ncache-control: public, max-age=31536000\r\nage: 436944\r\nlast-modified: Wed, 18 Feb 2026 19:51:37 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":43136,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 43136, version 1.0","md5":"665db5e157d2138835c4037c971ff3a4","sha1":"41ca6b7e4818eb81531d8006ff7ddd971c640879","sha256":"1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc","sha512":"6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a","ssdeep":"768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW","tlshash":"f9130231eb70ee59962c903454e7fda9433b1457d731aca80e99a1ce6f8103454facec","first_seen":"2026-02-19T22:27:43.350598Z","last_seen":"2026-04-09T01:42:05.475933Z","times_seen":70110,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":67,"dns":1,"connect":7,"send":0,"wait":9,"receive":9,"ssl":60},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/940460/985bc73325929fcf3e46f79d4cef12a38a399529.webp","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.669Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/940460/985bc73325929fcf3e46f79d4cef12a38a399529.webp HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7436\r\nlast-modified: Fri, 23 May 2025 09:55:15 GMT\r\netag: \"68304603-1d0c\"\r\nexpires: Sat, 23 May 2026 10:24:38 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap02-sec01-prg1-1\r\nx-77-nzt: k8AWCgyY1l/vLklk8x9RJoP0SzlQAqk/bwb3V2EAB06gH4k6e/SZSMjpl9ZsQSv325uuCvQ\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad6693ee19c26\r\nx-77-cache: HIT\r\nx-77-age: 27680282\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":7436,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 300x300, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"fbbb867a071db7b2314752eb1ff34cc5","sha1":"985bc73325929fcf3e46f79d4cef12a38a399529","sha256":"776e754f7ffa8004e000fa50bf91d69e6c842b1367f0022540537676df86ddae","sha512":"64335b62a05e2987be2bdd8c11f5075eaa8226cbab83622d97927cb2906f402228631fd0814c692a39282a50c4c22595cde7681772e32c97857bff48fa1dab90","ssdeep":"192:9pNnKxivWUuuCcNUMBB//iCIxlyC3jF7rjZ:9pNhvWUuZcekBHiTlyEF7rjZ","tlshash":"6be1bf48152da3148264c5497e7699b173b5b1fb4c8efac0746fc06cc0cec73a882d29","first_seen":"2025-07-19T13:10:07.920666Z","last_seen":"2026-04-09T02:15:37.043923Z","times_seen":77,"resource_available":false,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2WQwU4EMQiGX8UXmAYotHTPetVE4wPMdqa6h901jtlowsNLuweN9k9pA3wFSkBpAp5Ab1B3LDvOVjAUCEwBhe3+4dEY7XU9fcyHer4clnA5vFkREk1WlBKSIRQCZRPViAQmoJazICePkaJijmoMFg1cJJHZTwxwN4llsOen27HR5bzbXtdZMu1OUvhEoA6tWnQWXqBiAmHC1nKltc0VMC3aPB3+teu1iNl5ygkhGQRHi6FXGx1dNXU0IkfPNV9gwz1vX6dq9iuxS8Yw1PmO/Q1fhfQzptfEbgBwEGBbOM4v2/sl1PPRXf2NkdP76vHhG5ckNUWSFsuel3lty36/ELF/MDTKTb8B12HlcMcBAAA=\u0026cb=e2e_69d6da9b787390.83938329","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.784Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2WQwU4EMQiGX8UXmAYotHTPetVE4wPMdqa6h901jtlowsNLuweN9k9pA3wFSkBpAp5Ab1B3LDvOVjAUCEwBhe3+4dEY7XU9fcyHer4clnA5vFkREk1WlBKSIRQCZRPViAQmoJazICePkaJijmoMFg1cJJHZTwxwN4llsOen27HR5bzbXtdZMu1OUvhEoA6tWnQWXqBiAmHC1nKltc0VMC3aPB3+teu1iNl5ygkhGQRHi6FXGx1dNXU0IkfPNV9gwz1vX6dq9iuxS8Yw1PmO/Q1fhfQzptfEbgBwEGBbOM4v2/sl1PPRXf2NkdP76vHhG5ckNUWSFsuel3lty36/ELF/MDTKTb8B12HlcMcBAAA=\u0026cb=e2e_69d6da9b787390.83938329 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/914186/bbd8c9a524cdbdb661539e42eed6686ee5a8df3b.mp4","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.933Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/914186/bbd8c9a524cdbdb661539e42eed6686ee5a8df3b.mp4 HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 519862\r\nlast-modified: Fri, 03 Apr 2026 11:10:19 GMT\r\netag: \"69cfa01b-7eeb6\"\r\nexpires: Sat, 03 Apr 2027 12:07:05 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\naccess-control-expose-headers: Content-Range\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap01-sec02-prg1-1\r\nx-77-nzt: k1/PI9RdXMFFsrjjHc4iAC3A3zniDSNwVHSaEHDo2UtTABRHC28zfI4bBRHO/ELMrjANiHA\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad6699e182232\r\nx-77-cache: HIT\r\nx-77-age: 470300\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\ncontent-range: bytes 0-519861/519862\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":519862,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"b2510f609d50d52b2da8ac61b35fc107","sha1":"bbd8c9a524cdbdb661539e42eed6686ee5a8df3b","sha256":"c65c325428b54f9594bf8cf6e3c503ef860492f22a27f34d8e5dad3049f273fe","sha512":"cb766cd15380c244c829b38f227158d9ed17d040081b9cb4504d9cc5358293febfa036bfdaefcd86191b5c9bdf07d5ff0665a279eb080dad162e27268f5884a7","ssdeep":"12288:1gDUYO9SUByeVZ8dvcIGWADlpnoCBrhV1d3lDopkO:WDXQSUnZ8dvcagXdvdJAr","tlshash":"dfb42268873216e7f39841be4cbbd787ba38d528231d155393a23684fdf4a61de711c8","first_seen":"2026-04-04T01:37:14.421533Z","last_seen":"2026-04-08T22:46:20.061281Z","times_seen":3,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3,"receive":40,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQQU4DMQz8Ch/YyHbsrNMzXEEC8YA0u4E90KK2WoHkx+NsJUBqJnEke8aehIDSADyA3qHuWHY8WsaQITAFFLbHp2djtPf5cClLPa7LFNbl0zmMmiwrJSRDyATKJqoRCUxATQmySDKMRBGBwXxHAwdJZPZbAjwMYiPY68v9dtDheo99rqG36TlS+EKgrpk1axGeoGICYcLWxkpzKxUwTdqcDjdu4YoAIkYO+MXQ6RE5kjvyBbaly/n7UM3+ETtk809dj8Y35Svy38N8IPYAIJstsHP4KG/n0xrq8cNTvcXGMewvR/YvWstpKZfleNjqXWRcprHEsVGeuElrUCnHnCbY13GvPP8AgXcW6sUBAAA=\u0026cb=e2e_69d6da9b77f400.02553425","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.248","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.763Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQQU4DMQz8Ch/YyHbsrNMzXEEC8YA0u4E90KK2WoHkx+NsJUBqJnEke8aehIDSADyA3qHuWHY8WsaQITAFFLbHp2djtPf5cClLPa7LFNbl0zmMmiwrJSRDyATKJqoRCUxATQmySDKMRBGBwXxHAwdJZPZbAjwMYiPY68v9dtDheo99rqG36TlS+EKgrpk1axGeoGICYcLWxkpzKxUwTdqcDjdu4YoAIkYO+MXQ6RE5kjvyBbaly/n7UM3+ETtk809dj8Y35Svy38N8IPYAIJstsHP4KG/n0xrq8cNTvcXGMewvR/YvWstpKZfleNjqXWRcprHEsVGeuElrUCnHnCbY13GvPP8AgXcW6sUBAAA=\u0026cb=e2e_69d6da9b77f400.02553425 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VPS05DMQy8Chd4ke3YidM1bEECcYBHXgJd0CKKKpB8eJx0AYKMbEdjjz8ElBbgBfQKdcey42wFQ4HAFFDYbu/ujdFe2uFj3dfjeb+F8/7NCgMnsKKUkAyhECibqEYkMAG1nDKrR8QskTKyMVg0cJBEZo8Y4GYRy2CPD9fT0OF692OuYTIdHCl8ItDQNC26Cm9QMYEwYe+5UutrBUybdi+Hf9v6KCxJyCiLZG8TXFosG819LliGMiJH8uX8gU16PX0dqtmvwgGZp9DQD9nf9AX550afiMMB4BSAncLr+nx6P4d6fHVqtJg1vurMT25+/KxVS9UG0a23bSN9iq0h9Nox8TcZ+TAOxAEAAA==\u0026cb=e2e_69d6da9b783fc8.20000276","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.769Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VPS05DMQy8Chd4ke3YidM1bEECcYBHXgJd0CKKKpB8eJx0AYKMbEdjjz8ElBbgBfQKdcey42wFQ4HAFFDYbu/ujdFe2uFj3dfjeb+F8/7NCgMnsKKUkAyhECibqEYkMAG1nDKrR8QskTKyMVg0cJBEZo8Y4GYRy2CPD9fT0OF692OuYTIdHCl8ItDQNC26Cm9QMYEwYe+5UutrBUybdi+Hf9v6KCxJyCiLZG8TXFosG819LliGMiJH8uX8gU16PX0dqtmvwgGZp9DQD9nf9AX550afiMMB4BSAncLr+nx6P4d6fHVqtJg1vurMT25+/KxVS9UG0a23bSN9iq0h9Nox8TcZ+TAOxAEAAA==\u0026cb=e2e_69d6da9b783fc8.20000276 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2WPTU4DMQyFr8IFJrId23G6hi1IIA4wTWegi7aIogokHx4nXYAgT/mR/b7YJiCdgCewG7QNy4aLV0wVElNCYb9/eHRGf12OH/O+nS77Xbrs37wKialXI0VyhEpg7GKWkcAFzEvJGVEdMyiWCuwMnh1CJJk5bkxwN4kX8Oen27ExFHycva4jkVsPksEnAnVosWqz8A4aKggTrmtptKxzA9SdrWGHf+1GLWIOnooiqEMKtEbfTqOjq6aOZuQcXo8FPsLz+evY3H8Zu2QMQ53v2N/0VfYzZZTEfgDgAMDP6TC/nN8vqZ0OEepfDI/jNT9i48FkW1VdF5FGbd2ylhwDiG25obXlG24yknTGAQAA\u0026cb=e2e_69d6da9b786670.45273177","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.783Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2WPTU4DMQyFr8IFJrId23G6hi1IIA4wTWegi7aIogokHx4nXYAgT/mR/b7YJiCdgCewG7QNy4aLV0wVElNCYb9/eHRGf12OH/O+nS77Xbrs37wKialXI0VyhEpg7GKWkcAFzEvJGVEdMyiWCuwMnh1CJJk5bkxwN4kX8Oen27ExFHycva4jkVsPksEnAnVosWqz8A4aKggTrmtptKxzA9SdrWGHf+1GLWIOnooiqEMKtEbfTqOjq6aOZuQcXo8FPsLz+evY3H8Zu2QMQ53v2N/0VfYzZZTEfgDgAMDP6TC/nN8vqZ0OEepfDI/jNT9i48FkW1VdF5FGbd2ylhwDiG25obXlG24yknTGAQAA\u0026cb=e2e_69d6da9b786670.45273177 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VPW04DMQy8ChfYaOw4ibff8AsSiANE6S70ow9RVIHkw+OkQiA1ozjxeBxPGJwnyAS9I91I2kixmcKMIBwoiT0+PZuQvS+Hz7prx8tuGy67k2uENNusnImNMDNULKlGYliCWimJoks85xjnnE1g0eDgFEX8pICHKVmBvb7cj00O7/fY5xqpaedY8UXg3rPorDXJFo0ykjCta2m8rLWB8lZXl+PGLa4ISMmy8W/umLo8kkR2R75gg67n70Mz+yfsSMM/934yuSlfQfz3M59IPQA0fMHOYV/fzh+X0I57p/obQ2N0rQ9uXARSFlm1KXRua6NSIhVNS22lZsUPtMAqN7oBAAA=\u0026cb=e2e_69d6da9b7831a8.99095784","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.767Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VPW04DMQy8ChfYaOw4ibff8AsSiANE6S70ow9RVIHkw+OkQiA1ozjxeBxPGJwnyAS9I91I2kixmcKMIBwoiT0+PZuQvS+Hz7prx8tuGy67k2uENNusnImNMDNULKlGYliCWimJoks85xjnnE1g0eDgFEX8pICHKVmBvb7cj00O7/fY5xqpaedY8UXg3rPorDXJFo0ykjCta2m8rLWB8lZXl+PGLa4ISMmy8W/umLo8kkR2R75gg67n70Mz+yfsSMM/934yuSlfQfz3M59IPQA0fMHOYV/fzh+X0I57p/obQ2N0rQ9uXARSFlm1KXRua6NSIhVNS22lZsUPtMAqN7oBAAA=\u0026cb=e2e_69d6da9b7831a8.99095784 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/319620/2d4dace94d4376c225839616fd56eff5cb12641c.mp4","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:48.040Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/319620/2d4dace94d4376c225839616fd56eff5cb12641c.mp4 HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:48 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 341933\r\nlast-modified: Tue, 08 Oct 2024 21:20:10 GMT\r\netag: \"6705a20a-537ad\"\r\nexpires: Thu, 09 Oct 2025 18:46:10 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap01-sec02-prg1-1\r\nx-77-nzt: k9/s4WVMEMxAd1nqBCICLdonlDXOjWMMEpYHv+f8o++QQhgUnj1282NTKTDaHBprUK5yGVw\r\nx-77-nzt-ray: 2a494a15fb2856f5c1dad6696b742b01\r\nx-77-cache: HIT\r\nx-77-age: 15635549\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\ncontent-range: bytes 0-341932/341933\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":341933,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"1e375be37d9454a925054140342d1789","sha1":"2d4dace94d4376c225839616fd56eff5cb12641c","sha256":"9d3ea67b71e5e57fa08f7916fd1e81c9f97e453c4c8162db6199e391c13621be","sha512":"a465a2f23a9e63ceca3f72047b04f15893c30d9718db05c94dca7817bcb839698d5ea884274fd9d44c0694de6bf644ffd9e739a41d62a8fe00e3a10f948cf95b","ssdeep":"6144:py61OOEkwqMMaKYHKD98AurdB17f3SUvdT0xHM8amy38Zb125aW:pygGqM4YHHrdpvdIM8P7v25t","tlshash":"137412a47f22d54fe0253bf12d0500029c2728634517b8bbb2b776ba76cb7c69b49e17","first_seen":"2025-05-02T03:38:16.053852Z","last_seen":"2026-04-08T22:46:20.06175Z","times_seen":89,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Almarai:wght@300;400;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.803Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 16 Mar 2026 08:38:41 GMT","end":"Mon, 08 Jun 2026 08:38:40 GMT"},"fingerprint":{"sha1":"03:81:A0:0E:E1:9B:80:A3:BC:CD:F9:25:A5:7B:8A:43:07:22:C6:00","sha256":"73:8D:9A:B1:F0:C3:6E:8F:EE:C0:2F:99:C8:89:24:16:9A:DB:D1:9C:27:5D:8A:7A:A8:2B:0E:10:42:28:53:7F"}}},"request":{"raw":"GET /css2?family=Almarai:wght@300;400;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Wed, 08 Apr 2026 22:45:47 GMT\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3832,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (649)","md5":"e72d86029b98a7d197d51f1f6607b6df","sha1":"d031d578a5cf6afca0ce99288714cd6c8aa6dda6","sha256":"a23ec9c9c22d574d5f4591ac00cf9bcfad77fd89c6972842c830ec0ed9c3cefc","sha512":"2fea9e29312b81f74e6c7e34e41ef1eeffbe1b393452197199826c89fa4ae63b9efbfd606ec0dc712f668f5a2cfa905334728b992fc8de2d598d6b52e766c990","ssdeep":"","tlshash":"e1818de40c1e41c4bb472dc2738d6a27ee4ee19924c4c46cd6fd6b8b9c97d22726078d","first_seen":"2025-09-23T20:25:56.096085Z","last_seen":"2026-04-08T22:46:20.062361Z","times_seen":169,"resource_available":false,"data":null}},"time_used":624,"timings":{"blocked":287,"dns":4,"connect":23,"send":0,"wait":18,"receive":0,"ssl":281},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/images/avatars/default.png","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.823Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/images/avatars/default.png HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: image/png\r\ncontent-length: 1007\r\nlast-modified: Tue, 14 Sep 2021 09:29:18 GMT\r\netag: \"61406b6e-3ef\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HOOE1fKhsr4Uyp57VsvQ05QRBJ9lDvDDXFIzl3X0SuYoOja7n837HIE6wAVChl3R%2FxsoSgbkTeDjK7f%2FD%2Fy631wZ7%2FTk%2BCOIkQMhpx4v6v091y0otH5l3ZcupyQwx7Sl9hk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e94cde76b46b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1007,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 110 x 110, 8-bit colormap, non-interlaced","md5":"d51fe0c080e54e099a879326ba18d543","sha1":"396a7393b2962cc1b68ae4976eb10fd443a57493","sha256":"88267034d196227d634adaf8668f5813a766a2542aecdb5c12a48d7255db3471","sha512":"50e84699ab97781466a489cc3e5b7630c7972f787b9944900844b58aaa725aa5085aaefb2bcab3d484dd4c75ce8d86108914d5a3622a2abcd3f90c93e805869e","ssdeep":"","tlshash":"051161967173ba2cc20b63e8076ef198885e0ec7446e1d393c0048707a2e1a557ee776","first_seen":"2023-10-15T01:17:34Z","last_seen":"2026-04-08T22:46:20.063007Z","times_seen":35,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.360Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /ad-provider.js HTTP/1.1\r\nHost: a.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: application/javascript\r\netag: W/\"169b79c256a05ad96dcc2b8e3a5\"\r\nexpires: Tue, 07 Apr 2026 10:32:48 GMT\r\ncache-control: max-age=10800\r\nx-robots-tag: noindex, follow\r\naccess-control-allow-origin: *\r\nx-77-nzt: k4d1lRbtTL4+spvwvPM5xgKHiaiHyMGdoFnO1c7P5nmIjpa+R3ggeS0mFJsUtv/lSVgTF2I\r\nx-77-nzt-ray: 2a494a15e5d98fefc0dad669859c3715\r\nx-77-cache: HIT\r\nx-77-age: 2323\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":188413,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (39940)","md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"resource_available":true,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQQU4DMQz8Ch/YyHacxOmZXkEC8YB0twt7aIvaalUkPx47IIQgo0iWPfbYQ0B5AB5A7lA2nDZctGKoEJgCJtaHxydl1Lf98dqW8bQuU1iXd+UoHI0qlJEUoRIIaxKJIKQJREsspUBWREqYwVgMGhUMlCKzRwEAtYC+PN/3jwbSQnKrYKFrK4GyF0jghkDet5cqLfEEow1OTDjPZaT93EbAPMlsdPi3sQ3EXJKrC2dxcUbugvCDwTsjciRb0B5oT7fLx3FU/UV0pH4Ofv+/1S+I8wJsh+SC2FU7HfQSDu31cl7DeDpYygcELG6Pn8vm1trOS7sup2Mve4+WKji1vCu7Vtm8bgIRqZovFdsk9AkDCZ4S0AEAAA==\u0026cb=e2e_69d6da9b5c0e24.22131631","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.549Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQQU4DMQz8Ch/YyHacxOmZXkEC8YB0twt7aIvaalUkPx47IIQgo0iWPfbYQ0B5AB5A7lA2nDZctGKoEJgCJtaHxydl1Lf98dqW8bQuU1iXd+UoHI0qlJEUoRIIaxKJIKQJREsspUBWREqYwVgMGhUMlCKzRwEAtYC+PN/3jwbSQnKrYKFrK4GyF0jghkDet5cqLfEEow1OTDjPZaT93EbAPMlsdPi3sQ3EXJKrC2dxcUbugvCDwTsjciRb0B5oT7fLx3FU/UV0pH4Ofv+/1S+I8wJsh+SC2FU7HfQSDu31cl7DeDpYygcELG6Pn8vm1trOS7sup2Mve4+WKji1vCu7Vtm8bgIRqZovFdsk9AkDCZ4S0AEAAA==\u0026cb=e2e_69d6da9b5c0e24.22131631 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22887a5d7f9fb4978dd88bc10ed84daa71%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/952586/24e6b1124942c466de4ee8ae689f632fc9247913.webp","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.679Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/952586/24e6b1124942c466de4ee8ae689f632fc9247913.webp HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11818\r\nlast-modified: Thu, 22 Jan 2026 14:33:55 GMT\r\netag: \"69723553-2e2a\"\r\nexpires: Fri, 22 Jan 2027 14:48:19 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap01-sec01-prg1-1\r\nx-77-nzt: k+b9ikCnQaJG/VscIj0MbVIxdbA2kVPGAhDPYbRICtxJ57UJM9WW6B6Jw/7/h6kEcinttlE\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad669da1bce26\r\nx-77-cache: HIT\r\nx-77-age: 6594533\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":11818,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 600x600, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"8c01431bddc8df18367c07a94f489d3f","sha1":"24e6b1124942c466de4ee8ae689f632fc9247913","sha256":"b3fd39c48246efc7158d52654f7885ab2b74eaa080c4d0ac22b6f8a819c762aa","sha512":"3139eae968006a8a75b3358ca9280f2a2f3671eb55cf86333380b35b4d363cfa3b7cc687993b3b5c9f46a90162d5dc6853c3730c5036bc9f4c83792a694721fc","ssdeep":"192:3pwSYmGg0SgvRV/G47U4smL0uJLWC/J8gsKghA9JoX6Tuwx+h/LVPLvlEodIiF:G/f/G54s6L1J8gsqJo8uJJLJvlEoD","tlshash":"9332c088b6d11b12b84d6aefe6a13407283c6cd33db61ce904146e2f5c262347a7a5bd","first_seen":"2026-01-26T13:21:06.317486Z","last_seen":"2026-04-08T22:46:20.064147Z","times_seen":95,"resource_available":false,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VPQU4DMQz8Ch/YaOzYidMzXEEC8YDVbhZ6aIsoqkDy40nSAwgyipOMPfaEwWmCTLAbsp3oTrIXCgVBOJCK3z88upC/1uPHvF9Ol/0aLvs3LwJJ8GKciJ1QGCauZpEYrjDPKYtBnChr5FSSCzw6GlijSDsp4G5Sz/Dnp9uxqaHpW+xznZJb59jwSeCuqVZsVlmxUIIK07blhes2L6C02tbK8c9tG0UlKTtn1dzaBKh6cR52rpi6MJJEbt7agg96Pn8dF/dfhR06fsJd32V/01fkny+2gdQDQEMAP4fD/HJ+v4TldGhUbzFqmtORH9y4pFoxsyk4l7RyjlbznNsDKFLL8g3XrbLqwwEAAA==\u0026cb=e2e_69d6da9b785936.75136329","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.248","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.783Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VPQU4DMQz8Ch/YaOzYidMzXEEC8YDVbhZ6aIsoqkDy40nSAwgyipOMPfaEwWmCTLAbsp3oTrIXCgVBOJCK3z88upC/1uPHvF9Ol/0aLvs3LwJJ8GKciJ1QGCauZpEYrjDPKYtBnChr5FSSCzw6GlijSDsp4G5Sz/Dnp9uxqaHpW+xznZJb59jwSeCuqVZsVlmxUIIK07blhes2L6C02tbK8c9tG0UlKTtn1dzaBKh6cR52rpi6MJJEbt7agg96Pn8dF/dfhR06fsJd32V/01fkny+2gdQDQEMAP4fD/HJ+v4TldGhUbzFqmtORH9y4pFoxsyk4l7RyjlbznNsDKFLL8g3XrbLqwwEAAA==\u0026cb=e2e_69d6da9b785936.75136329 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-08T22:45:44.933Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/RIDf9DzOScJgFtg-NHDTC-184_s.jpg HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nserver: cloudflare\r\nvary: Accept-Language\r\ncache-control: no-cache, private\r\nset-cookie: XSRF-TOKEN=eyJpdiI6IlcvanZIdDZFWUxxVy9PMC9Wbm5qZkE9PSIsInZhbHVlIjoiN3ZtejdLNGF2OFJpQiswZHd2dG9Ua09pVVFpdmZBZUFMdURSekRsdEFMU2VtV2tPeG5QUnk1QW5KOGtZMkMxRWRNTnJWS1hZLzhrdmpvSnlJbDNFMmhqVnRpMXlTQjJ3ZTREV3ZMbld0YVp5ZGxYRmN5NXpNU3FBUFJzYjJOVnMiLCJtYWMiOiI1ZTBiYTBlNjE2MDEyMGEzYzI0NWVjZTNjNjcwM2U1NGNmNjljNzg0ZWVhYWU1N2U3Y2M4MmJkOWE3MzNjNDhhIiwidGFnIjoiIn0%3D; expires=Thu, 09 Apr 2026 00:45:46 GMT; Max-Age=7200; path=/; samesite=lax\nimgbob_user_session=eyJpdiI6IjhxVFBqdmRlQTFrWWRhNnpwdjJrTHc9PSIsInZhbHVlIjoiOXRJZFcxemR5UEIrV2VLU3pIRUNOVVFPOExkVlIvRUxVb0F6dkJncC96N2tGckl2NnRaVDVCUm5QK1JUOVh3bWdQM1VadE51L3Q3VHd2a2FsbldMam0rUEFpWjMrdUJWejRoeVo2NUV4UXNvN0ZXNzBQaUtQdlZBZ0dNYU8xcXEiLCJtYWMiOiIwYWFlMWNiY2EwODc0YTYxOTJlMWNiMjVjOGE4NWNkNDI3MDkxYTVkNmIzODYyZmZkYmY3ZDI2YjllMmZlZWZlIiwidGFnIjoiIn0%3D; expires=Thu, 09 Apr 2026 00:45:46 GMT; Max-Age=7200; path=/; httponly; samesite=lax\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncf-cache-status: