{"report_id":"ac414f7a-683f-4a72-9fc0-8d8d25814151","version":6,"status":"done","tags":[],"date":"2026-02-01T18:43:22Z","url":{"schema":"https","addr":"oi365-gemini.com/","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"172.67.197.141","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"oi365-gemini.com/","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"title":"Oi365-Gemini","dom":{"size":86696,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (54967)","md5":"b9fb4cb81879b086d0fa013270b25f77","sha1":"5f6af44915d865eb1fdeafcbe2dfefa9e13ea1d8","sha256":"8eabb6931d3720b198cd565cf114c75c6ae30fcc817f12498da3544363b3e9cf","sha512":"0b498d95596d7c397a210ac54100edca002ee74b3988a08f639b402cfe70bedc9a5088de28f1e0040e1ed06fcb5d71704a434dd55b742eab82cf3511b8be3a89","ssdeep":"768:eUzfwAXtgjy5Q5LZxM3CC2sk1JRHPT1F1abffoQb3VbSLKRQAM8Evvvuk7Qzx:eU5+0yZQblbSNAbEvvvukgx","tlshash":"a283913da8451c9fa137c4d1f0217b4db427a32fca6d9a859ef46294afe3c7068794b0","dom_hash":"domhash20e04e76a92c5ca9d255ef65328f8aa6","first_seen":"2026-02-01T18:43:30.97441Z","last_seen":"2026-02-01T18:43:30.97441Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"oi365-gemini.com/","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"172.67.197.141","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-08T18:43:22Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"api.bet777medusa.com","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-01-21","domain_rank":0,"first_seen":"2026-02-01T01:52:04.084362Z","last_seen":"2026-02-01T01:52:04.084362Z","alert_count":0,"request_count":2,"received_data":953611,"sent_data":1004,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"oi365-gemini.com","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-12-29","domain_rank":0,"first_seen":"2026-02-01T01:52:04.083068Z","last_seen":"2026-02-01T01:52:04.083068Z","alert_count":63,"request_count":63,"received_data":7148488,"sent_data":36834,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"image.win7777.xyz","ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-04-22","domain_rank":0,"first_seen":"2024-12-23T11:31:16.325965Z","last_seen":"2026-02-01T01:52:05.853119Z","alert_count":0,"request_count":25,"received_data":4198298,"sent_data":11625,"comment":"","tags":null,"fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"accounts.google.com","ip":{"addr":"74.125.205.84","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"1997-09-15","domain_rank":103,"first_seen":"2012-05-23T06:57:57Z","last_seen":"2026-01-26T00:22:04.5227Z","alert_count":0,"request_count":2,"received_data":250236,"sent_data":851,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"oi365-gemini.com/assets/tg4-Cg3j-mvG.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"f151fad49277f1cdd825fe2a08725f21","sha1":"93de407efdd35a63f8b5f90e38fc128ab543b61a","sha256":"b2255faec2db9723bb5a63461da1747ac34eeaacf9edfad6e26672923370ec08","sha512":"41d1dd8fae51b1d2213b9bcad732cd16108e2bae03e4697a850a2d10e05c710583de5827c9ff7067d821b6f1ff6dc0d8ef2dbf4028de276a441c3b2c5db5b119","ssdeep":"","tlshash":"d59004031440050101147170d373d457031117c4f35d4775c054510df057c544305d30","size":46,"data":"","first_seen":"2026-02-01T01:52:12.583622Z","last_seen":"2026-04-05T21:02:23.450519Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/UserOutlined-Bcc9dr-u.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"9d19913bf8d04f7687d77b457dbeb09b","sha1":"fdf85319f71decb0d4b86dd3352bb3db7a8fd73f","sha256":"88e9a9dc780f414abf4248aaccd4527a698247f86e096f639012eb5c111815b2","sha512":"782079c7e425a8c43bab7f9ad6f506e02381ed89d8d3be5ef610e79e4d14424cd28bea50a563bc421fa7d2bebcbba2e306079ee4303f4c622c3725880200e3df","ssdeep":"","tlshash":"523196596440b7fcbc89d2d8483b7500b04d143764e6be2cca62d8e081660dbd1fae4f","size":1458,"data":"","first_seen":"2026-02-01T01:52:12.684945Z","last_seen":"2026-02-01T18:43:31.052969Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/LockOutlined-DKLoBkB-.