BYPASS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MmwSvdmr1qq5mciTFKR%2BgbrOWG9zO03D1PWgviuf5fQey3pJdoYVaGOzi4jXCQ6g8ApewON2BnSHSS6ekvmhuaw8YurgvJkaC6cyzWRp2HW9O6n4coZNIMsN13Q3Odguvnc%3D\"}]}\r\ncf-ray: 9e94cde3981a23eb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45784,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":2616,"timings":{"blocked":1244,"dns":1227,"connect":1,"send":0,"wait":128,"receive":0,"ssl":13},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/v1/api.php","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.224Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"POST /v1/api.php HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain\r\nContent-Length: 443\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":443,"data":"{\"user\":{\"ua\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"language\":\"en-US\",\"referer\":\"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\",\"consumer\":\"ad-provider\",\"gdpr\":{\"gdpr\":0},\"screen_resolution\":\"1280x1024\",\"window_orientation\":\"landscape\",\"cookies\":[],\"scr_info\":\"YXN5bmN8fDM%3D\"},\"zones\":[{\"custom_targeting\":{},\"id\":5883082,\"extra_params\":{\"first_request\":true,\"zone_type\":2}}]}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nAccess-Control-Allow-Headers: Authorization, Content-Type\r\nAccess-Control-Request-Method: POST\r\nSet-Cookie: __uvt=s%3A32%3A%227d20af61730932873950e09a04404726%22%3B; expires=Fri, 07 Apr 2028 22:45:47 GMT; Max-Age=63072000; path=/; domain=magsrv.com; secure; SameSite=None\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2229,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"b1807d0c0e5cce21c82b0fa89bc4eade","sha1":"ce0defeb70fe7b5f44c198f5d39755bc1ac18969","sha256":"5f48e4f2723ad41a51bb62013a874a81d22ca71cd155347c6b6771fac67e5239","sha512":"8ae5007ac83415195ba1ea047a23c74ca9cf6c4498ca56350f0b8e0b5c4df4dc186af1d9a4311cef6d91f4a1dffb3a2f4ad1034cbd69eb3766c6edff9c0d655e","ssdeep":"","tlshash":"c9410bf273c08c6fc7b0f4ca2f5d31545d6e270743998a81905d7875d6748ba2a10be6","first_seen":"2026-04-08T22:46:20.064632Z","last_seen":"2026-04-08T22:46:20.064632Z","times_seen":1,"resource_available":false,"data":null}},"time_used":230,"timings":{"blocked":74,"dns":2,"connect":24,"send":0,"wait":92,"receive":0,"ssl":36},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/438437/c13d51c837d5b9337fa0ace7ae2f85a181fa3516.webp","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.547Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/438437/c13d51c837d5b9337fa0ace7ae2f85a181fa3516.webp HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8604\r\nlast-modified: Mon, 11 Mar 2024 16:24:23 GMT\r\netag: \"65ef3037-219c\"\r\naccept-ch: \r\nexpires: Thu, 13 Mar 2025 05:20:59 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-77-nzt: k/e4D6MBmAK6J3/RQjOQhIU/ONTMyqGCx/Xvli0UQNek5X60f7Si67Ko/DQTAUtyH1wwZXY\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad669fcf54923\r\nx-77-cache: HIT\r\nx-77-age: 2308904\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":8604,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 728x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7bff89f7f5340849b3e58adc09fc231c","sha1":"c13d51c837d5b9337fa0ace7ae2f85a181fa3516","sha256":"c47f016ff317a4cb2d5dd3d83480dc743fdd3bb2cdf6cb2c81459799bd349990","sha512":"a52b8fb6ae909090079717a22d79da2c332488b51ec527c592ba7cd11a3bf0d38270b43d42b99c32743a8a5571db2fe25843eaf0f7b8aa6ad9ef0dc01012b9ac","ssdeep":"192:ZZ5d4R+EOALktBqkf7eBFMjwyMjZCdwFh8NqVFNOTEnv+53T5WMEAY:HcRcLtBJOzyMguh8NOFqQ+53VWMpY","tlshash":"2e02cf8af113c1919105e7e5f8d12b58368a226402fbbab6c2f6c5704cff30cc18e65d","first_seen":"2024-04-08T10:57:15Z","last_seen":"2026-04-08T22:46:20.065401Z","times_seen":106,"resource_available":false,"data":null}},"time_used":92,"timings":{"blocked":44,"dns":32,"connect":1,"send":0,"wait":1,"receive":1,"ssl":10},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/vendor/libs/simplebar/simplebar.min.js","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.832Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/assets/vendor/libs/simplebar/simplebar.min.js HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 22 Mar 2021 16:51:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6058cb29-e338\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=co6eLqluIXCk0QWn2RkvzRSQxX3feHBT8xUom5v8IPOIxsCDm3YtFgqpoyn2I6uX4cFYVsT%2B8rCYa5SAEETEoqYfJcMQCqeePNr5Uj4%2BQU3MZ0ZB4l5N8nCo7yBoUlrmhHo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e94cde78b5cb4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":58168,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (57960)","md5":"bf2b0f78573ead4df6e17118b903a511","sha1":"c77999cef664c81938a5ddfb278b6cb217392d7d","sha256":"39c3c7a018149bfa70ac78df0f5d49a74c909da2aed3c7c9ae24a5592e9bbff9","sha512":"012f6b6590dd6fecb85b695c9a4346c1fe2cc26ebad3b5c96293524f59a434151f04191af1bb40ea68119a1a0543d526cbc363fdf839e38e3e4a094b1dba30b8","ssdeep":"1536:yo1qP3bArH8Ci4oO0RFs6e8KllDr9Im0nhOwEz+2/5f+Nh8cQBibzd+QfhanKrHf:yWqPrArH5XoNs6yDvMz2/5fkh8cQBibD","tlshash":"1543d8cdb292b07203e76266803f410af33a59a9750e4098f67dd9e97cb89495277f3c","first_seen":"2023-03-07T12:57:00Z","last_seen":"2026-04-08T22:46:20.065943Z","times_seen":194,"resource_available":true,"data":null}},"time_used":132,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":132,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQW04DMQy8ChfYaOzYibff8AsSiAOk+4D9oEVttSqSD0+yqhCCjCJZ9ozHNoNTB+lgd2Q70Z1k7yn0CMKBVPzx6dmF/H06XMoyHNdlDOvy6RJNYqUaJ2In9AwTV7NInFxhnmPOGcmJWCmBzAUeHRWsUaRFASDP8NeX++1TBXtmu/aoYfN2hksrsOFK4KabrLeiMmKojVWY5jkPPM1lAKXR5krHv4lrQ0pZm7tJsmYuKW2G+EHXlJEkch2wPviWLuevw+D+i9ig2zp0+3+ruK3aiAEPnTZH2mw3PvwcPsrb+bSG4fhRU61DoNxEbV+p51rLaSmX5XjYyk1Tz4Ecaa88xjJyRj/tU1GeVGemKdk3m3woitEBAAA=\u0026cb=e2e_69d6da9b5e8209.27864880","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.569Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQW04DMQy8ChfYaOzYibff8AsSiAOk+4D9oEVttSqSD0+yqhCCjCJZ9ozHNoNTB+lgd2Q70Z1k7yn0CMKBVPzx6dmF/H06XMoyHNdlDOvy6RJNYqUaJ2In9AwTV7NInFxhnmPOGcmJWCmBzAUeHRWsUaRFASDP8NeX++1TBXtmu/aoYfN2hksrsOFK4KabrLeiMmKojVWY5jkPPM1lAKXR5krHv4lrQ0pZm7tJsmYuKW2G+EHXlJEkch2wPviWLuevw+D+i9ig2zp0+3+ruK3aiAEPnTZH2mw3PvwcPsrb+bSG4fhRU61DoNxEbV+p51rLaSmX5XjYyk1Tz4Ecaa88xjJyRj/tU1GeVGemKdk3m3woitEBAAA=\u0026cb=e2e_69d6da9b5e8209.27864880 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22887a5d7f9fb4978dd88bc10ed84daa71%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQW04DMQy8ChfYaOw4Waff9BckEAcI+4D9aIvaagWSD4+zFRJSM3lpMuNMwuDcQTroA+lO0k56KxQKgnCgJPb0/GJC9jkdr3UZTusyhnX5co2QZivKmdgIhaFiSTUSwxLUlFJh5ygiS4wC8x4NDk5RxNcYEEvv+yy56L5T62Fvr4/bIIeX8rlFMPKKjWPFN4GbfdKiNcmIgTKSMM1zP/A01wGUR51djrvguCG4oVgy/iMcXdNHksiezhtso+vl5ziY/RM2pO0t3Pxkcnd8g4f2KWDfpXYl3b243zLCLuFQPy7nNQyng1OtXJO7uX0DiX/dWs9LvS6n43beTCbv6AdIQSHKUy6DKqT6oHFKyuMv5XgK8d0BAAA=\u0026cb=e2e_69d6da9b782499.99024927","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.766Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQW04DMQy8ChfYaOw4Waff9BckEAcI+4D9aIvaagWSD4+zFRJSM3lpMuNMwuDcQTroA+lO0k56KxQKgnCgJPb0/GJC9jkdr3UZTusyhnX5co2QZivKmdgIhaFiSTUSwxLUlFJh5ygiS4wC8x4NDk5RxNcYEEvv+yy56L5T62Fvr4/bIIeX8rlFMPKKjWPFN4GbfdKiNcmIgTKSMM1zP/A01wGUR51djrvguCG4oVgy/iMcXdNHksiezhtso+vl5ziY/RM2pO0t3Pxkcnd8g4f2KWDfpXYl3b243zLCLuFQPy7nNQyng1OtXJO7uX0DiX/dWs9LvS6n43beTCbv6AdIQSHKUy6DKqT6oHFKyuMv5XgK8d0BAAA=\u0026cb=e2e_69d6da9b782499.99024927 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pagead2.googlesyndication.com/pagead/js/adsbygoogle.js","fqdn":"pagead2.googlesyndication.com","domain":"googlesyndication.com","tld":"com"},"ip":{"addr":"142.250.178.66","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.637Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.g.doubleclick.net","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 16 Mar 2026 08:36:37 GMT","end":"Mon, 08 Jun 2026 08:36:36 GMT"},"fingerprint":{"sha1":"A0:67:41:BF:A6:6F:B4:E5:8D:DE:5D:C3:E1:E8:15:44:50:75:50:61","sha256":"E4:44:EF:CA:F5:17:16:4E:8D:3A:D1:2E:8A:75:99:3B:95:70:BB:41:17:3F:03:CB:D1:BF:49:18:04:EF:DF:E8"}}},"request":{"raw":"GET /pagead/js/adsbygoogle.js HTTP/1.1\r\nHost: pagead2.googlesyndication.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://hentaicovid.vip/\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\np3p: policyref=\"https://www.googleadservices.com/pagead/p3p.xml\", CP=\"NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC\"\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nlink: \u003chttps://googleads.g.doubleclick.net\u003e; rel=\"preconnect\"; crossorigin\r\nvary: Accept-Encoding\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\nexpires: Wed, 08 Apr 2026 22:45:47 GMT\r\ncache-control: private, max-age=3600, stale-while-revalidate=3600\r\ncontent-type: text/javascript; charset=UTF-8\r\netag: 7394938031624895244\r\naccess-control-allow-origin: *\r\nx-content-type-options: nosniff\r\ncontent-disposition: attachment; filename=\"f.txt\"\r\ncontent-encoding: br\r\nserver: cafe\r\ncontent-length: 55499\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":161353,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (4816)","md5":"ac88b97e456f48031ebaf5fcef1ae32f","sha1":"b15d73c80f89da6a0cec5cd9335a4d9fddb9c766","sha256":"b350de9a4da3edff0cead70caf615c20c8f361a2d7d3b2dcd8e7803881ec0999","sha512":"e88a24faef4767ee756d612a507bafe359788f29648fd742abad2a2193b92bb5df003459c8a0d88dadf89632d4818384a28d8ee3be68a310fe72a8d3a3a8b15b","ssdeep":"3072:hb+jbFNci1ZMTPRUxbNyM1CVv7KOZKSgDPqch16ooWT3LguOVomZdVwAlFfjsQih:hb+jbDcQ6TPRUxbwM1CV+4KBDPphYNIX","tlshash":"38f30a9a7192bcb3876389e5406f0107b42d9863f40cc8b0f2d8ded97a649759277fac","first_seen":"2026-04-08T22:46:20.066427Z","last_seen":"2026-04-08T22:46:20.066427Z","times_seen":1,"resource_available":false,"data":null}},"time_used":618,"timings":{"blocked":182,"dns":38,"connect":27,"send":0,"wait":211,"receive":2,"ssl":144},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/v1/api.php","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.231Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"POST /v1/api.php HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain\r\nContent-Length: 443\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":443,"data":"{\"user\":{\"ua\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"language\":\"en-US\",\"referer\":\"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\",\"consumer\":\"ad-provider\",\"gdpr\":{\"gdpr\":0},\"screen_resolution\":\"1280x1024\",\"window_orientation\":\"landscape\",\"cookies\":[],\"scr_info\":\"YXN5bmN8fDM%3D\"},\"zones\":[{\"custom_targeting\":{},\"id\":5883126,\"extra_params\":{\"first_request\":true,\"zone_type\":2}}]}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nAccess-Control-Allow-Headers: Authorization, Content-Type\r\nAccess-Control-Request-Method: POST\r\nSet-Cookie: __uvt=s%3A32%3A%22efea4b2490eea145a43572a0f6cfa3e0%22%3B; expires=Fri, 07 Apr 2028 22:45:47 GMT; Max-Age=63072000; path=/; domain=magsrv.com; secure; SameSite=None\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2223,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"49c3e68303a247a69a7870417156ad6f","sha1":"41b0a8eaea42062d7ce839f28e55e229efdf21e0","sha256":"29eb3addebc3389d6a887879133b73d3c31c904d9a760de4243bf6b2af5bcaa2","sha512":"174963d73552cb6e8fe0cac6b965c203395dc94eddb2585de4532f9d342587d33e930bb3bd6c95f3c7222f57a0a2c9bd310a2128621ca3d70f5937fbf855011e","ssdeep":"","tlshash":"1941e931b2408cbdaff0bfca678636d99c5eb11fdfc98891080aa54565349381b413b2","first_seen":"2026-04-08T22:46:20.067261Z","last_seen":"2026-04-08T22:46:20.067261Z","times_seen":1,"resource_available":false,"data":null}},"time_used":237,"timings":{"blocked":73,"dns":2,"connect":25,"send":0,"wait":98,"receive":0,"ssl":36},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQ205DIRD8FX/gkNllgaXP+qqJxg84F46eh7bGmkaT/XiBJrWJTFhgmGVnYXAcIAP0jnQnYSfJMrkMJ+woiD0+PZuQvZfD17jNx/O2uPP2UTVCGi0rR2IjZIaKBVWPDAtQSymQrxLyTEjZwwTmDRUcvEhdyeFhCJZgry/3fVIFWw2trJGaNooV3wRuKUWzjkEWzBQRhGld08xlHWdQXHStcvwziwucz8zWgCuGpvcknqujOmCdHk8/h9nsKiO6JIXeAbcDmdwIbkH46w0O1AJA3Rrs5Pbj2+nz7ObjvlLtja6pNfp95/om5/qBZZ1KTJhC9ViWZWGiXKJ6DdMv0GRgzrwBAAA=\u0026cb=e2e_69d6da9b9204e1.13782100","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.904Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQ205DIRD8FX/gkNllgaXP+qqJxg84F46eh7bGmkaT/XiBJrWJTFhgmGVnYXAcIAP0jnQnYSfJMrkMJ+woiD0+PZuQvZfD17jNx/O2uPP2UTVCGi0rR2IjZIaKBVWPDAtQSymQrxLyTEjZwwTmDRUcvEhdyeFhCJZgry/3fVIFWw2trJGaNooV3wRuKUWzjkEWzBQRhGld08xlHWdQXHStcvwziwucz8zWgCuGpvcknqujOmCdHk8/h9nsKiO6JIXeAbcDmdwIbkH46w0O1AJA3Rrs5Pbj2+nz7ObjvlLtja6pNfp95/om5/qBZZ1KTJhC9ViWZWGiXKJ6DdMv0GRgzrwBAAA=\u0026cb=e2e_69d6da9b9204e1.13782100 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":190,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":190,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/914186/cd9b27a29b57ee136a5aed159ac07c006e0238c4.mp4","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:48.010Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/914186/cd9b27a29b57ee136a5aed159ac07c006e0238c4.mp4 HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 312945\r\nlast-modified: Thu, 12 Mar 2026 12:00:30 GMT\r\netag: \"69b2aade-4c671\"\r\nexpires: Fri, 12 Mar 2027 12:01:57 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap02-sec01-prg1-1\r\nx-77-nzt: k4qQoWTMSOmOOOnp+To4NpTUy6YXzdD2wWvSUN9pm/0dE7aZYs04mFDiE7ormTk6muYc+oA\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad6692a3f0333\r\nx-77-cache: HIT\r\nx-77-age: 2370747\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\ncontent-range: bytes 0-312944/312945\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":312945,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"d6561a7c20361a0dcaf7121f0313d02d","sha1":"cd9b27a29b57ee136a5aed159ac07c006e0238c4","sha256":"8fa723f7c9bce2037b8e8d3223dda719ca3ccb6d05f61d0f1a99d5a34ef506c1","sha512":"91d15696f0012f22bcf724962be668badd83c6239969d4d6ab1b0d10423866b6e775429b7bf6fc84eaad74139bf3c0057ba34ddff45ed2e73912bfa293acb652","ssdeep":"6144:oC7vRZy9GSF3ipvt8AOP+lSc+BdXKkkLJ2FI7sSirtOpIQDLHnpUB39kigE:5JZCGy3KF8f+ccOdXlk12m7sSiUZDznM","tlshash":"bb6401146bb94ac7f069173e0db3db667b30d8504b06e2539345ba92fcba3f0e794192","first_seen":"2026-03-15T07:25:14.952618Z","last_seen":"2026-04-08T22:46:20.068122Z","times_seen":6,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/952586/01ba7c4355d2eedc195d6dff164c693472352993.mp4","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:48.023Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/952586/01ba7c4355d2eedc195d6dff164c693472352993.mp4 HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 393814\r\nlast-modified: Tue, 10 Mar 2026 14:37:26 GMT\r\netag: \"69b02ca6-60256\"\r\nexpires: Wed, 10 Mar 2027 14:40:26 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap01-sec01-prg1-1\r\nx-77-nzt: k/g2wH/EnLYLJCJnIHjbGW+raZIWybbITp2UE0N2UVH6zdwaf/nToVFyH3vPwlHBDy4Oujc\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad6692cc47536\r\nx-77-cache: HIT\r\nx-77-age: 2533418\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\ncontent-range: bytes 0-393813/393814\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":393814,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"b2d92c92471020f6a325896ae21d9efa","sha1":"01ba7c4355d2eedc195d6dff164c693472352993","sha256":"9f2a1eeccb5e80fd66dcfd5647ad5c0b7d2bad5cb5c3f2978eda14566777aa45","sha512":"5010df893b3bf2106a2b61a9508dc03f4096730c5db06ad314f7db5ff528b5c549aa7bfa32474f8a8c72d27ea769993e8b764c5707226ea6051eab95ae68a79d","ssdeep":"6144:L1+Ny0E191yUyuINbu9iMlAiojNmj+xN+Xqkvw39a5rcGyj1SWaY2/pI3He:Lb0M9Y3lNw/SNmqy6Is95TRJj2K+","tlshash":"69842340d77b5b66ce82f4b337a682020170c759a026d773db97da64723796e2f690b0","first_seen":"2026-03-14T13:19:04.105948Z","last_seen":"2026-04-08T22:46:20.068688Z","times_seen":76,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":66,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/952586/af01b03286ede16865909d1e62fa6f691781b906.mp4","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:48.039Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/952586/af01b03286ede16865909d1e62fa6f691781b906.mp4 HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:48 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 655515\r\nlast-modified: Thu, 22 Jan 2026 14:34:10 GMT\r\netag: \"69723562-a009b\"\r\nexpires: Fri, 22 Jan 2027 14:39:24 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap01-sec02-prg1-1\r\nx-77-nzt: k7UFx15xIYQASALEeyBSE6gairlYxQYFMSF05PH4Z+CnqNtwMzkFxUi/Oi4eeBy8iQ9GANg\r\nx-77-nzt-ray: 2a494a15fb2856f5c1dad6697c082501\r\nx-77-cache: HIT\r\nx-77-age: 6594560\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\ncontent-range: bytes 0-655514/655515\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":655515,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 v2 [ISO 14496-14]","md5":"98860e3fc00d64ee2e65f0d494df9784","sha1":"af01b03286ede16865909d1e62fa6f691781b906","sha256":"8c116ce69cba21d92f97c6b56f93d7690f65382c1e6cbd3d913cc469f505f3f5","sha512":"4558797a9ebea06a242fa9e32b6bb3e3a2aa35d76bf97e04aaf0c909e1e8b88ca66f2a58de4fa4efb75d306fac4ddd3ae81db858f6b7c830fc137af93cc8abc2","ssdeep":"12288:XgDy8XM6d/A0aCQJh/JG+y2ceMEJRr6UeJUZl5ixP0UqyzOY9shjkVbfkC:wyUMiA0WRvpJRiJql82+sGd","tlshash":"a0d423156ee1a4e2f14db3bba4c6aa134da3cb039dd04b93b8df0d400f1547e6a56a33","first_seen":"2026-01-26T13:21:06.294206Z","last_seen":"2026-04-08T22:46:20.069221Z","times_seen":93,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":84,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/914186/587b1489b391ef978978003abf99ee019b161898.webp","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.654Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/914186/587b1489b391ef978978003abf99ee019b161898.webp HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8482\r\nlast-modified: Fri, 03 Apr 2026 11:05:44 GMT\r\netag: \"69cf9f08-2122\"\r\nexpires: Sat, 03 Apr 2027 11:42:53 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\naccess-control-expose-headers: Content-Range\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap02-sec01-prg1-1\r\nx-77-nzt: kx+ss8Gnrjt2o2DvhPZaKKILAidB9Ubfh9GJhu451ESvFLX4z40dJ83B3mtXO+pr6DBGc8g\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad6695ff96026\r\nx-77-cache: HIT\r\nx-77-age: 471371\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":8482,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 600x600, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"fca28b7737c6ec179511cd112a22c0d9","sha1":"587b1489b391ef978978003abf99ee019b161898","sha256":"392b0eb749b703e924f694713b8555612fd6203df16aaad596bc18ea01dafdbe","sha512":"d2d470974fcb71a76b56fcc3878f7d88e0e2228980e39556714cbd8e3a42fb00123effd4c384838a15238fa1d44185d8678cd39b93ae027466407c1483276b35","ssdeep":"192:a9leaCR7laXoVhtuWeva0OcfzlZTIAOvya:a9ORGiteva0Oc3TIhya","tlshash":"2702aded7b02f41e8a3456d8ed32c2d44d7a03260d0d8becd8f22b523b26c5cb326612","first_seen":"2026-04-03T19:37:19.068334Z","last_seen":"2026-04-08T22:46:20.069696Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/940460/61b46f6570d89151ce4f7d88eb02cb7909d28542.webp","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.671Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/940460/61b46f6570d89151ce4f7d88eb02cb7909d28542.webp HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3874\r\nlast-modified: Tue, 06 May 2025 18:22:04 GMT\r\netag: \"681a534c-f22\"\r\nexpires: Thu, 07 May 2026 11:00:30 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap02-sec01-prg1-1\r\nx-77-nzt: k1jgM9Xx6yAYwBn8CIrup0/Cppd/lnd3pjtbE+sFkL/ukwExtNmZWl4/vP+tDULS5IZQQSg\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad6699acbaa26\r\nx-77-cache: HIT\r\nx-77-age: 28742145\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":3874,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 300x300, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5a4ff460b9f1ecd688f0b3be9a973aac","sha1":"61b46f6570d89151ce4f7d88eb02cb7909d28542","sha256":"ee9dffb7be51e71ea0e23b02fff66003b287ff61d07b0f1f5416d74830e06e3f","sha512":"c5621bf305e7a1939ea59f75d903fc5c615657df2659e491354cdf15ccc7a7aaa2091f71649ade85619fcac9c935b12369254c42073180cde9454aa566c43a2f","ssdeep":"","tlshash":"b1817e9395f0bb091be9f2ef1fb7813c848444e2ea5e451d68248b375140b7d1128cdf","first_seen":"2025-08-20T14:21:13.097424Z","last_seen":"2026-04-08T22:46:20.070559Z","times_seen":59,"resource_available":false,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/438437/497fa9b2344ff1039ca66a14b9ebe728d3dcdc46.gif","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:48.298Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/438437/497fa9b2344ff1039ca66a14b9ebe728d3dcdc46.gif HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:48 GMT\r\ncontent-type: image/gif\r\ncontent-length: 85947\r\nlast-modified: Mon, 11 Mar 2024 17:49:45 GMT\r\netag: \"65ef4439-14fbb\"\r\naccept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version\r\nexpires: Wed, 12 Mar 2025 14:55:18 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-77-nzt: kxa35b+U0+A3gWeeeKz92BvIb3TWY8raibtGk/7Yws4nzVOwuPnZ+mhMw87N8RUsxOq92YY\r\nx-77-nzt-ray: 2a494a15fb2856f5c1dad669a73be810\r\nx-77-cache: HIT\r\nx-77-age: 2360832\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":85947,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 728 x 90","md5":"8fbe8f324b6b9a3d332409e45f3e76cd","sha1":"497fa9b2344ff1039ca66a14b9ebe728d3dcdc46","sha256":"ebcf5afe60877a22679da6e2f80ff06769c27bf44a64ab4e51ad8feb102804a8","sha512":"a3a3604b87223aea3eddb9809463270eb455d1c686af7d9215931a0e70e38389efd322ef21b37b0d2d8cdd8ebd0d4c89b3ba27cb4bbada9e830ad5f5a4b06518","ssdeep":"1536:JpKSq2Du6YUrwG8ZvYN7PT0cQbH8vzBkOszHpv2jf1Ha/8:Jp/kM6xO7r4zHpv2jfk/8","tlshash":"5c8302cdd6bf94f4be80843fcbbe45810beb68e539996c1b588d55ac3a8127e09ccc01","first_seen":"2024-07-26T00:36:03Z","last_seen":"2026-04-08T22:46:20.071051Z","times_seen":36,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.862Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /ad-provider.js HTTP/1.1\r\nHost: a.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: application/javascript\r\netag: W/\"169b79c256a05ad96dcc2b8e3a5\"\r\nexpires: Tue, 07 Apr 2026 10:32:48 GMT\r\ncache-control: max-age=10800\r\nx-robots-tag: noindex, follow\r\naccess-control-allow-origin: *\r\nx-77-nzt: k+KBPF8JI9FZsAj9jyHd+v4TPPeN+MbYO9kEZglI03OG4LatfQMBAw56gXaWS/2kBdcoJAo\r\nx-77-nzt-ray: 2a494a15e5d98fefbfdad6695fa01131\r\nx-77-cache: HIT\r\nx-77-age: 2322\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":188413,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (39940)","md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.211Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /ad-provider.js HTTP/1.1\r\nHost: a.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: application/javascript\r\netag: W/\"169b79c256a05ad96dcc2b8e3a5\"\r\nexpires: Tue, 07 Apr 2026 10:32:48 GMT\r\ncache-control: max-age=10800\r\nx-robots-tag: noindex, follow\r\naccess-control-allow-origin: *\r\nx-77-nzt: k1HHHpr+yqJXh8pZb2XQFqwb5Y5D/mrLJBrGZWndbzsKGcQxlXbEk4zHqWj7D/Mqp5AtCP4\r\nx-77-nzt-ray: 2a494a15e5d98fefc0dad669fd8a720c\r\nx-77-cache: HIT\r\nx-77-age: 2323\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":188413,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (39940)","md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"resource_available":true,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQQWoDMQz8Sj+wRpIlW865ubbQ0ge43my7h2xKEpYW9PjKGwqFeLAM0ow0MgGlAXgAfUDdsew4W8FQIDAFFLan5xdjtM/Dcq1zO63zGNb5yzmMmqwoJSRDKATKJqoRCUxATQmKkBpGoogIyRgsGjhIIrO/EmA/iGWwt9fH7aLD9R77XENv03Ok8I1AXXPQolV4hIYJhAmnKTc6TLUBplEnp8OdW7ghuKAYG/0lHEPnR+RIbskP2Jaul5+lmf0jdsi2AHU9Gt+Vb8AeYoBYsq+ZOBXdD9qnYw8AsnkEu4Rj/bic19BOR0/1dhvHsH8Dsv/XWs9zvc6nZavD5k44Zs0jtwIQW4k81dJSzlLeG5bpF0zaQ1zSAQAA\u0026cb=e2e_69d6da9b781751.61325368","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.765Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQQWoDMQz8Sj+wRpIlW865ubbQ0ge43my7h2xKEpYW9PjKGwqFeLAM0ow0MgGlAXgAfUDdsew4W8FQIDAFFLan5xdjtM/Dcq1zO63zGNb5yzmMmqwoJSRDKATKJqoRCUxATQmKkBpGoogIyRgsGjhIIrO/EmA/iGWwt9fH7aLD9R77XENv03Ok8I1AXXPQolV4hIYJhAmnKTc6TLUBplEnp8OdW7ghuKAYG/0lHEPnR+RIbskP2Jaul5+lmf0jdsi2AHU9Gt+Vb8AeYoBYsq+ZOBXdD9qnYw8AsnkEu4Rj/bic19BOR0/1dhvHsH8Dsv/XWs9zvc6nZavD5k44Zs0jtwIQW4k81dJSzlLeG5bpF0zaQ1zSAQAA\u0026cb=e2e_69d6da9b781751.61325368 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQQU4DMQz8Ch9oZDt24vQMV5BAPCDN7sIe2qK2WhXJjyfeIoQgo0SWPeNxTEBpA7wBvUPdsmw5W8FQIDAFFLbHp2djtPfxcKlzOy7zEJb5wzgqx05VSkiGUAiUTVQjaDIBtRxzztBrSIJSshqDRYMOksjsUQBAy2CvL/frxQ6yCHAlgR67uREYe4UUrgjkwlGLVuEBGiYQJpym3GicagNMg06dDv9G7g0xZXF75aTuXtLNEX6wcWVEjtQn7AdsTdfz56GZ/SI65Ps/sPr9rd5ATpEADxtxR/SHVz7YOezr2/m0hHbc95R3CJhc5P/lvq+lnuZ6mY+HtewaS2koY9wRlV3fbE7TMLYmtSWKUcY6fQFGtDON0gEAAA==\u0026cb=e2e_69d6da9b91d006.65077358","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.898Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQQU4DMQz8Ch9oZDt24vQMV5BAPCDN7sIe2qK2WhXJjyfeIoQgo0SWPeNxTEBpA7wBvUPdsmw5W8FQIDAFFLbHp2djtPfxcKlzOy7zEJb5wzgqx05VSkiGUAiUTVQjaDIBtRxzztBrSIJSshqDRYMOksjsUQBAy2CvL/frxQ6yCHAlgR67uREYe4UUrgjkwlGLVuEBGiYQJpym3GicagNMg06dDv9G7g0xZXF75aTuXtLNEX6wcWVEjtQn7AdsTdfz56GZ/SI65Ps/sPr9rd5ATpEADxtxR/SHVz7YOezr2/m0hHbc95R3CJhc5P/lvq+lnuZ6mY+HtewaS2koY9wRlV3fbE7TMLYmtSWKUcY6fQFGtDON0gEAAA==\u0026cb=e2e_69d6da9b91d006.65077358 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":191,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":191,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/952586/e20ddb181d1bde58425d57018de46d69c8d4a74f.mp4","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:48.056Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/952586/e20ddb181d1bde58425d57018de46d69c8d4a74f.mp4 HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:48 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 492336\r\nlast-modified: Tue, 10 Mar 2026 14:26:34 GMT\r\netag: \"69b02a1a-78330\"\r\nexpires: Wed, 10 Mar 2027 14:31:15 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap02-sec02-prg1-1\r\nx-77-nzt: k0a8ZvxzYslQtt/y23eGimEVrMeIwe99wMenFqktBqINBpuDXJuPvqm4HD7020QdFUKF81o\r\nx-77-nzt-ray: 2a494a15fb2856f5c1dad669b24a3301\r\nx-77-cache: HIT\r\nx-77-age: 2533419\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\ncontent-range: bytes 0-492335/492336\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":492336,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"e5e802bcd7066fbd4c074262bfd960cc","sha1":"e20ddb181d1bde58425d57018de46d69c8d4a74f","sha256":"282f0a15f752b7a15d23399a7d067b95b4a63f5abf33c4186697e559e85069ba","sha512":"1d9fa825b0d7168641721410fb9213cc1f126badc885b8f4ed5b755dcb38c31550d7714ed0bd296c1f5bd790191d7713860103008263cfb07a77953d22d36baf","ssdeep":"12288:CgUyALsu00KyGibgtyae7wYAuq3JAn0zwz6+uXIPI:pnyGibae71Lq3JAn0sVu3","tlshash":"c3a423f493b9addfc1a7e07073b1c722a7f3e219e0068f4b99e0c8d99c95da85c22515","first_seen":"2026-03-13T08:27:01.872201Z","last_seen":"2026-04-08T22:46:20.071558Z","times_seen":59,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":69,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/css/extra/colors.css","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.811Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/assets/css/extra/colors.css HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\nlast-modified: Thu, 05 Mar 2026 09:05:33 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\netag: W/\"69a9475d-b0\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mwNSqCImAmAR0SBQJI8%2FwPWCVJTYzlHKI7dHI23TJFqEo1L1aRNrSM2uk%2BsXIhcZQdJL7zR4n6nV6P3ByLSbKomDEO0c4Gn9GECYMZ7lXwSiZCiM2tdqU6E8uwKdbJjzIxw%3D\"}]}\r\ncf-ray: 9e94cde75b3fb4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":176,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"ea7f8625aa8e7ab89aea9d27fcaff9f2","sha1":"4e0360c13c4e2a073d171a2e47078e5f494cf55b","sha256":"672021a18ae3ad18da1bd2685e4e665a7773be1d7f094d339d200fa0d543ffab","sha512":"f71bde42821dcf11f8b4319e0045a6afc31cf3fa17dc10215aba92ddcf54dd24a0ff379c5d7f94102d0e6345244145b66b012f63b1834ee344d13bba7572e79b","ssdeep":"","tlshash":"eec092485c535a1440af2caf77eaa42323333ecb2818ff033ecc55a52f491093eaa291","first_seen":"2023-10-13T19:00:11Z","last_seen":"2026-04-08T22:46:20.072071Z","times_seen":46,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/vendor/libs/fontawesome/v6.1.1/webfonts/fa-solid-900.woff2","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.221Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/assets/vendor/libs/fontawesome/v6.1.1/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/assets/vendor/libs/fontawesome/v6.1.1/fontawesome.min.css\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 154228\r\nlast-modified: Tue, 22 Mar 2022 13:08:02 GMT\r\netag: \"6239ca32-25a74\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bXjFj%2FUTGsyZRBZqH5uQ27pv1TZJ46qW8hpGKPCk7yUrOrU50LkMCPZBvYDrRcut1DJtDuSzOWyfZRrSW3kbgz%2BBgRwG8hCtFOSgHdmBuCpGcYsKUiAZRDy2GKEKUqWi7cI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e94cdea2b78b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":154228,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 154228, version 769.768","md5":"55b416a8df21f9f987aa352f10d1343b","sha1":"2717f3f58271f2f2e6120d9937c7227002656d34","sha256":"d76fb4e841748a3f6bc63efa23156e02631c283bf41f84efcbdaf339ea3e1b73","sha512":"7c4983811eba2ae80998c62c0eb48cc53eec26e3ca4222d5cf0a758a5ea92e6a14dcfed4fe5b7ef5513f89be2c0f336d0131687fa3eddcbd4bb218bbd6beb985","ssdeep":"3072:1s6054PmrMMxqMo/sE4yN1JWxUY+qI2kqdYt2B1dqchgjwQ:W68io3G5JYktDt62b","tlshash":"fce3123d3f8fc58deaa2037b7c645050a1b9bfa9a9f1293dc67028ac11557e17b48d8c","first_seen":"2023-04-05T03:24:19Z","last_seen":"2026-04-09T00:44:15.830247Z","times_seen":16658,"resource_available":false,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/914186/eedf480bcef94c6d841ce5ef1b0a3406389ce6b5.mp4","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.983Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/914186/eedf480bcef94c6d841ce5ef1b0a3406389ce6b5.mp4 HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 621029\r\nlast-modified: Fri, 03 Apr 2026 11:10:15 GMT\r\netag: \"69cfa017-979e5\"\r\nexpires: Sat, 03 Apr 2027 12:08:11 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\naccess-control-expose-headers: Content-Range\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap02-sec02-prg1-1\r\nx-77-nzt: kwzYDV6wTov7UX8Mr/RFyMb/mYGcLWYuUF49VlOvpDQTuOes46oGrEa+3hlUy/e5MSUxIpw\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad66928d32932\r\nx-77-cache: HIT\r\nx-77-age: 470177\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\ncontent-range: bytes 0-621028/621029\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":621029,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"a6e1be003122c6bd03b0535294ab9a40","sha1":"eedf480bcef94c6d841ce5ef1b0a3406389ce6b5","sha256":"6faab7dc8b74c8b529aca40fa6490f380f7254876d125a9b6e9f5969fd7ea420","sha512":"452cb27770aeebdc0e018cd2497ad8f90649085f66aeacdf9aa4705944495962f4600cb63c725cb9ce5851edfa5b5ef5f3da9f753aa5ad4c4a496150442c08e7","ssdeep":"12288:k4eSqK2M2PaFiPOnQhMEZ1M+W/XWrrdYmqjJI95DH/Gn4ouEfzb:0NK2MFQRZ1M+8XW/dYFS9Zu4ouELb","tlshash":"b0d4225547b517e7f228163cdefbe7053226c8462702d65f83107304feb0a96fac99a8","first_seen":"2026-04-03T19:37:19.033982Z","last_seen":"2026-04-08T22:46:20.073037Z","times_seen":4,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":60,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/vendor/libs/jquery/jquery.min.js","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.827Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/assets/vendor/libs/jquery/jquery.min.js HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 01 Oct 2021 19:56:55 GMT\r\nvary: Accept-Encoding\r\netag: \"61576807-15d9d\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QhFsHwvdw65ckfac6PhUGLW2z9Kw2CVabOaWqK2Vucvrkch%2FAn7JgEBQ%2FTJZRrxJJhNM8WqAOhFQl2HongqOmZqZ7DcHY%2BCc6dnCLvdX%2BuRtKFzl7wlPcUVeBpAXvHQ4mDU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e94cde76b47b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":89501,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-04-09T01:36:24.334373Z","times_seen":447096,"resource_available":true,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":105,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/v1/api.php","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.204Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"POST /v1/api.php HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain\r\nContent-Length: 444\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":444,"data":"{\"user\":{\"ua\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"language\":\"en-US\",\"referer\":\"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\",\"consumer\":\"ad-provider\",\"gdpr\":{\"gdpr\":0},\"screen_resolution\":\"1280x1024\",\"window_orientation\":\"landscape\",\"cookies\":[],\"scr_info\":\"YXN5bmN8fDM%3D\"},\"zones\":[{\"custom_targeting\":{},\"id\":5883096,\"extra_params\":{\"first_request\":true,\"zone_type\":31}}]}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nAccess-Control-Allow-Headers: Authorization, Content-Type\r\nAccess-Control-Request-Method: POST\r\nSet-Cookie: __uvt=s%3A32%3A%22287046cadc3439c8004addbf506a2d5a%22%3B; expires=Fri, 07 Apr 2028 22:45:47 GMT; Max-Age=63072000; path=/; domain=magsrv.com; secure; SameSite=None\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13973,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"e80d4f9078b503241a1ee1cae5fbafdb","sha1":"bf73edd2aed722a26a4a5f26ac4c78749c5b86f1","sha256":"958c0164dcc0039c5fc086cb1f7b9dde4402536e839e17ccc3484d75d6affdb3","sha512":"8b5828bf278452d4acda7329689190b0514f76197812a3fd24c4a03e27f1e9df33ba41155c24d37ecafe7f112ea8876a4e4968ec0de1f220a11866f9ccbfde4c","ssdeep":"192:9Lnc6cUtjMAINCpeTgzRqENCpeTgzRxZNCpeTgzR1ANCpeTgzRYDcNCpeTgzRlTL:1c6cOUNOVNObNOONOxNONNyrWSSNP","tlshash":"b35239701499ee6e137196f7d801a69cff420a9f4c9965afde4ac1a620ff8b1f0c6344","first_seen":"2026-04-08T22:46:20.073568Z","last_seen":"2026-04-08T22:46:20.073568Z","times_seen":1,"resource_available":false,"data":null}},"time_used":319,"timings":{"blocked":70,"dns":1,"connect":26,"send":0,"wait":177,"receive":0,"ssl":37},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/js/extra/extra.js","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.834Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/assets/js/extra/extra.js HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Wed, 20 Jul 2022 15:36:04 GMT\r\nvary: Accept-Encoding\r\netag: \"62d820e4-66e\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FqGm2MwDsE79g1o239dMr%2BzYyd%2FNejLhhmnO5tMOjaWF3z87MT%2FtXgjM68e%2Boz62lUuE02Yd%2FXjVWv6Gmkfk4VEWQ46i%2BvaKfqdXH9hdFabRbUcyKaP7SviYqMJTG8x%2FSds%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e94cde78b5fb4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1646,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"1ea368b0d1884c14d0ef31525ede5718","sha1":"4f2324cba8533195f596b6b4b27dba75cce31c02","sha256":"d5e2cfc10e90c257761d93ea813670288980565c75ecb14efe3e2851a6bf76a7","sha512":"b80159f0328b03269f12b1708dd92076c15999e581be51f62d012591f1ff78a8401c3a8d0a258b926767cff44a63bcafb7808ad3ff6055851a7d62f5c7027157","ssdeep":"","tlshash":"4331e11e32ba947d80b7706a5abf9d093931044b1608fe087f5c77a05f445eea9f27c6","first_seen":"2023-03-14T16:40:15Z","last_seen":"2026-04-08T22:46:20.074429Z","times_seen":64,"resource_available":true,"data":null}},"time_used":105,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":105,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/css/extra/extra.css","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.813Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/assets/css/extra/extra.css HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 03 Jan 2022 00:35:36 GMT\r\nvary: Accept-Encoding\r\netag: \"61d244d8-373\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0W8KBystZR8M2elWMxpX138izL57GB6ojOqkC%2B2huLyhHnIe87%2BT6CHfIrO23sfm6HYfxEqzrPUF6pkh0dVjGumlsyx0DzLmcyoVMG814sl4tu2EpYsjDKkm5PQtqz7POeA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e94cde75b40b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":883,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"0c01ce7bc2a4dc5ed8c6f38cc9094eca","sha1":"28b204c996643b4b30bca6cea1642833748de1f9","sha256":"9d45a35c655775f855c086ee6839bab57c07390900cbdb3037691f1e5a8cd84f","sha512":"72dc8acfd47ec3ab5818527b2ff7e0fa43015d4ca1613dcfa83205f6249c032601009a171842f7dabee453492c1f8b3e5c8d42815ab2c1109f8a5fb47c748efb","ssdeep":"","tlshash":"4d11afd352272c8e7c5bd61907f80685333a2023f31fe96a3b9d63545f831f64852ea4","first_seen":"2023-05-26T21:42:37Z","last_seen":"2026-04-08T22:46:20.076113Z","times_seen":162,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/vendor/libs/simplebar/simplebar.min.css","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.808Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/assets/vendor/libs/simplebar/simplebar.min.css HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 01 Oct 2021 19:17:47 GMT\r\nvary: Accept-Encoding\r\netag: \"61575edb-b79\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VNRYdvRF4QW2tMdp%2FjGDasfN5Y8oKn%2Bd%2BcUlr%2Bwhz7Dxt9O%2BYk%2BG%2B2R4kGk0vEWP%2FHtiUiJkUONVLiA8x4dbxdHLDkU5FdMe7gS9vFQFbBhDpys5Nvtx%2F5EcHsXhNN6x5q4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e94cde75b3cb4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2937,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (2936)","md5":"a7833a871d7e2882523d2750ba1f8d78","sha1":"393c58cca7889217fc0c528e7902fd5178314e50","sha256":"56f1018c32be3d6be2fbe926c035e3e2321fbb09d5a04abdb45ddf3cfc3ae085","sha512":"b994f069862124b157697626d6374d887e89675c0b0935676ab2736bb899d4e2909af8baa6bb64f3934cbe27284a86f294fe4ae0509d184738be4d40613f1bf5","ssdeep":"","tlshash":"2051cd3186b434b8d7ffd22551d3667c412a90c1fbae028cd1769f28a2cd67e1a1a98c","first_seen":"2023-04-06T23:34:25Z","last_seen":"2026-04-08T22:46:20.076552Z","times_seen":504,"resource_available":false,"data":null}},"time_used":106,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/vendor/libs/bootstrap/bootstrap.bundle.min.js","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.830Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/assets/vendor/libs/bootstrap/bootstrap.bundle.min.js HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 01 Oct 2021 19:42:26 GMT\r\nvary: Accept-Encoding\r\netag: \"615764a2-13367\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3yH4hVcZfzx5jGPq%2FHD%2Be9uaAu%2FDfieCiNoCgtA5TF6KRAwq7bV62Z7tbrVriGMClmHwOoM%2BtiS47wT0cLn5uG2GvvnbvD1VbdZSWQBWo59tFy4Km%2FP5%2BGL9WQ7pZPBJQpc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e94cde76b48b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":78695,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65299)","md5":"74d375bb9f1208a67546d7b1b9e7b73c","sha1":"11aad571327ebccf184e62ec03b32c67a028846f","sha256":"8f27c2a51f4f713efda3881de03697fdce7a5022874d94d5256e106e0322d598","sha512":"459019069586a628c3a957ed609bc77a7d08c3258cfa6d7d9eeeeea6b46b29d9703e3f2682123ef09a7807079b35dacf522136d39377ce412d6fb83466c42701","ssdeep":"1536:tp+1ZTPR2t4tXbih05ve8/pwgrEpc9t0vSAIAxCH:MFRIpk0vSAW","tlshash":"5673d7493254b87309ee55a68037460bf3255994b14b802cb9bdadde2b3dc8272b7f78","first_seen":"2023-03-07T12:10:33Z","last_seen":"2026-04-08T22:46:20.077043Z","times_seen":397,"resource_available":true,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":108,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.233Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /ad-provider.js HTTP/1.1\r\nHost: a.