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"a77c03b31075fba2418b02e4cbd75fe6","sha1":"ec7dc2a9f74bbc8a4db96de2b71a8138df324d7e","sha256":"dfe8c69bceadae7b054675dd10b4f90524c27ab6d1ce572cebb5e08c65c3b885","sha512":"2a519c7c1da7e330b9e881acedfdb6cbd953e402de9055b35031820f3c4854e6ee2145aebf30af9804a7d42dc8f7944b5d1c4017865590a7b6f54558d83bf004","ssdeep":"","tlshash":"59219698256cbafa47fa55948c3ff242b119686520687c10b6e0ccc069614cefc85f1b","size":1120,"data":"","first_seen":"2026-02-01T01:52:12.619769Z","last_seen":"2026-02-01T18:43:30.990621Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/index-C7z3N1dQ.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"57d8b99a62163ef391379a10819368f8","sha1":"15aeec2cb766bc9407f1f5c68b38e23afb62ad8b","sha256":"24256633d362b8ff35a6052609d30499d6ce8b2a5331e4f5dda9c684dbb0ef19","sha512":"d4e8dd48687dc1f3cf796c9e094fe8d278cc1825dc6abe5b1d187796eec55695b8796dcf530afe7ebf99070fc5a7e2c32eed4baa4e053764a967da1517c55d23","ssdeep":"1536:OryoY8S7PCM8ZJLbfFPefpSicXwzCGbBDzyFBlxvHG94WckhXiA6wwKk7/kEJ1SR:0m7uFPkawLyL5gk244y7+","tlshash":"5ee349adb124b96781f3899712614100b1750a9ef829c8e4f0f95d6b89bed1413eeff8","size":153174,"data":"","first_seen":"2026-02-01T01:52:12.614229Z","last_seen":"2026-02-01T18:43:31.025279Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"accounts.google.com/gsi/client","fqdn":"accounts.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"74.125.205.84","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"f1c62ffce4275f180d1cf3d57909b0dc","sha1":"6461bceae0cdd16d6a9b4dffccb50f3ca7b48090","sha256":"d91599426b3a178e187c2a32c441d516f3ddaf3a2fc746ccfb0653ac8bb9a904","sha512":"a48b272b4836a35bb0b1c40dcb774ce5a0e97aa0b98dd68f197e7895a281db53bef705c688db4f65c1ba42dd00f9493eb9248a0afda7716f990723f7ee3a7744","ssdeep":"6144:RmZd7hxy5ChtJytS/w/oAkwnR8AiuMKCj1UupNQ:QPhPH/w/o5sybuMKCjKuLQ","tlshash":"ff344bdcb6e270315213f9b5d43f410ab03aa669f0498cacfa94c5f5acb1d890167f7a","size":247403,"data":"","first_seen":"2026-01-30T08:41:57.270658Z","last_seen":"2026-02-05T13:52:09.288028Z","times_seen":642,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/fb-SFSBBuUD.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"5e8b98db69b00956a17f4419fb1eac66","sha1":"40fcc641bc6737b513491355f99da8774f80a8a0","sha256":"9b858ea9056cade151793275c9facd054ea5bad137ae8468d099f12818feb5cd","sha512":"7e76efbdf1ccc2c391f22522e86b00a8fdd5375522c4cfd605fedbbd89b233f1f5c435cb7597be280282e8e995f07f7169d74d5056d6cdb19dbfb999ec4c4ecc","ssdeep":"","tlshash":"ab717db4a66a48e660fa2c87f2219511898f7b4fb108a160bcb5f0c18b50786df37a60","size":3761,"data":"","first_seen":"2026-02-01T01:52:12.58682Z","last_seen":"2026-04-05T21:02:23.40155Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/SignIn-DY0ncZ66.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"3ea90c688691eafb51bea37712e6bff3","sha1":"86ac75791f908e4d87e599690541dcc1b5a7f10e","sha256":"aecf7926c0a649a9f5b697b1ead2f17028db062caa47811b3929f8b471cc7878","sha512":"ee12ddc52065f4b56ef5c9fa03942ae3e837f1ff84b509924d9913c47613969c766ca401a5829bc8b01cb1abaeab7aed2aa50d0adde7a0a1042d9e61aa3bc613","ssdeep":"","tlshash":"8a71632da0578639feb31041564878a4a10d7ffae2228edb74ee8d003350db8b79f714","size":3762,"data":"","first_seen":"2026-02-01T01:52:12.589442Z","last_seen":"2026-02-01T18:43:31.036349Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/bxgq-BKq56oMt.