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: application/javascript\r\netag: W/\"169b79c256a05ad96dcc2b8e3a5\"\r\nexpires: Tue, 07 Apr 2026 10:32:48 GMT\r\ncache-control: max-age=10800\r\nx-robots-tag: noindex, follow\r\naccess-control-allow-origin: *\r\nx-77-nzt: k7YeRhdfRmrVMqsTzInC5KHldubNdB5LC9LZ7imEDCUj4+1B8tFKHjyvGyfiLbqu2qqxfds\r\nx-77-nzt-ray: 2a494a15e5d98fefc0dad669fffa170e\r\nx-77-cache: HIT\r\nx-77-age: 2323\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":188413,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (39940)","md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":3,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.251.38.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.272Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 16 Mar 2026 08:38:40 GMT","end":"Mon, 08 Jun 2026 08:38:39 GMT"},"fingerprint":{"sha1":"93:71:51:4C:A3:35:66:7B:96:98:73:5F:8A:D5:61:38:29:33:E3:58","sha256":"A7:C2:55:50:7A:01:61:98:C7:16:8F:8D:72:97:DD:77:B2:9D:D8:18:29:80:41:DE:61:95:42:E5:0F:79:FE:EF"}}},"request":{"raw":"GET /s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 43136\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 03 Apr 2026 21:23:23 GMT\r\nexpires: Sat, 03 Apr 2027 21:23:23 GMT\r\ncache-control: public, max-age=31536000\r\nage: 436944\r\nlast-modified: Wed, 18 Feb 2026 19:51:37 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":43136,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 43136, version 1.0","md5":"665db5e157d2138835c4037c971ff3a4","sha1":"41ca6b7e4818eb81531d8006ff7ddd971c640879","sha256":"1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc","sha512":"6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a","ssdeep":"768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW","tlshash":"f9130231eb70ee59962c903454e7fda9433b1457d731aca80e99a1ce6f8103454facec","first_seen":"2026-02-19T22:27:43.350598Z","last_seen":"2026-04-09T01:42:05.475933Z","times_seen":70110,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":14,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.251.38.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.364Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 16 Mar 2026 08:38:40 GMT","end":"Mon, 08 Jun 2026 08:38:39 GMT"},"fingerprint":{"sha1":"93:71:51:4C:A3:35:66:7B:96:98:73:5F:8A:D5:61:38:29:33:E3:58","sha256":"A7:C2:55:50:7A:01:61:98:C7:16:8F:8D:72:97:DD:77:B2:9D:D8:18:29:80:41:DE:61:95:42:E5:0F:79:FE:EF"}}},"request":{"raw":"GET /s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 43136\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 03 Apr 2026 21:23:23 GMT\r\nexpires: Sat, 03 Apr 2027 21:23:23 GMT\r\ncache-control: public, max-age=31536000\r\nage: 436944\r\nlast-modified: Wed, 18 Feb 2026 19:51:37 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":43136,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 43136, version 1.0","md5":"665db5e157d2138835c4037c971ff3a4","sha1":"41ca6b7e4818eb81531d8006ff7ddd971c640879","sha256":"1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc","sha512":"6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a","ssdeep":"768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW","tlshash":"f9130231eb70ee59962c903454e7fda9433b1457d731aca80e99a1ce6f8103454facec","first_seen":"2026-02-19T22:27:43.350598Z","last_seen":"2026-04-09T01:42:05.475933Z","times_seen":70110,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/438437/98985d83f83371222d99041eb705ad13286c4f2c.webp","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.824Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/438437/98985d83f83371222d99041eb705ad13286c4f2c.webp HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: image/webp\r\ncontent-length: 23662\r\nlast-modified: Mon, 11 Mar 2024 16:08:42 GMT\r\netag: \"65ef2c8a-5c6e\"\r\naccept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version\r\nexpires: Wed, 12 Mar 2025 15:24:26 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-77-nzt: kzcdJ/ZsD2VRjcLVZsM95bPbWzYyM5+eguML7sSmhfwtwRKwYWt6OMiLjvuuCdb9UfNqI2c\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad669a2379a2f\r\nx-77-cache: HIT\r\nx-77-age: 2357444\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":23662,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"32151f3d0fe7cb43cafc82f61a034fe9","sha1":"98985d83f83371222d99041eb705ad13286c4f2c","sha256":"609b97c05336a7c60ed17ca1c84e28452c10f2bd749ca13d626d299788ad5aa6","sha512":"a820c3f6d777c02c01cecb0f248386c04d3d8532a0bb9c91048bfc8f39fa0f1db6be8d31e98809326ac56afd663171308ffd67fa5f7ee212cd9999cac8f85af2","ssdeep":"384:gFBTT8WcQvw6l15s5xfuETS0tC5uVGIe9xm4ev6dfK9byVVp1Bc5FjowGrxZcKc7:gFRFI6lA5RVHtMuVGIw7nuWpz0FL4eK6","tlshash":"93b2e18521b087d99b1f7f31994e90931b007bba7ad5ea0b0e00de382e95bc719a0f85","first_seen":"2024-11-30T17:25:10.97624Z","last_seen":"2026-04-08T22:46:20.077553Z","times_seen":114,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/940460/63fc90a0bf32d356fd4fb9a10caa51cf4f61c131.webp","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.676Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/940460/63fc90a0bf32d356fd4fb9a10caa51cf4f61c131.webp HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7284\r\nlast-modified: Fri, 23 May 2025 09:58:52 GMT\r\netag: \"683046dc-1c74\"\r\nexpires: Sat, 23 May 2026 10:26:15 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap02-sec02-prg1-1\r\nx-77-nzt: k8eF7ovcKor1dHah8CvEYFoo1WL22dN4D7OSqZ3JWTj7X+pUGCZYEHHUs3GYPycbYigX6RY\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad6696e6ec026\r\nx-77-cache: HIT\r\nx-77-age: 27679891\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":7284,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 300x300, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0631e20bcb63e6cc461675346a934b34","sha1":"63fc90a0bf32d356fd4fb9a10caa51cf4f61c131","sha256":"23427e4cd500a45207269ff3f869d7322daae19ea6025a3c5b601014cd0867a4","sha512":"9ff4c13a83bf2afcca0da54bca7f9b001967d2497f293fee91dde54139b7740ded316928d2492224f7d75e6c2b5938baa653feda669eb315b3a3cbdea12a3cba","ssdeep":"192:VDNa+IdPD531gDJ7PME0gC0j7yUtn36kTmp04aLnM:VYrgPLCW7yu3L404azM","tlshash":"d3e18de61ec461fa2c901bba5c78d749ca653ad82c6371fdc84a64b6cccb1680fc5ad4","first_seen":"2025-08-10T15:55:01.776483Z","last_seen":"2026-04-08T22:46:20.078073Z","times_seen":45,"resource_available":false,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/952586/fda04d2e832712ae35e8eb8ef42049a2844a1cb7.webp","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.886Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/952586/fda04d2e832712ae35e8eb8ef42049a2844a1cb7.webp HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7602\r\nlast-modified: Tue, 10 Mar 2026 14:23:57 GMT\r\netag: \"69b0297d-1db2\"\r\nexpires: Wed, 10 Mar 2027 15:00:05 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap02-sec01-prg1-1\r\nx-77-nzt: k2VsEKbSKCRWLF6/CBgSeBADK21wBKr52ek7siHcu+gHkuNCsGbfjnufHc9E6b+bllT4uPM\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad669f8a3d430\r\nx-77-cache: HIT\r\nx-77-age: 2533415\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":7602,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 300x300, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"20378d6c3a0edbe234c71d0a49620a7c","sha1":"fda04d2e832712ae35e8eb8ef42049a2844a1cb7","sha256":"13fb6c7f6a0b2876c31e42476bc28ad8492e47e926e00588b1e1fc8af52e1788","sha512":"1ab1a493bb05cbccc52368ca3835ae1dcce718e9e87e5824217857fe1d93ccd1f240ab142bfd1c15f748a53b25e1a0cc0897be0fa22c9887b1e8558b0319d94b","ssdeep":"192:VDZqiL/CSjhEFhcK3BNCzUL+mUbQjZkOqnQZzJORvP3E:VDMs/CSOFhcKuQLgEdkMEvPU","tlshash":"80f19e6aa3c9d80bfc3da4e3ed66ba531c6660c7fc20dd5b8693041d513ae643821f28","first_seen":"2026-03-12T21:35:09.876986Z","last_seen":"2026-04-08T22:46:20.078573Z","times_seen":55,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQW04DMQy8ChdoNH5k4/Sbb5BAHCBkd2E/aFFbrYrkw5NsJYQgoySWZyaOzeBhB93B7sj2GveaPFPICMqBovrD45Mr+ft0uJSlHtdlDOvy6UJ5YHg2HoidkBmmHs0EZh5hntKQwObEioGGllG4OBo4imqPAkCe4C/P99umBnYBrhFocS/uiV07w4Yrgbtxsmwl6ojaHo7KNM+p8jSXChpGm5sc/76MGwJL1q0OfrDreiEVbv9qC76ly/nrUN1/CTvi1kXsR7f9pW+QNsdbg5B+0dZbZ87ho7ydT2uox4+W6v5AXZy7RNuQ1nJaymU5Hja6e5zSVLjOdcxSksyZJ3mdahI14XFW+gaTz4SsxwEAAA==\u0026cb=e2e_69d6da9b91e331.72930207","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.248","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.900Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQW04DMQy8ChdoNH5k4/Sbb5BAHCBkd2E/aFFbrYrkw5NsJYQgoySWZyaOzeBhB93B7sj2GveaPFPICMqBovrD45Mr+ft0uJSlHtdlDOvy6UJ5YHg2HoidkBmmHs0EZh5hntKQwObEioGGllG4OBo4imqPAkCe4C/P99umBnYBrhFocS/uiV07w4Yrgbtxsmwl6ojaHo7KNM+p8jSXChpGm5sc/76MGwJL1q0OfrDreiEVbv9qC76ly/nrUN1/CTvi1kXsR7f9pW+QNsdbg5B+0dZbZ87ho7ydT2uox4+W6v5AXZy7RNuQ1nJaymU5Hja6e5zSVLjOdcxSksyZJ3mdahI14XFW+gaTz4SsxwEAAA==\u0026cb=e2e_69d6da9b91e331.72930207 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":190,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":190,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Roboto:wght@100;300;400;500;700;900\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.801Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 16 Mar 2026 08:38:41 GMT","end":"Mon, 08 Jun 2026 08:38:40 GMT"},"fingerprint":{"sha1":"03:81:A0:0E:E1:9B:80:A3:BC:CD:F9:25:A5:7B:8A:43:07:22:C6:00","sha256":"73:8D:9A:B1:F0:C3:6E:8F:EE:C0:2F:99:C8:89:24:16:9A:DB:D1:9C:27:5D:8A:7A:A8:2B:0E:10:42:28:53:7F"}}},"request":{"raw":"GET /css2?family=Roboto:wght@100;300;400;500;700;900\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Wed, 08 Apr 2026 22:45:47 GMT\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":33510,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"a763918f3b1cf01f5127eaaaa4e5ed36","sha1":"e5932e684c5249dece73f827719829b05315deda","sha256":"316e33bfe6ab63fbb1920bfcf23774c4a779aa22c0707c7831064f9a1bb87c43","sha512":"adeeb53b0a7524e78f035b88e7993fee8484360c90ce3e6d3d69536ebf2aea3dc5d1cd45a94f0dbf8ce9ed4989351a1258ae07663871bd407bd3baa6b33d7f0e","ssdeep":"768:DDZDCDHDHDY4DRLDuDWDyDS99YURRuWDyjooYhREHPM5svvYaR7AIWP2ZZYQRVK7:Xxyllff","tlshash":"04e210a1041744009b838ce223cebf35fe1f52117142d0b5abfd9b6baddbca6526936d","first_seen":"2026-02-19T23:46:21.252973Z","last_seen":"2026-04-09T00:41:06.696868Z","times_seen":897,"resource_available":false,"data":null}},"time_used":530,"timings":{"blocked":240,"dns":6,"connect":12,"send":0,"wait":21,"receive":0,"ssl":240},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/css/extra/custom.css","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.816Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/assets/css/extra/custom.css HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: text/css\r\ncontent-length: 0\r\nlast-modified: Tue, 12 Jul 2022 19:11:11 GMT\r\netag: \"62cdc74f-0\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oKx7oSd%2BZYQ9kidLqtHck5wzmCve0oVSlcEAdnDpPbipN9vagiryfHbZ2CrJS8CC4egMbTbMX9GcOUv6O28AqKeVIADcF0WGOFRdVRq8apuTLZZ%2BSV2RHcmpylyvXHa3gXY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncf-ray: 9e94cde75b42b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/css","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":103,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":103,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VPW04DMQy8ChfYaOw4Waff9BckEAfYZnehH20RRRVIPjxOKlEkMoqTTGb8YHAeIAP0jnQjaSOjFQoFQThQEnt4fDIhe1uOn9O+ni77OVz271YSJ81WlDOxEQpDxZJqRIElqI1jjETZKCLTWMAmsGhwcIoiflLAdkg2wl6e7/smB5uHVtaI2bRxrPgicPMsWnRKMqNSRhKmdR0rL+tUQXnW1eX4162XYhH3c0nF+0WIxXP7u/dzxdCckSS61HzBOj2dv4/V7FdGdDWlPgy3RzPan0w3jLcpEUAtANQNsHM4TK/nj0uop4NTLUXXeIn+37l+gRBF4VUozbuia8EuxqVmmqLmNM8/fVo5f8YBAAA=\u0026cb=e2e_69d6da9b921e41.68580169","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.916Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VPW04DMQy8ChfYaOw4Waff9BckEAfYZnehH20RRRVIPjxOKlEkMoqTTGb8YHAeIAP0jnQjaSOjFQoFQThQEnt4fDIhe1uOn9O+ni77OVz271YSJ81WlDOxEQpDxZJqRIElqI1jjETZKCLTWMAmsGhwcIoiflLAdkg2wl6e7/smB5uHVtaI2bRxrPgicPMsWnRKMqNSRhKmdR0rL+tUQXnW1eX4162XYhH3c0nF+0WIxXP7u/dzxdCckSS61HzBOj2dv4/V7FdGdDWlPgy3RzPan0w3jLcpEUAtANQNsHM4TK/nj0uop4NTLUXXeIn+37l+gRBF4VUozbuia8EuxqVmmqLmNM8/fVo5f8YBAAA=\u0026cb=e2e_69d6da9b921e41.68580169 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":189,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":189,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/940460/8fefe124469042cd9bfd40494c9d55d1a58314f8.mp4","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:48.022Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/940460/8fefe124469042cd9bfd40494c9d55d1a58314f8.mp4 HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 242979\r\nlast-modified: Fri, 23 May 2025 09:59:01 GMT\r\netag: \"683046e5-3b523\"\r\nexpires: Sat, 23 May 2026 09:59:35 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap01-sec01-prg1-1\r\nx-77-nzt: k8Lzdu/Qljru8CtlFLcg/6pcIkaeP3Xc7Z+HA/NaBaXPB/LQbye7azMSgNtimxGKyDkPXGQ\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad669b1cf0f35\r\nx-77-cache: HIT\r\nx-77-age: 27684406\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\ncontent-range: bytes 0-242978/242979\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":242979,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"5888df513b1f1beedef093852e0b4cf0","sha1":"8fefe124469042cd9bfd40494c9d55d1a58314f8","sha256":"8729fba9d1bc2f2873c6e7e3ab491b4687cc9eaa9f348a34828cb3d8a4d6b20c","sha512":"cf69f947d7beae74cf8f3d5404a44a34140421f9052b10ca3cfedbace8ccf18216581830d8820869c2c9c85ddf3910c4185ca746f4d2806bda57f2fe99132c46","ssdeep":"6144:pgIProlnES1dE1SjBvdUCNyAs/cDilK2WsJI0OPsQoH:pPDolEei1SjBFSUDszGlPsjH","tlshash":"6a34120b77b088e2e644273c6f67d3123214ea5077a28d438351b66cfd7afa8c8d59d9","first_seen":"2025-08-10T15:55:01.826432Z","last_seen":"2026-04-08T22:46:20.079537Z","times_seen":36,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":44,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.797Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /ad-provider.js HTTP/1.1\r\nHost: a.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: application/javascript\r\netag: W/\"169b79c256a05ad96dcc2b8e3a5\"\r\nexpires: Tue, 07 Apr 2026 10:32:48 GMT\r\ncache-control: max-age=10800\r\nx-robots-tag: noindex, follow\r\naccess-control-allow-origin: *\r\nx-77-nzt: k6DVIGgvYns2GEs6fp9oibRs5urdjcks0P28P9LnzhokkH3OmaqgUhyQ0jLglS0k/3tYPlY\r\nx-77-nzt-ray: 2a494a15e5d98fefbfdad66993130a31\r\nx-77-cache: HIT\r\nx-77-age: 2322\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":188413,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (39940)","md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"resource_available":true,"data":null}},"time_used":86,"timings":{"blocked":26,"dns":20,"connect":1,"send":0,"wait":1,"receive":0,"ssl":33},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/v1/api.php","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.251Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"POST /v1/api.php HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain\r\nContent-Length: 443\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":443,"data":"{\"user\":{\"ua\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"language\":\"en-US\",\"referer\":\"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\",\"consumer\":\"ad-provider\",\"gdpr\":{\"gdpr\":0},\"screen_resolution\":\"1280x1024\",\"window_orientation\":\"landscape\",\"cookies\":[],\"scr_info\":\"YXN5bmN8fDM%3D\"},\"zones\":[{\"custom_targeting\":{},\"id\":5883084,\"extra_params\":{\"first_request\":true,\"zone_type\":2}}]}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nAccess-Control-Allow-Headers: Authorization, Content-Type\r\nAccess-Control-Request-Method: POST\r\nSet-Cookie: __uvt=s%3A32%3A%228e578f4a78f726163a2531078c0b5494%22%3B; expires=Fri, 07 Apr 2028 22:45:47 GMT; Max-Age=63072000; path=/; domain=magsrv.com; secure; SameSite=None\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2064,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"c93f59d232276df0a65b179082167fff","sha1":"a62b30f3217753a6f2108971589c1cf4958d9776","sha256":"1c7a615eff61b9d55409eef88f087910ff02699dec4253ea28b52bea7dee7c6d","sha512":"cc95098b5767afc2cb2c57efc01a5f5b7e1b90f975d8b10c23b530e6a06fbcb58e8a86d58cb1d58398a5420a7aa9b581085c0c094fd3efef763184dcf4252166","ssdeep":"","tlshash":"51412cf676c040fe7dd15444dfca3656bc9e70179663e4c94304499078fc188194d7e0","first_seen":"2026-04-08T22:46:20.080454Z","last_seen":"2026-04-08T22:46:20.080454Z","times_seen":1,"resource_available":false,"data":null}},"time_used":203,"timings":{"blocked":53,"dns":1,"connect":23,"send":0,"wait":92,"receive":1,"ssl":30},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/images/dark-logo.png","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.818Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/images/dark-logo.png HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: image/png\r\ncontent-length: 20609\r\nlast-modified: Mon, 19 May 2025 07:14:18 GMT\r\netag: \"682ada4a-5081\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qlljzEGXxSt0BcbByXg1lLviHyTvLBPPjQ9xrwGIzkOInoN7uR5plmxPaM%2B8Z9gXqFQgj%2FBMiYJMVVjRZSLkEHeh6AFbpb4yybIcmBNPczpVWkI9%2BRCzb6nfThALrTX1jzQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e94cde75b43b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20609,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 305 x 60, 8-bit/color RGBA, non-interlaced","md5":"0ff8e15f0ef7072e31a4e0e2e743b56d","sha1":"44bd6cbba94ae973d7ed89439552ebfa793f2677","sha256":"132a47a76519a6895c2cdb0f6243c85336c78d7494e24c0a1d31c8f0ee71c6c8","sha512":"1e814b2d61aabb5381e6d0f16be85ca0eb673371014a6ef7947b03ddc2ce6ae4b533a785748b46cc196448f25d65237761a8dcf343b6fc96ee6eb90d419b8139","ssdeep":"384:TJXE05SmU73II2dr2OPsZcI05cK3tPqXOwrLAgALl4fxr560aZuHHv+wo:x35SR73I/r2OGcIO/Jq4Lyfxt6US","tlshash":"4792d158c370066ea8752b148d49545f636f32a9ad4b357410143aef28b8e3fbbdc8b8","first_seen":"2023-10-14T14:34:02Z","last_seen":"2026-04-08T22:46:20.081247Z","times_seen":31,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":105,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.863Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /ad-provider.js HTTP/1.1\r\nHost: a.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: application/javascript\r\netag: W/\"169b79c256a05ad96dcc2b8e3a5\"\r\nexpires: Tue, 07 Apr 2026 10:32:48 GMT\r\ncache-control: max-age=10800\r\nx-robots-tag: noindex, follow\r\naccess-control-allow-origin: *\r\nx-77-nzt: k8xidTuZQ2qyQ6eold3a5LV+IemVFSAJW9sqa4vy3bHIR+z4GHZOYuoNb1elMwFPd86HkLs\r\nx-77-nzt-ray: 2a494a15e5d98fefbfdad669c25d6d31\r\nx-77-cache: HIT\r\nx-77-age: 2322\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":188413,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (39940)","md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"resource_available":true,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VPQU4DMQz8Ch/YaOw4idMzXEEC8YAluws90CKKKpD8eJz0AIKM4li2JzNmcJ4gE/SKdCdpJ8UqhYogHCiJ3d7dm5C9rIePed+O5/0Szvs3qwLJsKqciY1QGSqWVCMxLEGt5CIq3qOSIquoCSwaHJyiiL8UcDMlK7DHh+txyeF8j123p9prrPgkcOesWnVOsqBRRhKmbSuN121uoLzo5uP459alqAq5cpYa1RCQkltj42HogqlTI0lkd+cHNsrz6evQzH4NdqSxC3d+p/1tX0D5Z0vXpB4AGgzYKbzOz6f3c2jHVy/1P8aMmx39URsJCqelNS1ZuCRkeqosOa5r5bnOWr4Biu6EmcYBAAA=\u0026cb=e2e_69d6da9b7880f0.55681487","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.785Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VPQU4DMQz8Ch/YaOw4idMzXEEC8YAluws90CKKKpD8eJz0AIKM4li2JzNmcJ4gE/SKdCdpJ8UqhYogHCiJ3d7dm5C9rIePed+O5/0Szvs3qwLJsKqciY1QGSqWVCMxLEGt5CIq3qOSIquoCSwaHJyiiL8UcDMlK7DHh+txyeF8j123p9prrPgkcOesWnVOsqBRRhKmbSuN121uoLzo5uP459alqAq5cpYa1RCQkltj42HogqlTI0lkd+cHNsrz6evQzH4NdqSxC3d+p/1tX0D5Z0vXpB4AGgzYKbzOz6f3c2jHVy/1P8aMmx39URsJCqelNS1ZuCRkeqosOa5r5bnOWr4Biu6EmcYBAAA=\u0026cb=e2e_69d6da9b7880f0.55681487 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/319620/4def2500619520624137c8397b3549b025054c1a.mp4","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.787Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/319620/4def2500619520624137c8397b3549b025054c1a.mp4 HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 626940\r\nlast-modified: Tue, 08 Oct 2024 21:20:14 GMT\r\netag: \"6705a20e-990fc\"\r\nexpires: Thu, 15 Oct 2026 18:32:07 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap02-sec02-prg1-1\r\nx-77-nzt: kx9X/CexxnulZUbxwqlaoeqojya5R/Kd9YbcIfGRPDbZfWPBKak03C4yvfy10F48XDJxEM8\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad66993517a2c\r\nx-77-cache: HIT\r\nx-77-age: 83720\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\ncontent-range: bytes 0-626939/626940\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":626940,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"700a03703d9489a2cc6e424650ebd063","sha1":"4def2500619520624137c8397b3549b025054c1a","sha256":"4dca1cca4c74345aae925959465c0c3072431cc5c1b4be48b38bd0803eacc556","sha512":"02acc6e2e6c1a21f974fec2f15fcf398a34d7b9cff2f453563d96353640890ce25559e4994849ed9e2d8322a29c2b68d6d8bb4e39cfb2a335f8e72b8085f70bd","ssdeep":"12288:DfZ5+WTy0hWNZmibnHWGtBFPpWuGUvIQC/xq0YILzCIalVt4/zkC:lQWlIbnpt/PPGUvIpE0YszCIalVYYC","tlshash":"fad423b35736752be02f34e546181bb5ac223e81282cfb7f8172432717ba25adb39516","first_seen":"2025-03-27T19:24:30.915193Z","last_seen":"2026-04-08T22:46:20.081778Z","times_seen":15,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":4,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u3y8v8u4.aucdn.net/library/319620/28ba991bb83fcac089feb8fcb7248b71bf42bc2f.mp4","fqdn":"u3y8v8u4.aucdn.net","domain":"aucdn.net","tld":"net"},"ip":{"addr":"95.173.205.15","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.810Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/319620/28ba991bb83fcac089feb8fcb7248b71bf42bc2f.mp4 HTTP/1.1\r\nHost: u3y8v8u4.aucdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 7029618\r\nlast-modified: Fri, 22 Aug 2025 16:20:17 GMT\r\netag: \"68a898c1-6b4372\"\r\nexpires: Tue, 22 Dec 2026 01:17:31 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap01-sec02-prg1-1\r\nx-77-nzt: kwXIuysXePVtvwnRXzs6hU0vshucOdAQj34QhIXpUlwN5igBjYQmCkc686/q6Zt9/ODL3pU\r\nx-77-nzt-ray: 2a494a154f1f5af6c0dad6694559c72e\r\nx-77-cache: HIT\r\nx-77-age: 9295763\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\ncontent-range: bytes 0-7029617/7029618\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":3932160,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"fd1a6d50dba2d449ee4fe3dddc4274fe","sha1":"07f01c67a58021da0d24e04b7486cb8e7f7a8e81","sha256":"8899cbbb1bfc724f05c215bf727a7c26bd4f793f7d9ee0f71dc4746be25d788f","sha512":"70ba7e204cc7b28e011d5fbbe437fc3fe63770518d3318ba7d659c84599e9e71d6f561f197fe06abc05243a799a08f2626acaee75902ea6081b874bcc59dc151","ssdeep":"24576:ND40cIiK01NnJA4RM4qLs/iKcjmA2zXt2JoHRlYtWKIu:NDiIH0jJBRMu/PZAe2+Ttu","tlshash":"d22523bc53652933f449367c41f01747fb70c0ae160a62ef9683e7150e5a7ea0e6bae4","first_seen":"2025-09-06T11:38:59.914997Z","last_seen":"2026-04-08T22:46:20.082369Z","times_seen":78,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":2,"connect":1,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"u3y8v8u4.aucdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-08T22:45:46.310Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: XSRF-TOKEN=eyJpdiI6IlcvanZIdDZFWUxxVy9PMC9Wbm5qZkE9PSIsInZhbHVlIjoiN3ZtejdLNGF2OFJpQiswZHd2dG9Ua09pVVFpdmZBZUFMdURSekRsdEFMU2VtV2tPeG5QUnk1QW5KOGtZMkMxRWRNTnJWS1hZLzhrdmpvSnlJbDNFMmhqVnRpMXlTQjJ3ZTREV3ZMbld0YVp5ZGxYRmN5NXpNU3FBUFJzYjJOVnMiLCJtYWMiOiI1ZTBiYTBlNjE2MDEyMGEzYzI0NWVjZTNjNjcwM2U1NGNmNjljNzg0ZWVhYWU1N2U3Y2M4MmJkOWE3MzNjNDhhIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IjhxVFBqdmRlQTFrWWRhNnpwdjJrTHc9PSIsInZhbHVlIjoiOXRJZFcxemR5UEIrV2VLU3pIRUNOVVFPOExkVlIvRUxVb0F6dkJncC96N2tGckl2NnRaVDVCUm5QK1JUOVh3bWdQM1VadE51L3Q3VHd2a2FsbldMam0rUEFpWjMrdUJWejRoeVo2NUV4UXNvN0ZXNzBQaUtQdlZBZ0dNYU8xcXEiLCJtYWMiOiIwYWFlMWNiY2EwODc0YTYxOTJlMWNiMjVjOGE4NWNkNDI3MDkxYTVkNmIzODYyZmZkYmY3ZDI2YjllMmZlZWZlIiwidGFnIjoiIn0%3D\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\ncache-control: no-cache, private\r\nset-cookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; expires=Thu, 09 Apr 2026 00:45:46 GMT; Max-Age=7200; path=/; samesite=lax\nimgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D; expires=Thu, 09 Apr 2026 00:45:46 GMT; Max-Age=7200; path=/; httponly; samesite=lax\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YJiLhA4bK%2BKlky%2FYTASTpJzscrpp2RTCqKP%2FjMsSG8hqpfun2ME9XnLsSfnyn%2FFcycHM7n2pnoqXv3Jk0XIyW9rI4ik7Eur1W8U6gG3aW03XD49LPRQiZr3geGQeOQM%2FcNc%3D\"}]}\r\ncf-cache-status: BYPASS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9e94cde4797723eb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Clipboard.js","description":"","website":"https://clipboardjs.com/","common_platform_enumeration":"","icon":"Clipboard.js.svg","categories":["JavaScript libraries"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"jQuery:3.6.0","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"SweetAlert2:11","description":"SweetAlert2 is a JavaScript library that provides customisable, visually appealing, and responsive alert and modal dialog boxes for web applications.","website":"https://sweetalert2.github.io/","common_platform_enumeration":"","icon":"SweetAlert2.svg","categories":["JavaScript libraries"]}],"data":{"size":45784,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (13899), with CRLF, LF line terminators","md5":"bc9ea30fe9e724a4ed06fa42d30105e0","sha1":"072fe36032c3dc02ae088cd5c7ba14e31dc44aae","sha256":"001029fc6e790fa9660efff5b7629d345ab9d1b08fe961d051c0a1930a49adea","sha512":"c37e9ebb265ec1c61cf2bc05189f5d466e666f7961bb7b838437b589821cfe90a4c365ef0288180d0dac24aac7c9d6403a6bc96b11284b7976074c0cd2b44217","ssdeep":"768:YoE++tZNULNm6U8F68wjXRwzXhw0kLV/K2OKHGO:3Z+QNms1GXKXhw0kOKHV","tlshash":"5723181374b0a43b01a794e24927e70df9b2519be94bc4047afc4ad19fa1f52ccabb19","first_seen":"2026-04-08T22:46:20.083542Z","last_seen":"2026-04-08T22:46:20.083542Z","times_seen":1,"resource_available":true,"data":null}},"time_used":168,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":168,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/css/application.a6f4311081b5241b37716e7ba6a751d6.css","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.814Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/assets/css/application.a6f4311081b5241b37716e7ba6a751d6.css HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 26 Oct 2022 18:47:18 GMT\r\nvary: Accept-Encoding\r\netag: \"635980b6-c481\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CIFtDg20ZuJrQF%2BVsyqUFq0YPDIN2qsJpXDRqRhl7%2FjtIuMSMdDWtbo9tSPidgrP2%2FKce45XsOe5q9KByJZKSL5HNgxpqvThibQjAJOeuoN0KvwH07L5BCuL1D0IiIDvzQM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e94cde75b41b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":50305,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (50304)","md5":"a6f4311081b5241b37716e7ba6a751d6","sha1":"81e8cce63e4320c283498cde45a7fd8fff394e8f","sha256":"11335dac125f69f6562589c248f248ef5ddf43b2e1c049a7d130f23b9efdc26f","sha512":"a9e87b8052b215eb58ce3aaf3b3849445b5472e6d31f965bddcbb78de5950463ee39bded90cfac2f6327859fc73b1f760340ecb8d39ddf68cb2323c6cfb1d168","ssdeep":"384:VivMSAhMPFEICc8OArbiApdOvsDvmFo7OdrtMYQQVQPzrkFrPKe/S:Vi+hMl8OAPimdOEDmFS+7We6","tlshash":"9d33a855b264313d743bc43c99f298c820eed802e76746eff427e25ac6ce79215b3689","first_seen":"2023-10-13T19:00:11Z","last_seen":"2026-04-08T22:46:20.084494Z","times_seen":50,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":106,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/js/application.4936becb62852bad09281e60fb01ab7b.js","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.834Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/assets/js/application.4936becb62852bad09281e60fb01ab7b.js HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Tue, 26 Sep 2023 09:37:22 GMT\r\nvary: Accept-Encoding\r\netag: \"6512a652-ad31\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6znkWPp5C%2BoG3SAqKhlcEgnY7KWB7oR81EM7%2FR1HEt18FBXC5SpQVMTIbZM56jBC%2Bcw%2FRZlwonLJ%2FkoG5T%2FJ62oaLJqAySUutN9B07f8o%2BQjAFdWb4pHQwGU8gLBBDUbQvc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e94cde78b5eb4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":44337,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (859)","md5":"33aa175c8756312b95d34b618c66b939","sha1":"3494c3161d13bcefe2df8bc52ad7d6562795d59a","sha256":"6ae8e944bdf76655a23f9818a20e8e2b66e1665540f97c742558aa7061b6f64b","sha512":"8266651c5cb83cfe77bb15b0e5f6ef3bd113c9dcd9e53ba321cd7b870034aaf3bd1a01ebf718818e7436d2122fabb53ee3e7442470e0acd0cc18a1963540b8ff","ssdeep":"768:XOoBV4qELGCWnqe0C8UbbY8HEzkpP2nluCY:XcqEKqe5/2nEh","tlshash":"e013b71ab5f119749267b1a5896f8608b270522b8d0add043c2cd6c94f6cc7c57fbbec","first_seen":"2024-08-19T18:10:16.695944Z","last_seen":"2026-04-08T22:46:20.085036Z","times_seen":37,"resource_available":true,"data":null}},"time_used":106,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/sweetalert2@11","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.835Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/sweetalert2@11 HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: 11.26.24\r\nx-jsd-version-type: version\r\netag: W/\"13877-yvQx6m3IVnvgENB/T31XmBY4Id4\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\nage: 38985\r\nx-served-by: cache-fra-eddf8230135-FRA, cache-hel1410033-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 21418\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":79991,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (49001)","md5":"e8f033d3c7a50e4abe3d98ac65234d13","sha1":"caf431ea6dc8567be010d07f4f7d5798163821de","sha256":"7506c8f4d85e4707ab46f9858f0c6e65e3316b9d2f122dcf485b9dbf39d5a7ac","sha512":"ecad9d89ce602e5121c97135933a33122f0d9b32c15b43949d5fbe51fe576da069e9a416772117eb4666d8354b685046c0d7a3e086f669fffa488e2f05ff0ba3","ssdeep":"1536:iw46xylPIZSKcO355lcVU/SZ2DUdzI8bRj:PxYIvTlcVU/62mI8d","tlshash":"e173f8916a00f03776bb45ae65d1e7047ae99405fcb34894f42cc8804fe7d4f26b7aba","first_seen":"2026-03-20T09:57:21.567576Z","last_seen":"2026-04-09T00:01:31.957174Z","times_seen":693,"resource_available":true,"data":null}},"time_used":173,"timings":{"blocked":55,"dns":15,"connect":28,"send":0,"wait":27,"receive":6,"ssl":38},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/914186/dc235307178e64ceb096bde32c058e8c1fcc5ddf.mp4","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.978Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/914186/dc235307178e64ceb096bde32c058e8c1fcc5ddf.mp4 HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 327716\r\nlast-modified: Fri, 03 Apr 2026 11:10:17 GMT\r\netag: \"69cfa019-50024\"\r\nexpires: Sat, 03 Apr 2027 11:42:04 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\naccess-control-expose-headers: Content-Range\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap01-sec01-prg1-1\r\nx-77-nzt: kw4l8OrO1sStuBi4k+QxPLUUdmly4cTRR6zphph/+8DJ1PC0FpiuCkweal1obOlASwsXMoI\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad669af812732\r\nx-77-cache: HIT\r\nx-77-age: 471412\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\ncontent-range: bytes 0-327715/327716\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":327716,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"67c2f0ed4d85354e514a4d67cca4fd28","sha1":"dc235307178e64ceb096bde32c058e8c1fcc5ddf","sha256":"5b712e3155dabf8042143c1efe16e42ab940b7ff81b17304a563821b4edda5fd","sha512":"5ef784293c0d6c0be50739465d40585a98d714f94201de671f76c6a94f4162f6bdc4ef8644f921bb30a4f1a89a61cf09663b559aefb984224a803d46b4444eeb","ssdeep":"6144:+l6tQgfz4JNPyhpleDZwicAR1Tr4RLSCnW4S3I8Mxv80n4qDSOT:+UmSpleDG0j41So/nTDnT","tlshash":"f06412a8ab7941d2e11006bf8cf3d742b774b8621778a9a78395f784fc76581ec321c6","first_seen":"2026-04-03T19:37:19.065072Z","last_seen":"2026-04-08T22:46:20.086079Z","times_seen":4,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"a.pemsrv.com/popunder1000.js","fqdn":"a.pemsrv.com","domain":"pemsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.202Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pemsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:22:51 GMT","end":"Sun, 24 May 2026 08:22:50 GMT"},"fingerprint":{"sha1":"51:4C:15:FB:47:44:FA:A8:E5:C3:C9:E1:C6:2A:CE:3F:1F:DD:7E:CE","sha256":"58:4D:39:CD:58:CF:09:A4:17:8E:80:49:FF:5C:B0:CF:61:C6:0E:57:8E:8A:0E:13:E5:98:09:4C:93:14:89:13"}}},"request":{"raw":"GET /popunder1000.js HTTP/1.1\r\nHost: a.pemsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: application/javascript\r\netag: W/\"bf02d30fb1fe9693af3f72a2e41\"\r\nexpires: Tue, 07 Apr 2026 10:33:30 GMT\r\ncache-control: max-age=10800\r\nx-robots-tag: noindex, follow\r\naccess-control-allow-origin: *\r\nx-77-nzt: kzWJ9uWgPwmNWkZBItB0kG2yOkoWQfU3Os1js6/HkyoThfT8RKWOcJc56q0ouohUa0kwRiQ\r\nx-77-nzt-ray: 2a494a158726a5f2c0dad669c4c21c10\r\nx-77-cache: HIT\r\nx-77-age: 2314\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":122256,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"8b4068331d16fce51c286cc6e411facd","sha1":"bf02d30fb1fe9693af3f72a2e41cac284c44fd0c","sha256":"c74f376507b893d47c70f03562cabd6bc5135e6e13d8689878c8f8a0b2844b76","sha512":"f44effa59dc95ec29631f207ba1aaa6287489f47ed94029942bc14fc676dafa03943c73ff0fceee53b75f4f3d0e456eadb1c586363563751115f166666a81d88","ssdeep":"3072:drCqGR9VdpPtCgzTNiQ4n8701l21bMp1qk:XGjVdhdQQOe+p4k","tlshash":"28c35140210748e521e2e67ed56fb0993c24a823f5e9cda76c05e7c1f8dec99069bde3","first_seen":"2026-04-02T16:18:07.313899Z","last_seen":"2026-04-09T01:51:18.589896Z","times_seen":45,"resource_available":true,"data":null}},"time_used":140,"timings":{"blocked":68,"dns":51,"connect":1,"send":0,"wait":1,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/v1/api.php","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.366Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"POST /v1/api.php HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain\r\nContent-Length: 443\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":443,"data":"{\"user\":{\"ua\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"language\":\"en-US\",\"referer\":\"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\",\"consumer\":\"ad-provider\",\"gdpr\":{\"gdpr\":0},\"screen_resolution\":\"1280x1024\",\"window_orientation\":\"portrait\",\"cookies\":[],\"scr_info\":\"YXN5bmN8fDM%3D\"},\"zones\":[{\"custom_targeting\":{},\"id\":5883120,\"extra_params\":{\"first_request\":true,\"zone_type\":20}}]}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nAccess-Control-Allow-Headers: Authorization, Content-Type\r\nAccess-Control-Request-Method: POST\r\nSet-Cookie: __uvt=s%3A32%3A%22887a5d7f9fb4978dd88bc10ed84daa71%22%3B; expires=Fri, 07 Apr 2028 22:45:47 GMT; Max-Age=63072000; path=/; domain=magsrv.com; secure; SameSite=None\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":34020,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"3f9b85c5c281d0c66d549b59c4318a23","sha1":"5be68baf2a4b3d738204b0273b5d4e5fae6f2e49","sha256":"c3c3a22860e7163580e2a519b9445f447149823bafafa110b343837f47bba531","sha512":"d817909b1e74a65a78fe7ef7c2365dc985fefc80d605b46fa2a8761bff8fe27418f6ef52eb13fc6ff6e0a32a7838af742be6bdc76f1c3b45e2908d9222d6f7d6","ssdeep":"768:F6LkytLBl4RAzmuadBR/irH58nAdiGDpRP:stLWQZOQiYpRP","tlshash":"26e26bb3a708989337e65bc126df34bcad1b314fcec0caa2508dd515d2b2279479726a","first_seen":"2026-04-08T22:46:20.087638Z","last_seen":"2026-04-08T22:46:20.087638Z","times_seen":1,"resource_available":false,"data":null}},"time_used":228,"timings":{"blocked":55,"dns":1,"connect":23,"send":0,"wait":112,"receive":2,"ssl":32},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQQU4DMQz8Ch/YyPbaWadnuIIE4gFpdgN7oEVttQLJj8dJhUBqRrEUz9geh4DiADyA3qHuWHY8WcKQIDAFFLbHp2djtPflcMlrOW7rHLb10zWMGi0pRSRDSATKJqojEpiAmhIkYTYciUbiCYzBRgMHyeiEywI8DGJOvb7c94sOr/fY5hp6m5YjhS8EajWLJs3CMxSMIExY61RoqbkAxlmry+HGLVwRQMQt0O/bMTT5iOwO2fyA9XQ+fx+K2T9hg3T/1OrR+Ia+Qv8W84HYAoB0W2Dn8JHfzqctlOOHp1qLrjFsmyP7F235tObLejx0HrqjOvs3LxlYokhKEgup7EuqvJ/zVH8AG2BsKMUBAAA=\u0026cb=e2e_69d6da9b7809b5.20819964","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.764Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQQU4DMQz8Ch/YyPbaWadnuIIE4gFpdgN7oEVttQLJj8dJhUBqRrEUz9geh4DiADyA3qHuWHY8WcKQIDAFFLbHp2djtPflcMlrOW7rHLb10zWMGi0pRSRDSATKJqojEpiAmhIkYTYciUbiCYzBRgMHyeiEywI8DGJOvb7c94sOr/fY5hp6m5YjhS8EajWLJs3CMxSMIExY61RoqbkAxlmry+HGLVwRQMQt0O/bMTT5iOwO2fyA9XQ+fx+K2T9hg3T/1OrR+Ia+Qv8W84HYAoB0W2Dn8JHfzqctlOOHp1qLrjFsmyP7F235tObLejx0HrqjOvs3LxlYokhKEgup7EuqvJ/zVH8AG2BsKMUBAAA=\u0026cb=e2e_69d6da9b7809b5.20819964 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.837Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /ad-provider.js HTTP/1.1\r\nHost: a.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: application/javascript\r\netag: W/\"169b79c256a05ad96dcc2b8e3a5\"\r\nexpires: Tue, 07 Apr 2026 10:32:48 GMT\r\ncache-control: max-age=10800\r\nx-robots-tag: noindex, follow\r\naccess-control-allow-origin: *\r\nx-77-nzt: k3+dWzCOWYRDJUaw0hQ3FMskWJI0FWWvNUZVPGxK8qimiPRayRZWId2MjmxTUA55Ox+FGiE\r\nx-77-nzt-ray: 2a494a15e5d98fefbfdad66908221031\r\nx-77-cache: HIT\r\nx-77-age: 2322\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":188413,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (39940)","md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.839Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /ad-provider.js HTTP/1.1\r\nHost: a.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: application/javascript\r\netag: W/\"169b79c256a05ad96dcc2b8e3a5\"\r\nexpires: Tue, 07 Apr 2026 10:32:48 GMT\r\ncache-control: max-age=10800\r\nx-robots-tag: noindex, follow\r\naccess-control-allow-origin: *\r\nx-77-nzt: kygGaJMdBcuEogGlZc0K7z0dawTaUZ827F7XcG93EgIKKQ7Ls4G4EX+zaJQMHqeWJ7BwyMc\r\nx-77-nzt-ray: 2a494a15e5d98fefbfdad6693b1f0e31\r\nx-77-cache: HIT\r\nx-77-age: 2322\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":188413,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (39940)","md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.226Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /ad-provider.js HTTP/1.1\r\nHost: a.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: application/javascript\r\netag: W/\"169b79c256a05ad96dcc2b8e3a5\"\r\nexpires: Tue, 07 Apr 2026 10:32:48 GMT\r\ncache-control: max-age=10800\r\nx-robots-tag: noindex, follow\r\naccess-control-allow-origin: *\r\nx-77-nzt: k1s0zwenjRS1XXYen6a5WZ3TqKZHa+vkPdw661GxA4gQjpz3kAbzq9akYE0R0qOoby/gquQ\r\nx-77-nzt-ray: 2a494a15e5d98fefc0dad669c7138c0d\r\nx-77-cache: HIT\r\nx-77-age: 2323\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":188413,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (39940)","md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/914186/ed18ea477c1d3cd0904415b4f2a53db11cbdb975.webp","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.665Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/914186/ed18ea477c1d3cd0904415b4f2a53db11cbdb975.webp HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: image/webp\r\ncontent-length: 12012\r\nlast-modified: Wed, 26 Mar 2025 10:07:15 GMT\r\netag: \"67e3d1d3-2eec\"\r\nexpires: Thu, 26 Mar 2026 10:32:47 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap01-sec02-prg1-1\r\nx-77-nzt: k5dWaNY+ND4gtcjDq0vb0ZQ1K7Nz5gaI+JeFIP8Y0EYSGLpcSky7eISZ8NB5Y45DVjeiDlk\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad669be629826\r\nx-77-cache: HIT\r\nx-77-age: 1167178\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":12012,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 300x300, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"cf46cfbec1d8549bbd6397447284c9fd","sha1":"ed18ea477c1d3cd0904415b4f2a53db11cbdb975","sha256":"aed98b611e4c3a4b620aa4bd4e3788622c82690b305a1ebcfcc5f4df2d958222","sha512":"436cabb370cfd8434415eca26ddfe3e504b1a8ae14ec04b2d2e48281c4c6c3a3bfd5570d6ed9e49020a52d965fdae92921442d9fe1ad26d335d389ef7eb8c8bc","ssdeep":"192:4DYuyiCPruNyOBOEo4Zd/RDqmnBn5KpRbXCW7h+eDHZpLZzjUcl/qH3FVluRqqWv:4DYLZPqSl4ZqmBnwp/7hZD5pLNUrFh7D","tlshash":"6442c0052d7a1f56ac56f60d6031c3ff5ac47fa2740fc6222fa8e9834f8618e5a901d3","first_seen":"2025-08-25T13:08:33.473386Z","last_seen":"2026-04-08T22:46:20.088514Z","times_seen":168,"resource_available":false,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VPS05DMQy8Chd40dhxEqdr2IIE4gDp+0AXtIiiCiQfnjjdIMgokTXxeMYMzhNkgt6Q7iTtpFilUBGEAyWx+4dHE7LX9fjZDvPpcljC5fBuKhKRrSpnYiNUhool1UgMS1ArShExGzET11zEBBYNHZyiiFcBAJEV2PPT7bjU0Qf01429FOdY8UVgF61atSVZMFNGEqZtKzOvW5tBedGtt+NfXBhRkczGGRHizimpe41AV0yujCSRe7p+YINu5+/jbPar0ZHGLux6l/39vkK9MeBuSu5IY2GiIYCdw1t7OX9cwnx665SPCFRH1PE/uFFULCWWurZ9i0vedJFIoB5z23MuM/0Az/CFxcUBAAA=\u0026cb=e2e_69d6da9b77ddb5.52884717","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.761Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VPS05DMQy8Chd40dhxEqdr2IIE4gDp+0AXtIiiCiQfnjjdIMgokTXxeMYMzhNkgt6Q7iTtpFilUBGEAyWx+4dHE7LX9fjZDvPpcljC5fBuKhKRrSpnYiNUhool1UgMS1ArShExGzET11zEBBYNHZyiiFcBAJEV2PPT7bjU0Qf01429FOdY8UVgF61atSVZMFNGEqZtKzOvW5tBedGtt+NfXBhRkczGGRHizimpe41AV0yujCSRe7p+YINu5+/jbPar0ZHGLux6l/39vkK9MeBuSu5IY2GiIYCdw1t7OX9cwnx665SPCFRH1PE/uFFULCWWurZ9i0vedJFIoB5z23MuM/0Az/CFxcUBAAA=\u0026cb=e2e_69d6da9b77ddb5.52884717 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/914186/78e2ded741c19009324e6afbdeb944bb4f2aa9b9.mp4","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:48.048Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/914186/78e2ded741c19009324e6afbdeb944bb4f2aa9b9.mp4 HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:48 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 517334\r\nlast-modified: Thu, 02 Apr 2026 09:45:13 GMT\r\netag: \"69ce3aa9-7e4d6\"\r\nexpires: Fri, 02 Apr 2027 09:48:52 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\naccess-control-expose-headers: Content-Range\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap02-sec02-prg1-1\r\nx-77-nzt: k5Y7UkQmH9Vf6NN4d8zs+kwpwh2KzXsqX4nqW+BmCKlSwF6wJVFsgsnOvwaZAhvghuWExwM\r\nx-77-nzt-ray: 2a494a15fb2856f5c1dad66983cd3001\r\nx-77-cache: HIT\r\nx-77-age: 564413\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\ncontent-range: bytes 0-517333/517334\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":517334,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"df829306a28238e84d34fd845717143b","sha1":"78e2ded741c19009324e6afbdeb944bb4f2aa9b9","sha256":"18200c43a640b800ca2793d0d8b777beab17796506678bf728e468102d0c2c3b","sha512":"92adc27111a87d1bf7d4d075f21026cc0c42169a18a445807eab8213fb0628620ca563a377ff838439ab4a363d4d5c1ba3c82a5a7aa0edca384ee400c95d0c6d","ssdeep":"12288:kzXSvSW6P3/uxxbO9zFcUsrSM0QrHev/Djez3WI:kGvSDP3/uxdO9RFs30WEbmWI","tlshash":"31b422652bb21ac3f62562bc1e73cb247737c1485f72945ee3107a25fc7aae2e5a04c4","first_seen":"2026-04-03T03:48:29.785159Z","last_seen":"2026-04-09T02:15:36.937934Z","times_seen":26,"resource_available":false,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":63,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/all.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.799Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Mar 2026 00:38:49 GMT","end":"Fri, 12 Jun 2026 01:38:45 GMT"},"fingerprint":{"sha1":"7A:4A:F6:D6:63:62:70:CA:51:C5:5A:06:41:17:71:BF:9D:2C:C9:42","sha256":"7F:F5:F5:FE:73:1F:E7:AF:1A:82:5B:59:EE:E8:E9:65:D6:87:68:61:8C:11:1E:94:4A:9A:C4:14:BD:4B:04:BA"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.4.2/css/all.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 18778\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"64cac444-495a\"\r\nlast-modified: Wed, 02 Aug 2023 21:01:56 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 1892458\r\nexpires: Mon, 29 Mar 2027 22:45:46 GMT\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=s8QcEi%2BRNumPrPx4UfZVtEbT6R6glF3KwLet%2BFert%2Bd2LrSc1kAcBPIKCqOYnQYoH0AV95N6%2F%2FhSKcq7k8Ltr28F8LmF9EJAS08Yq25vV0ZPQlTiI9XB%2Fxx7F4KfDQjTjZ%2BWa%2FqJ\"}]}\r\ncf-ray: 9e94cde77c7d5687-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":102217,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (52276)","md5":"5222e06b77a1692fa2520a219840e6be","sha1":"8b4236206a8b86af3761a244277663046d7ff7ee","sha256":"0934b1fc0d3a766d41d3adf5e7a115875e66e98ebba408d965a41cf3d2cb4ab5","sha512":"cf780ba5def29277f562835b0b3a9129ce2aca8afc81a294d6a9a7f824a1c5bb81bac00d23d42946884606b7821642b12e17a2e92f424171446db2aea8b8340c","ssdeep":"1536:0wMCMPMCMjMCM4MCMwMCM3sVMX709gbPMfjSFOTyPGuuprrlCq:M709gMGFiyPGuuprlCq","tlshash":"09a3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2023-08-04T22:28:10Z","last_seen":"2026-04-09T01:40:00.920753Z","times_seen":36479,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":1,"connect":1,"send":0,"wait":15,"receive":1,"ssl":27},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQy04DMQz8FX5go7HXzqNnuIIE4gO22V3ooS1iUQWSPx4nvVSQURzL9njsMDgOkAH5jvJOdCfJCoWCIBxIxR6fnk3I3pfT13So58thDpfDhxWBRFjJHImNUBhZTHMeiWGKbCkmRBYjSkKxgE1go8HBOor4SwEPg1qCvb7c90sO57ttus3NLcYZ3wRunCWXPKnMqBShwrSuqfKyThUU57x6Of5N61JUhFw5ShmzIUCVvDf3ea4YGnMkGdmH8wPr4Wn7OVWzm8IG7atw4zfa3/QVNzu6IjUDUCfAtnCc3rbPS6jno4dai17jo/Z8j3Un0bhqjFV1T1R1P/mHis46zQuQZvkFM7dAFcQBAAA=\u0026cb=e2e_69d6da9b784ca8.51556500","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.781Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQy04DMQz8FX5go7HXzqNnuIIE4gO22V3ooS1iUQWSPx4nvVSQURzL9njsMDgOkAH5jvJOdCfJCoWCIBxIxR6fnk3I3pfT13So58thDpfDhxWBRFjJHImNUBhZTHMeiWGKbCkmRBYjSkKxgE1go8HBOor4SwEPg1qCvb7c90sO57ttus3NLcYZ3wRunCWXPKnMqBShwrSuqfKyThUU57x6Of5N61JUhFw5ShmzIUCVvDf3ea4YGnMkGdmH8wPr4Wn7OVWzm8IG7atw4zfa3/QVNzu6IjUDUCfAtnCc3rbPS6jno4dai17jo/Z8j3Un0bhqjFV1T1R1P/mHis46zQuQZvkFM7dAFcQBAAA=\u0026cb=e2e_69d6da9b784ca8.51556500 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/vendor/libs/fontawesome/v6.1.1/fontawesome.min.css","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.806Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/assets/vendor/libs/fontawesome/v6.1.1/fontawesome.min.css HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 17 Jul 2022 16:22:02 GMT\r\nvary: Accept-Encoding\r\netag: \"62d4372a-18972\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eZz1JdW%2BfJYmU1TVHbYH5N0hgxMToUg8ADtesTJidoe%2B5Wyoe%2FvACzNMkeic8PVQne%2FuuKKUoKlp%2FDh0%2FUA9MBtbu2JtFFYZx3nDDIVyz25IXRh3l%2Fb5TQlZi7sJegwShOk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e94cde75b3eb4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":100722,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65317)","md5":"3ffeb81d797af28426fb1b21978304ad","sha1":"9ce47583911058940d6c37f847baeda2a0f85744","sha256":"188a706590dc9e898c5c90a1da8346a9bc732cad28884386fbf20b05f4e83594","sha512":"15cdf3d8f35212abeaff334a8cd7e7841a59643147318c59472719d6329357a685c6502e84445a823343fb23c964c3b0d507c068e015807fc80b10b255286546","ssdeep":"1536:mUMVM6MVMkMVM9MVMNMVMispLudL+P8Wcn0Fwib3ePMUHsE+l:hudL25cn0FfePMUME+l","tlshash":"84a3b7f5e44c05d97732c44bab95b37c65b6f738d9810ca9f02f580c1ad26a822c6f7a","first_seen":"2023-08-22T04:49:49Z","last_seen":"2026-04-08T22:46:20.090001Z","times_seen":446,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":106,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/914186/45ab138b02b1840583367376e95898e8844644f0.webp","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.661Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/914186/45ab138b02b1840583367376e95898e8844644f0.webp HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: image/webp\r\ncontent-length: 18086\r\nlast-modified: Thu, 12 Mar 2026 11:58:34 GMT\r\netag: \"69b2aa6a-46a6\"\r\nexpires: Fri, 12 Mar 2027 17:47:06 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap02-sec01-prg1-1\r\nx-77-nzt: kxkOnhrt3TaCE3JcbNY0ex6XjSC0FDKvwPBhtiR4eSykW+NwgXPKVPsc4fhy2IBFDTUG/Q4\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad669e1ee7226\r\nx-77-cache: HIT\r\nx-77-age: 2350446\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":18086,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 600x600, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"e507c62f624c9907cf3af870bf9efd83","sha1":"45ab138b02b1840583367376e95898e8844644f0","sha256":"6d2b41f5c728a938a8b096a5df3c93038a42ef502bcb27f1ec8a68a497074a8d","sha512":"b85defc24ad31d6631997387143ae88259b08e2dbfef1f25bf2a3935b00c0994bd937b762746c8c7f623a35e71793b6d71a5dc50fa3df0917b106178b2785941","ssdeep":"384:W64cmWoUTPC5DsaUcuTxeRtCLDcfMjfgzK0wyJSR75x1:WAmWNTq5gaUcyGtYcUrg/IF1","tlshash":"2582e02256802c54c3f6962f17f1576246e44de60d736d4bbbd3d3b3a4a191fc881b8a","first_seen":"2026-03-15T07:25:15.04092Z","last_seen":"2026-04-08T22:46:20.090507Z","times_seen":3,"resource_available":false,"data":null}},"time_used":4,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VR0U5DIQz9FX9g5LQUKHvWV000fsCVe6/uwc04s2jSj7cwM02kocDpOS0FBucNZAO9It1K2kqxSqEiCAdKYrd39yZkL8v+Y9q1w2k3h9PuzWripNmqciY2QmWoWFKNqLAEtVISSfYYKymVqCawaHDjFEV8pYCbTbICe3y4HpPc2Nz1si5l046x4pPAXbNo1SnJjEYZSZjWtTRe1qmB8qyr0/Hvtl6KRVzPNbPfCSFWzx29Fi626cpIEp1qPmADno5f+2Z2oRGdRWk0w/3QhfYn068N7k+bCKDuABoK2DG8Ts/H91Noh1eHeo7B8RojPrDzZl1ynVMrs/+XlLnlyZ/1Kc6ZMi2Qb698VuPHAQAA\u0026cb=e2e_69d6da9b9211a0.65287685","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.913Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VR0U5DIQz9FX9g5LQUKHvWV000fsCVe6/uwc04s2jSj7cwM02kocDpOS0FBucNZAO9It1K2kqxSqEiCAdKYrd39yZkL8v+Y9q1w2k3h9PuzWripNmqciY2QmWoWFKNqLAEtVISSfYYKymVqCawaHDjFEV8pYCbTbICe3y4HpPc2Nz1si5l046x4pPAXbNo1SnJjEYZSZjWtTRe1qmB8qyr0/Hvtl6KRVzPNbPfCSFWzx29Fi626cpIEp1qPmADno5f+2Z2oRGdRWk0w/3QhfYn068N7k+bCKDuABoK2DG8Ts/H91Noh1eHeo7B8RojPrDzZl1ynVMrs/+XlLnlyZ/1Kc6ZMi2Qb698VuPHAQAA\u0026cb=e2e_69d6da9b9211a0.65287685 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":190,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":190,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/438437/958e470916df7831b16a4db8fee1d74f14e340d7.mp4","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.800Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/438437/958e470916df7831b16a4db8fee1d74f14e340d7.mp4 HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 25220\r\nlast-modified: Mon, 11 Mar 2024 17:49:45 GMT\r\netag: \"65ef4439-6284\"\r\nexpires: Wed, 17 Sep 2025 12:29:44 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap02-sec02-prg1-1\r\nx-77-nzt: k3uvpY0AIphGMYEKhFFsu3AZKu6jAIE9kaw1liZEr8ZHG7qN+Hm+laBnEKeDHblNhxQigfM\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad669e4b4ba2d\r\nx-77-cache: HIT\r\nx-77-age: 17576144\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\ncontent-range: bytes 0-25219/25220\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":25220,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"9985949527c8616d989581fd854d9290","sha1":"958e470916df7831b16a4db8fee1d74f14e340d7","sha256":"1b3b328f51ae920a8152770010c9e285b7d7886e8cbe0d6a111fa33e5de8e12a","sha512":"51816692c2ac2f3733c6e5d3a859da8cfdbf38bc155ca5512211004a1f937990ff84df0a19cb26a27d5e9cb064fb4d9861517dc5d824014a864c971f37c0f378","ssdeep":"768:DnN9GD78cDwzQhy6W+YYn4nCLbKKbWKOF:ry0gYYi6KKbA","tlshash":"12b2e11347e1cccad90522b6b0ed53a9227fd74079cb8685213930588dfed964b7983e","first_seen":"2024-03-24T15:44:48Z","last_seen":"2026-04-08T22:46:20.091077Z","times_seen":87,"resource_available":false,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/319620/9daf79db8fb0ccbc0d1041e37be1ec1ba1942508.mp4","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:48.041Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/319620/9daf79db8fb0ccbc0d1041e37be1ec1ba1942508.mp4 HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:48 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 211775\r\nlast-modified: Tue, 20 May 2025 13:05:23 GMT\r\netag: \"682c7e13-33b3f\"\r\nexpires: Wed, 23 Dec 2026 17:53:50 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap02-sec01-prg1-1\r\nx-77-nzt: k++UVGvJTUY3F5DuGfxk2lL8m5GFooFwFInFDjq96NT1K8uuUbc6Vy8KpzznGJ2Ddw\r\nx-77-nzt-ray: 2a494a15fb2856f5c1dad6690ca22e01\r\nx-77-cache: HIT\r\nx-77-age: 1720472\r\ncontent-range: bytes 0-211774/211775\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":211775,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"e41bc4fe2a6a253f3f8cacb29417180a","sha1":"9daf79db8fb0ccbc0d1041e37be1ec1ba1942508","sha256":"5478113c11b9e91d7564053adf72245c027dfb00631c1b379ee9352c9b793385","sha512":"214cdd5605fdf794e7e62d32fb359fbc6d77f97be4cf0f882715e024d9a5fcc044ad50b1cfca8827b6a706633165c9ed8196709d778f518fdf70fd84b7f5fab8","ssdeep":"3072:5Z/lTWlbS63weNb6MVO9NRTw79fB6G7RXq1J3tq9LVlG8b14Uuqkc5KdmfyoQJ4e:5ZibSWNbPOUTn8v3tq9BvO+YpojZM","tlshash":"3c24138ac74d6c46d1b152362ff342f5303886e72e41e9e3c035e5f0898b9b2f95d99a","first_seen":"2025-05-25T21:16:57.184952Z","last_seen":"2026-04-08T22:46:20.091545Z","times_seen":7,"resource_available":false,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/914186/51e200f1a731a4cd2ec67df4f2f4b5ff9d00473d.webp","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.658Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/914186/51e200f1a731a4cd2ec67df4f2f4b5ff9d00473d.webp HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: image/webp\r\ncontent-length: 10674\r\nlast-modified: Fri, 03 Apr 2026 11:05:25 GMT\r\netag: \"69cf9ef5-29b2\"\r\nexpires: Sat, 03 Apr 2027 12:08:13 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\naccess-control-expose-headers: Content-Range\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap01-sec02-prg1-1\r\nx-77-nzt: k9S78zIx9ZbIVckm1o9gGVIlqVFJEASA3iRbvkmeTe97bxrW/sf+tquK3cpVEu/lQw\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad66963b86426\r\nx-77-cache: HIT\r\nx-77-age: 470141\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":10674,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 600x600, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"caf0ffa6da6fd0639942edaa166b03ac","sha1":"51e200f1a731a4cd2ec67df4f2f4b5ff9d00473d","sha256":"54ccdc17a4e08a68417033d3bd67f99327273d83ce0441175f8d7c66fcd5320c","sha512":"d7c7869491469b42c311d1d5e10f004bf103a07886011cc71acaedf415142dd4ae7bd50fd38f528eb499350408aea7357c5cbb2a22fe2a0bdf1187d72835291c","ssdeep":"192:shZXV8cdddCPEL1G8YUB1QpSxQsP/UZUciPs6JFt7tj72VghR7qmAOZbC6kaxE57:kl8mddCmGVS1QpU18GPskFtR77HqYCpP","tlshash":"ff22af035c54779a8c329b55a7481ef0d1f66adb273d3bb0a840687cfb8d255ca8e3d4","first_seen":"2026-04-03T19:37:19.038227Z","last_seen":"2026-04-08T22:46:20.092143Z","times_seen":2,"resource_available":false,"data":null}},"time_used":3,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VPW0oEMRC8iheYUNXpZJL91l8FxQPMI6P7sbviyqLQhzeJsAqmSNGpdPVDIHGADkg3TDsNOx0t02U4Fcegdv/waEp7LcePab+cLvvVXfZvllQ9ouUkkWJEFiS1kJJHhgUkGxM9fDSKUPIImMK8oUKCV22RA0DaCHt+uu2XFWKVWl+TamqSJHwS0jwl5TQFXbEwIqhw28ZFyjYtYFzTVtPxb1oYOWoUkwiPWsb5LLG3whVDc3qqlzpcPbAuT+ev42J2TSN/TKEvI+3RjPan0i/YyeFuCG1b9pXJ7oCd3WF6Ob9f3HI6VKnVcMy9R//vWg/KXPK8bJW8D3PBWsA0M8wrxwlT+QZ+hJ83xwEAAA==\u0026cb=e2e_69d6da9b91f823.07741003","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.902Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VPW0oEMRC8iheYUNXpZJL91l8FxQPMI6P7sbviyqLQhzeJsAqmSNGpdPVDIHGADkg3TDsNOx0t02U4Fcegdv/waEp7LcePab+cLvvVXfZvllQ9ouUkkWJEFiS1kJJHhgUkGxM9fDSKUPIImMK8oUKCV22RA0DaCHt+uu2XFWKVWl+TamqSJHwS0jwl5TQFXbEwIqhw28ZFyjYtYFzTVtPxb1oYOWoUkwiPWsb5LLG3whVDc3qqlzpcPbAuT+ev42J2TSN/TKEvI+3RjPan0i/YyeFuCG1b9pXJ7oCd3WF6Ob9f3HI6VKnVcMy9R//vWg/KXPK8bJW8D3PBWsA0M8wrxwlT+QZ+hJ83xwEAAA==\u0026cb=e2e_69d6da9b91f823.07741003 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":190,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":190,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/images/favicon.png","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:48.310Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/images/favicon.png HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D; __suvt=49fbd4a0dd9077ab83c1ad05fd1c560c\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:48 GMT\r\ncontent-type: image/png\r\ncontent-length: 20658\r\nlast-modified: Mon, 19 May 2025 07:14:18 GMT\r\netag: \"682ada4a-50b2\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4yicK2Pse2tqaHgxoPtKCid48cdd16jU%2Fc%2Fb9Kc%2FDOdYRpPlLROodOUeD3dtk0O8v7cNuLJ%2FxmdPlY9vfiYjQFDqN%2Bw6j7s74LNrfXM62f%2BbV5eH%2BqbjF4sheurSr%2Bv%2FcAY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\ncf-ray: 9e94cdf0fba0b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":20658,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"46d45a9fdd01c451d4fb032ba8146f4d","sha1":"5bd2230f03026ca9aacbd02f70663bc6fdd84425","sha256":"af9632f45772358de31a3696827969c33e5d485f94a183d0c9b103a8bb2c6e62","sha512":"eee6a4fe39a1f1a4a6e0f8b4b1c22a6d35ddb6f62311e3a5272a07ebae1691fac8107396f3332dfad92244d455cab919f92e89a40c7e2092b85d3f6c78cc0c62","ssdeep":"384:gJXE05cFyy8FA0AycTq6WVKjzjTsnx9d5rNnNL2j0Tfad0sOUDp:c35c9uxxc1KKjHInzdhb2j0Tq0s5Dp","tlshash":"ab92d0e76211eac9e0d170522e49264ed73463ce3a553afcf604aefd47b211ec58a378","first_seen":"2025-11-21T12:53:57.083831Z","last_seen":"2026-04-08T22:46:20.09305Z","times_seen":7,"resource_available":false,"data":null}},"time_used":109,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":108,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/images/flags/en.png","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.821Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/images/flags/en.png HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: image/png\r\ncontent-length: 673\r\nlast-modified: Sun, 17 Jul 2022 23:53:30 GMT\r\netag: \"62d4a0fa-2a1\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qdYidtUfeCxpr63GCpaclFLN9MxBYPPAbwUJd83wIGUcaI%2FjNQZblGFUpR8T0WyONcOd9gGRXTH7Z6SHWE%2FxZOpxp43DBBPn7Ie9eCUvf826sLI8xAsfCU%2Bn3ZTQNDUEW4Y%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e94cde75b44b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":673,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 25 x 25, 8-bit/color RGBA, non-interlaced","md5":"e6c9212f1dd129c6e7f0c0af7c5fd83f","sha1":"b4ddb6f170bd6c8e424ad8759bf8034a0c675a73","sha256":"53c9b7dcd76cbe43ed0ad40605b09ef24c3e30a05e0b7bf9b3be1502d07fab84","sha512":"4d6a565c26b25e79950065bca02aab6e24e7c609e3ab49d05d8f9867ff4b37d86cb2176071dd74be318194d63c20b704aacf51b525f743c2a2441d001a067be6","ssdeep":"","tlshash":"0701feae5cd3ace5ae091657a2d414a547f348c85147195e0d01cce3997792034939a9","first_seen":"2023-10-13T19:00:11Z","last_seen":"2026-04-08T22:46:20.094426Z","times_seen":68,"resource_available":false,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":108,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/952586/7e21f5f285802b1c6f39866b5dc3f682ec5fe0fc.webp","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.677Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/952586/7e21f5f285802b1c6f39866b5dc3f682ec5fe0fc.webp HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7832\r\nlast-modified: Tue, 10 Mar 2026 14:36:35 GMT\r\netag: \"69b02c73-1e98\"\r\nexpires: Wed, 10 Mar 2027 15:00:07 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap02-sec01-prg1-1\r\nx-77-nzt: kzaMzsBHylS3ICD6GHVDG6cEEgrH4CoiMrcXEVsmKPD8anu+IbdAPjvEVGjWo7NCXObDJps\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad6697209c526\r\nx-77-cache: HIT\r\nx-77-age: 2533415\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":7832,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 300x300, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ebccc3fdef5896f3be2ea66f753a742f","sha1":"7e21f5f285802b1c6f39866b5dc3f682ec5fe0fc","sha256":"61bce1aca9f0230f1a78b5802bceed4fa7eea6a3ab78e83d31b87b7d94cdb8c0","sha512":"a555d3bdfc4c9133654cfecd49b820edb74971f68af374bf38aabc576dbf00e977a36a1b86fa34dbaac889de5b6d7ee615d7dc2d7ace0e958f8570764cfa261f","ssdeep":"192:sDNj/AfkMrM1IDbEVnsyGYc9nPlJumkW35D5S6f5t+:ajAfkMrQIEVnsy8Vl0Vw5U","tlshash":"f0f1af26ec126fa9ec1374899893304d2cab47e93b812437bd2c1655a834ae2769bc5d","first_seen":"2026-03-12T21:35:09.932954Z","last_seen":"2026-04-08T22:46:20.094998Z","times_seen":65,"resource_available":false,"data":null}},"time_used":3,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQW04DMQy8ChdoNHacV7/5BgnEAdKkC/tBi9pqVSQfnniLEIKMIluemdgOg+MGskG+o7yVsJWkhVyBE3YURB8en1RI3/aHS53bcZm7W+YP9VQiQ0vmSKyEwsiiIWePMiKyphAoJlEiKSLMrAL1igEOXsQyB5Am6Mvz/XppYLwWcY3AyK25puE0hjOuBDbjPpdcg3S0oQ3CNE2p8X6qDRR7noYc/0bGDW4MKWsf/GBjek/iecw1DnQt1/Pnoan+EhrCuoWNYa6/7A2M9L0fvAVaVzPm7N7r6/m0uHZ8HyXzOzaqmETGHy31NNfLfDystHm0t9R7qRR3IXqKjaYcemy+TWkXculfaZrqH8YBAAA=\u0026cb=e2e_69d6da9b924630.11425050","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.248","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.922Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQW04DMQy8ChdoNHacV7/5BgnEAdKkC/tBi9pqVSQfnniLEIKMIluemdgOg+MGskG+o7yVsJWkhVyBE3YURB8en1RI3/aHS53bcZm7W+YP9VQiQ0vmSKyEwsiiIWePMiKyphAoJlEiKSLMrAL1igEOXsQyB5Am6Mvz/XppYLwWcY3AyK25puE0hjOuBDbjPpdcg3S0oQ3CNE2p8X6qDRR7noYc/0bGDW4MKWsf/GBjek/iecw1DnQt1/Pnoan+EhrCuoWNYa6/7A2M9L0fvAVaVzPm7N7r6/m0uHZ8HyXzOzaqmETGHy31NNfLfDystHm0t9R7qRR3IXqKjaYcemy+TWkXculfaZrqH8YBAAA=\u0026cb=e2e_69d6da9b924630.11425050 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:48 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":202,"timings":{"blocked":110,"dns":0,"connect":0,"send":0,"wait":92,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"a.magsrv.com/ad-provider.js","fqdn":"a.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.203Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /ad-provider.js HTTP/1.1\r\nHost: a.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: application/javascript\r\netag: W/\"169b79c256a05ad96dcc2b8e3a5\"\r\nexpires: Tue, 07 Apr 2026 10:32:48 GMT\r\ncache-control: max-age=10800\r\nx-robots-tag: noindex, follow\r\naccess-control-allow-origin: *\r\nx-77-nzt: k8Yqr75JzrAcZD+T7iCtvfbxv+57r0B5lM0pEOlxw+6dl8dDPRVTUxL3T1UtYc1SbmFV5z4\r\nx-77-nzt-ray: 2a494a15e5d98fefc0dad6695ae3e80b\r\nx-77-cache: HIT\r\nx-77-age: 2323\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":188413,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (39940)","md5":"2cee4fd69ccd439b0b9166433ffa0290","sha1":"169b79c256a05ad96dcc2b8e3a5472ef8a38c209","sha256":"0efe41855c6ef29c697c5ab03d73ac3a1ce81a3cd1f8742715856e3c44c141a8","sha512":"3f42dacbbed8cff8c2ffede5874a0b9ed26deccecc8f66587a4be4241cccc19065097bcfb028889c61c64a4fc2b52016244b4c1a3fd9de8755afc4c4916e5e97","ssdeep":"3072:8dqQ7K6+28VOk2DZ2HgMaElwnRyL78wBHishYolYHoJCXMZpo:DM+28VOk2d2SElwnRW8w4sDNpo","tlshash":"86045c983792303441d3a12da9ff52083375506ab90f4884bb4dd9a427adeea51b3ffd","first_seen":"2026-04-01T17:29:32.57685Z","last_seen":"2026-04-09T02:15:36.929544Z","times_seen":244,"resource_available":true,"data":null}},"time_used":3,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"a.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/vendor/libs/fontawesome/v6.1.1/webfonts/fa-regular-400.woff2","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.331Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/assets/vendor/libs/fontawesome/v6.1.1/webfonts/fa-regular-400.woff2 HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/assets/vendor/libs/fontawesome/v6.1.1/fontawesome.min.css\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 23940\r\nlast-modified: Tue, 22 Mar 2022 13:08:02 GMT\r\netag: \"6239ca32-5d84\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kLAZWSojIiIPJwsgPQGPh037%2BXC8DxjDK13%2Bc8Xg1VII7UtwyQJnmKX6zOtmRcxS8QVexH%2FONLWXIQoAP6pfeKQW6w5mgl7sMNbiY%2BZL2amSrhji2GEgMWgFrm5YL0Tx7LA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e94cdea9b7eb4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23940,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 23940, version 769.768","md5":"e8a1ba418ee6d897d1339ef22e6d8e60","sha1":"379ca48f70f3d4f79f8bf1079881c7c5af4f44a4","sha256":"6a274e7629c0d71dcf8cab1e7733687ebfe32e2c53b4ca9fad050b4f1d5471f3","sha512":"1cc7d14749f0a8b5b6018f4076d8ad9f5821191e555e251b92045dd29a487d9180a7d398c721844bf01cb3f0e18419e069bebebe94b756f6e2639b5fb3cc505f","ssdeep":"384:9JvNR6si8QhXLGaHTECx02DFKQUGrIq3nnihiaX4hnp7LO42+bXsbrarFEl:f1R6sibhXLGATECxLQQUkNnMchhL9I+G","tlshash":"c9b2e182ed99ab390a9071f9d90e1ef65ca0099590eb4be93c8cdb2f462d52c805d353","first_seen":"2023-04-09T09:43:39Z","last_seen":"2026-04-08T22:46:20.095532Z","times_seen":3546,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":99,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/vendor/libs/fontawesome/v6.1.1/webfonts/fa-brands-400.woff2","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.353Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/assets/vendor/libs/fontawesome/v6.1.1/webfonts/fa-brands-400.woff2 HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/assets/vendor/libs/fontawesome/v6.1.1/fontawesome.min.css\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 105536\r\nlast-modified: Tue, 22 Mar 2022 13:08:02 GMT\r\netag: \"6239ca32-19c40\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bnDGyHrz71cJ6wCy5cCVSE0haekWIN4i1GeicGTsmxPSJ7sAkNX%2Bin09X67QLLUQOvQTcRm7trcLx40moH%2BRI%2BH6jJaJCz0UTisos1z7Z%2FYm6O80fW6XL%2Fcwhkehmk6OcFk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e94cdeaeb81b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":105536,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 105536, version 769.768","md5":"cd2b4095e9ce66cde642c3502a4022d9","sha1":"a280ecdddd14695fad22599301ab03adfe5224c0","sha256":"404c746c8f7e3f9b7611a8f23d908c1a32a5c972236b9d89bb68b05d9bf4b905","sha512":"062782597f37b964a5f285fe8b75ac2cc57e99024fa6c9bf841dc2e7b930ce6cfc12ea5f32d2a6b7301a74ffbb552457a2a82ed9d945e135d8b027f506bf5d77","ssdeep":"3072:cBrlv6vs2sSSF2Hv2/V49i7iM6wYyXuJwzO:cBrlvyVsSSFeWV49SiM6kaoO","tlshash":"86a312970cd7bed18e2da7c565932d43f197f6fe718c4510d42a282949c212d18ee2f7","first_seen":"2023-04-05T17:13:40Z","last_seen":"2026-04-09T00:09:34.914618Z","times_seen":7502,"resource_available":false,"data":null}},"time_used":107,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":103,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.pemsrv.com/venor.php","fqdn":"s.pemsrv.com","domain":"pemsrv.com","tld":"com"},"ip":{"addr":"95.211.229.248","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.480Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pemsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:22:51 GMT","end":"Sun, 24 May 2026 08:22:50 GMT"},"fingerprint":{"sha1":"51:4C:15:FB:47:44:FA:A8:E5:C3:C9:E1:C6:2A:CE:3F:1F:DD:7E:CE","sha256":"58:4D:39:CD:58:CF:09:A4:17:8E:80:49:FF:5C:B0:CF:61:C6:0E:57:8E:8A:0E:13:E5:98:09:4C:93:14:89:13"}}},"request":{"raw":"GET /venor.php HTTP/1.1\r\nHost: s.pemsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"very short file (no magic)","md5":"c4ca4238a0b923820dcc509a6f75849b","sha1":"356a192b7913b04c54574d18c28d46e6395428ab","sha256":"6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b","sha512":"4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a","ssdeep":"","tlshash":"c70000000c000000c00000300000000000000000000000000000000000000000000030","first_seen":"2023-03-07T01:10:09Z","last_seen":"2026-04-09T01:40:53.328643Z","times_seen":105384,"resource_available":true,"data":null}},"time_used":148,"timings":{"blocked":62,"dns":2,"connect":22,"send":0,"wait":24,"receive":0,"ssl":35},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/914186/7ab20d4aaa2c5db24721c8230d987d4460acd416.mp4","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:48.012Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/914186/7ab20d4aaa2c5db24721c8230d987d4460acd416.mp4 HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 841558\r\nlast-modified: Wed, 26 Mar 2025 10:07:26 GMT\r\netag: \"67e3d1de-cd756\"\r\nexpires: Wed, 05 Aug 2026 08:48:49 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap01-sec02-prg1-1\r\nx-77-nzt: k8tdgckYsFAHF4GT9ygvpGvUaxSn+pzPevl4znic79WSq/IiYAS0zEpo0rcHxURxPAtBhFA\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad669fb85c034\r\nx-77-cache: HIT\r\nx-77-age: 21303498\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\ncontent-range: bytes 0-841557/841558\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":841558,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 v2 [ISO 14496-14]","md5":"f819834f2f47ee44542e48cc99543530","sha1":"7ab20d4aaa2c5db24721c8230d987d4460acd416","sha256":"66ab65b932dc672b32814800a0804b5fb3fcf3481cfdc168e5f8c90945bae5a6","sha512":"3da2c7a49d27e3daf9fdd814dd320697623943bf298b2a7b49079493fb547f873c156a63450a88f725f4e55ac9c473c2f1dbb089fca928c0a772721093868b32","ssdeep":"24576:W+C16XETobu1cSzWK0UQiOtLyWGVgEZLNah6E/K:kQUx1PqTtWNVgEN+6+K","tlshash":"0c0523b3cf97c49dc556687244971b868322e62d9aed4263701da5a30cdfcb43c2e7e2","first_seen":"2025-08-27T13:27:02.987934Z","last_seen":"2026-04-08T22:46:20.097665Z","times_seen":157,"resource_available":false,"data":null}},"time_used":186,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":157,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/Application/storage/app/public/uploads/users/aQ2WVGrBGkx7y/NHDTC-184_s.jpg","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.822Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/Application/storage/app/public/uploads/users/aQ2WVGrBGkx7y/NHDTC-184_s.jpg HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 1072598\r\nlast-modified: Wed, 08 Apr 2026 18:34:19 GMT\r\netag: \"69d69fab-105dd6\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cFf4XfFLR5A8FFjz%2Fg1nDeM2vFgDCSGsJmqOqybbIxv1ID9SiKlJjkPErR%2F1jVqTrmp7qL7XCKAjHFzhbd7vxF23vRGVfnT%2BBCnqe9un8tgQxUkUd9kpnM1p2ssr%2BRZZt64%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e94cde76b45b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1072598,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 80\", baseline, precision 8, 1224x5817, components 3","md5":"eeebfb8d4739f6a3420d5ba108317f52","sha1":"155dedf22c540fbdea8c7be1834b6629d44bcdc3","sha256":"97dc119b8292cd00918f3de8626deeee15ff0736b435d4d39503e96c469180a7","sha512":"6633c16c2bb21428caaf24ad284959313b33814028e897827032384c5a781b436e01d0ff00a328696d9f4966c355338783d0adff1e8bf8cf2186f70dfa090fb4","ssdeep":"24576:u5+D4HKoLGZcTMX4UUvwNWPjL87ta/zuLbS5:P8fSZ0GtUvwoPj2M5","tlshash":"f3253332f1664ec6804c4eb19f01394b3a39cf64b2d154dd4032aefe77fa54a3529a9a","first_seen":"2026-04-08T22:46:20.098263Z","last_seen":"2026-04-08T22:46:20.098263Z","times_seen":1,"resource_available":false,"data":null}},"time_used":306,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":107,"receive":199,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/v1/api.php","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.248","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.190Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"POST /v1/api.php HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain\r\nContent-Length: 799\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":799,"data":"{\"user\":{\"ua\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"language\":\"en-US\",\"referer\":\"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\",\"consumer\":\"ad-provider\",\"gdpr\":{\"gdpr\":0},\"screen_resolution\":\"1280x1024\",\"window_orientation\":\"landscape\",\"cookies\":[],\"scr_info\":\"YXN5bmN8fDM%3D\"},\"zones\":[{\"custom_targeting\":{},\"id\":5883086,\"extra_params\":{\"first_request\":true,\"zone_type\":2}},{\"custom_targeting\":{},\"id\":5883088,\"extra_params\":{\"first_request\":true,\"zone_type\":2}},{\"custom_targeting\":{},\"id\":5883090,\"extra_params\":{\"first_request\":true,\"zone_type\":2}},{\"custom_targeting\":{},\"id\":5883092,\"extra_params\":{\"first_request\":true,\"zone_type\":2}},{\"custom_targeting\":{},\"id\":5883094,\"extra_params\":{\"first_request\":true,\"zone_type\":2}}]}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nAccess-Control-Allow-Headers: Authorization, Content-Type\r\nAccess-Control-Request-Method: POST\r\nSet-Cookie: __uvt=s%3A32%3A%22f311ac31095fc974e064129837790b8e%22%3B; expires=Fri, 07 Apr 2028 22:45:47 GMT; Max-Age=63072000; path=/; domain=magsrv.com; secure; SameSite=None\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23576,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"73573947971118b6531d34b9133cdc3d","sha1":"bd853ac50de86e7c7136e14acda0bc1d08fc7658","sha256":"6b2a4af2764bb3a5c3b51325cf915a8129a82a050a00738ce46b40d294db8cc7","sha512":"46173b772cd30f2d2d6f53f0fc334965379cbdd92e6adfadaa16ce7228f17c6d7d17f9e734ec62f74438b8c8a3f14d5c1255245dcccd204b3137d02a3b764c0f","ssdeep":"384:M0NvbPwEqttCbvLJ8Um1fXjTCBTwATyTXSqf4vsTzrwbwusE9DW+ozozozozoXP:M0VbP0ttCjL6Um5SLhqf44rwbsE9DW+G","tlshash":"87b24937fa8844aa27e18fc11d973abced3d340bdb818e663288b62543f85f50712360","first_seen":"2026-04-08T22:46:20.099175Z","last_seen":"2026-04-08T22:46:20.099175Z","times_seen":1,"resource_available":false,"data":null}},"time_used":492,"timings":{"blocked":53,"dns":3,"connect":22,"send":0,"wait":370,"receive":0,"ssl":41},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.magsrv.com/cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQW04DMQy8ChdoNHacxOk33yCBOECa7cJ+0KK2WhXJhydJEUKQURLLMyM/GBw3kA30jnQrYSvJMrkMJ+woiD08PpmQve0Pl7LU47pMbl0+zFOODMvKkdgImaFiQdWPH2pRIZDYuBCy9yQmMG9o4OBFeuQASdES7OX5flxqYMvAlQNa3MtbYpPOsOJK4G7da9YSZEKliCBM85wq7+dSQXHSucnxr2nc4OBVRh38YNP1rUnPrbN2YCNdzp+HavZL2BHGHL6H3faXvqHv5XvE/tIYrRNn915ez6fV1eN7S3W7o9yI3HZlJG1Nazkt5bIcD4PvJktzyrsiU+Ip+6xSEDTpDrFmRB/5CwdYzHHJAQAA\u0026cb=e2e_69d6da9b5dad49.63552519","fqdn":"s.magsrv.com","domain":"magsrv.com","tld":"com"},"ip":{"addr":"95.211.229.245","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.564Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"magsrv.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 08:20:01 GMT","end":"Sun, 24 May 2026 08:20:00 GMT"},"fingerprint":{"sha1":"58:0F:84:09:FF:55:47:81:68:33:43:D3:D2:47:4C:DB:77:90:25:FB","sha256":"11:22:FD:18:0A:A9:69:03:FF:90:1D:F1:BD:A4:A3:CF:3E:A4:0C:FA:D2:84:97:23:1B:81:45:31:26:81:D6:14"}}},"request":{"raw":"GET /cimp.php?t=api\u0026data=H4sIAAAAAAAAA2VQW04DMQy8ChdoNHacxOk33yCBOECa7cJ+0KK2WhXJhydJEUKQURLLMyM/GBw3kA30jnQrYSvJMrkMJ+woiD08PpmQve0Pl7LU47pMbl0+zFOODMvKkdgImaFiQdWPH2pRIZDYuBCy9yQmMG9o4OBFeuQASdES7OX5flxqYMvAlQNa3MtbYpPOsOJK4G7da9YSZEKliCBM85wq7+dSQXHSucnxr2nc4OBVRh38YNP1rUnPrbN2YCNdzp+HavZL2BHGHL6H3faXvqHv5XvE/tIYrRNn915ez6fV1eN7S3W7o9yI3HZlJG1Nazkt5bIcD4PvJktzyrsiU+Ip+6xSEDTpDrFmRB/5CwdYzHHJAQAA\u0026cb=e2e_69d6da9b5dad49.63552519 HTTP/1.1\r\nHost: s.magsrv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://hentaicovid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nCookie: __uvt=s%3A32%3A%22887a5d7f9fb4978dd88bc10ed84daa71%22%3B\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 08 Apr 2026 22:45:47 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: https://hentaicovid.vip\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\nX-Robots-Tag: noindex, follow\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-09T01:38:06.881517Z","times_seen":13521868,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s.magsrv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/844306/88672f6888c6a57a86f5f9f1be41272058b2cbb3.webp","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.648Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/844306/88672f6888c6a57a86f5f9f1be41272058b2cbb3.webp HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7878\r\nlast-modified: Mon, 07 Apr 2025 19:10:15 GMT\r\netag: \"67f42317-1ec6\"\r\nexpires: Tue, 07 Apr 2026 19:42:58 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap01-sec02-prg1-1\r\nx-77-nzt: kxoYAi4Dbl3YaKiiNPKyuoCv/lmY7/7ctbFYDv9dx/rHAwyOQmBC4JegueWj5YiIj/5V/Nk\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad669f99f2626\r\nx-77-cache: HIT\r\nx-77-age: 97366\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":7878,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 300x300, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"69251c8d346962c97ea3656b61d80996","sha1":"88672f6888c6a57a86f5f9f1be41272058b2cbb3","sha256":"90c4ea48fe454450276e5a7f8de66c08c5635315841c769a41cd5215c67edd5d","sha512":"9faf5404d426ace63ba033ca96e596117720fced884b0993d165788c3efedfff66b50cd09afee481113d31e55f53224366b6879bb2a9aebb9c5030c5f0609238","ssdeep":"192:Du0xieRazqF8IK/HdLEM+phwDxEnrC0moCpU4rN:JYeRa2SIKVQQDxkrCpogU4rN","tlshash":"abf19f9cc6513bba0753e20b95bc8796eed4ff48f853544132a4104b9537b472758e09","first_seen":"2025-09-20T08:31:28.42748Z","last_seen":"2026-04-08T22:46:20.10018Z","times_seen":91,"resource_available":false,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/940460/520bf7ca8820f65a8a19c7e4040e53dcc632fb6e.mp4","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:48.016Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/940460/520bf7ca8820f65a8a19c7e4040e53dcc632fb6e.mp4 HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 878226\r\nlast-modified: Fri, 23 May 2025 09:55:27 GMT\r\netag: \"6830460f-d6692\"\r\nexpires: Sat, 23 May 2026 10:04:01 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap02-sec01-prg1-1\r\nx-77-nzt: k4zHkkyrJJ/6TkmuEXOIZ7Qnm/q0+yBxLGKU5yQMSsZZQeUi32qhil+ppvSsepJGkzWfZnk\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad6695b9cc534\r\nx-77-cache: HIT\r\nx-77-age: 27683974\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\ncontent-range: bytes 0-878225/878226\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":878226,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 v2 [ISO 14496-14]","md5":"06c87fc635cf6bdc19d4e200b58d9953","sha1":"520bf7ca8820f65a8a19c7e4040e53dcc632fb6e","sha256":"23e0159f9e0a5a2160c32eafa6ac94214698a9daa74a980c42b8c55cef3c15ca","sha512":"27a8e4dbf7341db6403c097bc2b78234c95ee191622ec2dfeb941cb49cd5bd2c01114fb60d553c53104ee65ce52121a283aeb06db200b584786ec1a0d0c90e8f","ssdeep":"12288:fkijUuStXYbA89iU+sYQA4MuvlJ9rtfKl5PWQK7A10mfupy3yea+73iSNsFNC9oe:fJVbbiXsbjDil5PWQMAzlz6FNCQNkdZ","tlshash":"6b152342ede951b3f13411bab3ffc144ae9625bab0d51e08b7492db1cc54d4e0ada8ec","first_seen":"2025-07-19T13:10:08.053245Z","last_seen":"2026-04-09T02:15:36.932789Z","times_seen":62,"resource_available":false,"data":null}},"time_used":201,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":170,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/vendor/libs/toastr/toastr.min.js","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.831Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/assets/vendor/libs/toastr/toastr.min.js HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 04 Oct 2021 20:28:26 GMT\r\nvary: Accept-Encoding\r\netag: \"615b63ea-1461\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BcDSOMZJtSdTZZAlMI%2Ff7b%2FiavgjEidCdHbTYTlboDp7OAVLKT2ALDRsI1asuNM35nAgZ1RuwvNAPd4RWkZ0VxRvhExisYzZjFr8rw3NUGOE2giyrILGLuCaJ4BJB%2FuYogM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e94cde77b53b4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5217,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (5215)","md5":"57b703726fe13ac3579b559e7dfc7a46","sha1":"9691d795cfa6c5c4af45f1439a9b3f3782e6ee6e","sha256":"7fe565f3385448e1ec8d57dc2c1639d723561f1aabc2e3d547e284bbf9f9b073","sha512":"c6e60b917e6d285befafa3bd2bfb144a8b1bb8344418498ff86d1c54ff459ee288ef9f9520b03995ff3005094f077edd823134575a63bf7cb159aa899c335a1a","ssdeep":"96:OdCZR1JHduRv75dR+FIEHXX9oxNDP9mA1UZsEyHGJAcCwV02tfrS:O4BtcvvRqIQcNa74c7rS","tlshash":"b2b18384b220b78b1bb31079919f140b937673b2ccce5440763aa9987e7082c97a7fdd","first_seen":"2023-03-07T12:25:14Z","last_seen":"2026-04-08T22:46:20.10198Z","times_seen":231,"resource_available":true,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":101,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/914186/2397a3dc7ef3c939a90194f4fd045a9a900e534b.webp","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.651Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/914186/2397a3dc7ef3c939a90194f4fd045a9a900e534b.webp HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9204\r\nlast-modified: Fri, 03 Apr 2026 11:06:04 GMT\r\netag: \"69cf9f1c-23f4\"\r\nexpires: Sat, 03 Apr 2027 12:07:06 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\naccess-control-expose-headers: Content-Range\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap01-sec01-prg1-1\r\nx-77-nzt: kz/CM1GRu842nNjFG+odI74FFwUGxhH2WGsXmdWLb8HJePRhkYJxgXW+mOpmM1y6sk3Rpco\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad6695a3c4426\r\nx-77-cache: HIT\r\nx-77-age: 470263\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":9204,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 600x600, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4dc2a3113159a032c4d7b45de50a142a","sha1":"2397a3dc7ef3c939a90194f4fd045a9a900e534b","sha256":"b4ed4faa6f2a1ad3fa42ac04b707c40d775fda04c7903bcd9d5c28ca8609a2f9","sha512":"39991d2be681bc55a606c5986a53dc6fb6131c0dbe6ba9594ffdf884ffceef22478442f7ff334238c48c5531fb1a6476dd34485c5b71021f3a52867527d5b2a4","ssdeep":"192:RKyCKZHiN+1VcpGQNnbqjqYP78Bd0vzx93Otk21O:BRIeMNnunqd07/SU","tlshash":"aa12b05cfd200cce1e899a98e48d0418871359d83723cf88ad7b25edeb6c4b0059deba","first_seen":"2026-04-04T01:37:14.367195Z","last_seen":"2026-04-08T22:46:20.102551Z","times_seen":3,"resource_available":false,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/844306/5ca6f1576e83b6f39cd5e568b7a59f5c54460030.webp","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.871Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/844306/5ca6f1576e83b6f39cd5e568b7a59f5c54460030.webp HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9798\r\nlast-modified: Fri, 09 May 2025 15:40:37 GMT\r\netag: \"681e21f5-2646\"\r\nexpires: Sat, 09 May 2026 18:53:12 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap01-sec01-prg1-1\r\nx-77-nzt: kzv4pfEs/sM2rhl22btp+xs3Zckecw5hvG/XQ01ixHXK22VsOHhFhLniymqx2jHZ1zwgIfs\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad669d0392c30\r\nx-77-cache: HIT\r\nx-77-age: 28820346\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":9798,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 300x300, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"77cc1fdb7534ac296fdcde94b9e801fe","sha1":"5ca6f1576e83b6f39cd5e568b7a59f5c54460030","sha256":"32955b9cf54bab1e5cde1dadae3b9731bea00b40bfd5e00d0dba1985849912fe","sha512":"807719a0e36bdfa36ec133912b671d1acf74b485c9927953044c758680601f46b09eac777a56d2866b141a72042be09834f53681f5e29130ab9b9956c5e4cc93","ssdeep":"192:jMSjElxp8fSwWratUFuZY9zRguPDqji2oUNzLZnrDj35d7:jM77qqwuAUFuK9zau+p7Nz9n/Vd7","tlshash":"5a12bf2078fe4d6c57a7953fcec5741a42f5ec2b59aa12453d040de4fa23cb66c185b8","first_seen":"2025-09-20T08:31:28.25918Z","last_seen":"2026-04-08T23:23:59.089108Z","times_seen":80,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/952586/af01b03286ede16865909d1e62fa6f691781b906.mp4","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:48.025Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/952586/af01b03286ede16865909d1e62fa6f691781b906.mp4 HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 655515\r\nlast-modified: Thu, 22 Jan 2026 14:34:10 GMT\r\netag: \"69723562-a009b\"\r\nexpires: Fri, 22 Jan 2027 14:39:24 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap01-sec02-prg1-1\r\nx-77-nzt: k4ZMlOw0CqshKcHKwvMk0H1ol8lSHmiU5FUarKRT9aovd3HundrgqDnpnDPwDw/fx2HjvpM\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad66956157b36\r\nx-77-cache: HIT\r\nx-77-age: 6594559\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\ncontent-range: bytes 0-655514/655515\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":655515,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 v2 [ISO 14496-14]","md5":"98860e3fc00d64ee2e65f0d494df9784","sha1":"af01b03286ede16865909d1e62fa6f691781b906","sha256":"8c116ce69cba21d92f97c6b56f93d7690f65382c1e6cbd3d913cc469f505f3f5","sha512":"4558797a9ebea06a242fa9e32b6bb3e3a2aa35d76bf97e04aaf0c909e1e8b88ca66f2a58de4fa4efb75d306fac4ddd3ae81db858f6b7c830fc137af93cc8abc2","ssdeep":"12288:XgDy8XM6d/A0aCQJh/JG+y2ceMEJRr6UeJUZl5ixP0UqyzOY9shjkVbfkC:wyUMiA0WRvpJRiJql82+sGd","tlshash":"a0d423156ee1a4e2f14db3bba4c6aa134da3cb039dd04b93b8df0d400f1547e6a56a33","first_seen":"2026-01-26T13:21:06.294206Z","last_seen":"2026-04-08T22:46:20.069221Z","times_seen":93,"resource_available":false,"data":null}},"time_used":103,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":36,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hentaicovid.vip/upload/assets/vendor/libs/bootstrap/bootstrap.min.css","fqdn":"hentaicovid.vip","domain":"hentaicovid.vip","tld":"vip"},"ip":{"addr":"104.21.75.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:46.804Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hentaicovid.vip","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 12:02:07 GMT","end":"Tue, 02 Jun 2026 12:02:06 GMT"},"fingerprint":{"sha1":"CE:04:A9:F0:5B:B2:E0:02:DA:7D:98:66:C5:27:02:CD:52:AD:67:4E","sha256":"2E:3F:8E:CE:ED:20:8A:79:7B:29:43:24:86:3A:D9:EC:F4:18:01:1E:A3:AF:11:70:88:C4:3A:E4:D6:06:AD:4F"}}},"request":{"raw":"GET /upload/assets/vendor/libs/bootstrap/bootstrap.min.css HTTP/1.1\r\nHost: hentaicovid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg\r\nCookie: XSRF-TOKEN=eyJpdiI6ImZUdW1rdUJFQjM2SmVJUmdPeDEwOEE9PSIsInZhbHVlIjoiZDliaTR1NUlCdzZrbFhaT2FqeGpCbFc4aWRjUXp1OWJhb1EzUDZRWXBnMy9laTY5SVlsRi9ReWZFRWErNGtWV0ZnUUNtK0k0dEhNQUVOWnA4R2U0emd5a2dTZU1Ba3JKQmgveGhvNHNOSkxTdUdaSW85aTVvb3k0ZTRtSm9jeFgiLCJtYWMiOiIzNTZlN2UyNzA4MWFhYTBjMDNkODM5MDEzMzZlNTE2NDdjZDJjNmUzNjNhZjA0OTA4Mzc5YjMyNmU2M2FlYjBmIiwidGFnIjoiIn0%3D; imgbob_user_session=eyJpdiI6IlNlZWJscVByd2I0R05pZi9MVDZtN3c9PSIsInZhbHVlIjoiT21DQitRNHNmcHZ6YXNDamJWMkNNeXhicEJCbTVQVUF5cWZ1VHpJTXlocm5tTnA3SS9CTGEzMEQ1YjhOSWdxcHNwNXlwUE5odTdlUHBPYzZDTk9tUXlWL2hEY2hZNDRBNHVqSlBXWVZqT055NUlvUDVQc1YyNkdDUGhia0JHdlkiLCJtYWMiOiJkNDU4OTAwOGIwYzBhNzJjODdhNTIwYzkzMzk0NjliYjI0YjY3NWRkYjBlZjY5MGExOTBjZTJmZTgxMDIzNjdmIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 08 Apr 2026 22:45:46 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 01 Oct 2021 19:42:20 GMT\r\nvary: Accept-Encoding\r\netag: \"6157649c-27b73\"\r\nstrict-transport-security: max-age=63072000\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lfiLZW20RkzEpV6QdFBwgQGPUjtoEuLoJg7QFiGoLtQEsp7LGUptUG%2BVyUDnXN07eVBgj0TfcntRyzEYCfs0ZREFOkpmxeWElQI7m8nt3IMGr0ksO54eTQA7sj4auS62SgU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e94cde75b3bb4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":162675,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65306)","md5":"72e4fe18d5a5445178a45ec7f786a88c","sha1":"7a07b9f71105781cd35cc7ff31edcff5fa3f774d","sha256":"457d42dfc58373e2b07655f896ed685ba9729c2111684fd6eb02bf3697634939","sha512":"5c65884096b96b0d086939f3dbc04ae4448db4a611bac9321a3802ddceabe46a3260e998fa25283ff124f3fb8b3523538836acca325472f55fe6b24c1729d504","ssdeep":"1536:FtawT8if0W8DsEBpy0cuJBf2rIWn5gyVUpz600I4fj:FtawEyVUpz600I4fj","tlshash":"1cf3b4d7f581341dd4a7c259a4d1bffd052f8685e3025aabb0277bb88b892c70963e4c","first_seen":"2023-04-15T13:26:58Z","last_seen":"2026-04-08T22:46:20.103675Z","times_seen":506,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":109,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/940460/f8212595c447b46903f6fcbacf17a716f67470f5.webp","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.684Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/940460/f8212595c447b46903f6fcbacf17a716f67470f5.webp HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: image/webp\r\ncontent-length: 16826\r\nlast-modified: Tue, 06 May 2025 18:10:10 GMT\r\netag: \"681a5082-41ba\"\r\nexpires: Thu, 07 May 2026 11:00:57 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap01-sec01-prg1-1\r\nx-77-nzt: kxMEl39xwNpPNy+sRK5U0H2MztEZS9E6EkMuy5mxwgdR1ADuuEiKzbyf0q9zgmHHXhyBoko\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad669300ae426\r\nx-77-cache: HIT\r\nx-77-age: 28537648\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":16826,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 300x300, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5f83a4f20b3affde8b3fa4c10da81580","sha1":"f8212595c447b46903f6fcbacf17a716f67470f5","sha256":"1245d96153cd92c57aebc875bb5e97d9f590a9b1128c60e7f3fcb5611cd24198","sha512":"7f72b8b1b68b165225db46ea85e7f0cce8ec315e4dac766e23cfe76da05b93862ee9dbbf419cce85f233131ebe22d7ab4705cd0f96c7b3482b516f7b5ee12d30","ssdeep":"384:PI1FUM5Ra/F5XNvI4I3B8pgVHllxk0l0xsDvAd58HY7e/PktM8Z18:PaGJNvI4I3OpEFlxk0Tj75Ihe","tlshash":"cf72e0c0f0ac5794b1f39d1b20589b89b8679a1c236e0703c92686b9cffc459ce71b17","first_seen":"2025-07-19T12:49:36.040613Z","last_seen":"2026-04-08T22:46:20.104197Z","times_seen":39,"resource_available":false,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3t3d2y1.afcdn.net/library/914186/a8431c03a7dc1bf209ab60f213dbcd660628361f.webp","fqdn":"s3t3d2y1.afcdn.net","domain":"afcdn.net","tld":"net"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://hentaicovid.vip/upload/en/RIDf9DzOScJgFtg-NHDTC-184_s.jpg","date":"2026-04-08T22:45:47.880Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afcdn.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 10:36:59 GMT","end":"Tue, 28 Apr 2026 10:36:58 GMT"},"fingerprint":{"sha1":"AB:9C:92:CE:1E:90:F5:AF:93:B0:87:A9:90:C3:9A:64:ED:5E:03:AF","sha256":"01:4D:B7:94:F8:BA:31:CB:D6:8C:62:E6:3E:61:AD:4A:4E:F8:29:68:68:FD:8A:E7:69:2F:01:50:99:04:62:40"}}},"request":{"raw":"GET /library/914186/a8431c03a7dc1bf209ab60f213dbcd660628361f.webp HTTP/1.1\r\nHost: s3t3d2y1.afcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://hentaicovid.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:45:47 GMT\r\ncontent-type: image/webp\r\ncontent-length: 10342\r\nlast-modified: Thu, 02 Apr 2026 09:40:07 GMT\r\netag: \"69ce3977-2866\"\r\nexpires: Fri, 02 Apr 2027 09:50:17 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\naccess-control-expose-headers: Content-Range\r\nx-robots-tag: noindex, follow\r\nx-served-by: hap01-sec01-prg1-1\r\nx-77-nzt: kw07jsIMYOYEWe2FPPfRXbmBrinIGVZmXx5PyDZJKVXjZ6+y7qnpN/M0El1smT0XLmpvlLE\r\nx-77-nzt-ray: 2a494a15fb2856f5c0dad66951acc530\r\nx-77-cache: HIT\r\nx-77-age: 564404\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":10342,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 600x600, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5291a092909a4c259cece1ab0867cba7","sha1":"a8431c03a7dc1bf209ab60f213dbcd660628361f","sha256":"4ff62d31a95d3ce899e0059d5dad1337c2981b3b64ed9d9cdf65a13b336652ab","sha512":"073d2a59cbc204d3d56b4647cb13eba33bc031cd46c4bffcdb9ff8f70549e1b7874e7dd8c06620aaa1da811412ce10b6cc530e8aa65646bd81755a96eb684a02","ssdeep":"192:ii0Mp/lsuK63V/d/6GLUFSyDxzNzn/4kv/4j1M6jb5nTvFkv0/Tm0a14bK:i4/ugRkdxzN7/4M/4ZM2bdTvus71aZ","tlshash":"1622bffc3fa29740d1db6a4f2ce76a1e4f17254e6c1dd24179bcc795d9790047546802","first_seen":"2026-04-03T03:48:29.749807Z","last_seen":"2026-04-09T02:15:36.991525Z","times_seen":20,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"s3t3d2y1.afcdn.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}