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"11aba037f81b99aee9cfccef42d46597","sha1":"b6a999bdd45e5d83078ee83c1c197b79f519ad66","sha256":"39bde915096e20a55c26208a751b006e228bfbcc79a3111a16f448ab84614a20","sha512":"99ecfc9640c83f13cf02fcaf0ab8f1b083c61d0fe6936128c770cee44fdd53df77efdc9ad82e0669020614f04a94101ae89f2d3c075431975cc4d7c79321dbd6","ssdeep":"","tlshash":"9d90025104210ab2066d74889362c541504103247565436593245546b5114509007d64","size":52,"data":"","first_seen":"2026-02-01T01:52:12.618906Z","last_seen":"2026-04-05T21:02:23.456104Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/logo-CihcioOD.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"d5d71d8d1e5cfdc8e40b110222fb9fec","sha1":"48a00a1b89795f492abd91c6f4263b6cb133979a","sha256":"c072553c28432adf9b80f9999199525adc9e0f0248ee6d79a8fb5746dcb2f945","sha512":"eb6451bcfb271bb5a2cc4c08ed42917d8ffe0673c4d1f8dc10c76d56bff23bcfc87ea248e03e0ccdf76f36e88c2c801c7071b7a95ab212bad360e36d348d4049","ssdeep":"","tlshash":"7a90022acc0414a40098204851a394424015121c6167a29ec4555195a37158c8886c20","size":52,"data":"","first_seen":"2026-02-01T01:52:12.704024Z","last_seen":"2026-02-01T18:43:31.05451Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/index-gfA2LmCy.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"6329efe2d626e11ab21873c86b8f1f28","sha1":"0d2091f1b51ee56fee09c62b93c202f0bb889715","sha256":"256be4265eb7fba7973557312628943bf2410356c8f592cd264528f8ade25802","sha512":"6e552989f61250ff537717b41b7cc41b54b87f57cf92cd727034d8741705ed3abae7f5aa7713c7301efcb00824ce33b2c514b2807da1fec273413e07508f753f","ssdeep":"96:HYiFXzGdzFNyUVHOXet57AYH3jmz2lmJlojFmCRpa8J6oQ:4ixGdzb5HOXu58yqz24J2jYCR3J9Q","tlshash":"bdd1961fb869b43ee7b2842421442004268c2f8ea1b5c4e175dd6d3177e5d7c7bbeba4","size":6209,"data":"","first_seen":"2026-02-01T01:52:12.614954Z","last_seen":"2026-02-01T18:43:31.015794Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/maintain-LTx9tNmU.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"bfa0351a3eab3dfca6aa0df24d81c978","sha1":"c330cb53b42c0ff25f27eab435a8bf5f8599c490","sha256":"051baa130e2b3e6cddae99f47226d15c0d7dad9f6d43c89854efa965d2b6b75c","sha512":"f68e43c6e57f127d199c8cfb70b1548560eb99d5d86c204cbb6e4996429231af2334d481dc5cffe0479187f7d1d64932605574f896b58ebb9c4cd66df4063abc","ssdeep":"","tlshash":"387112fd4c041acdf838ca3b3a543b15e03326f9af6a488ddde27159d9b544429e893e","size":3659,"data":"","first_seen":"2026-02-01T01:52:12.608174Z","last_seen":"2026-04-05T21:02:23.389602Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/index-Dw2UbQiz.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e0c7d8c2bd8ad38eb71170bd068b7cff","sha1":"d2d661ff017c20f5f1ddfebb31356b9ee3096cda","sha256":"ff41dd2e64be75628d12120e38ea82c26689996ad16cd4b0f0652643927b4505","sha512":"d0f7670b3c0e1fdaef71a9cef9accfe26aca802738b9261ae9d8b9999c0c93008615127d7c4ab2a7cfd990d67e9dd67ac774dac6303eb70a90aa7c8a249c6fbe","ssdeep":"49152:MoYfGyljh+WVvcxUzVwgCsMgk9ZDur9iqIIhqvkTyUXEWlieRgbEgtAb/nsXmzY3:36bfO","tlshash":"0e956cd07289b8a58377c9e4907b0501b6291b44f41dc4e4f1bd9caa3b96e1ca1b7f3e","size":1902445,"data":"","first_seen":"2026-02-01T01:52:12.709019Z","last_seen":"2026-02-01T18:43:31.117495Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"oi365-gemini.com/assets/bxgq-BKq56oMt.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:00.509Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/bxgq-BKq56oMt.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://oi365-gemini.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Mon, 02 Feb 2026 06:43:00 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncf-cache-status: REVALIDATED\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5FobjPJ61WOT3%2B7qoEFjUgk0smwSHJN0OTpCh1%2BbKQFQhBjnG4yAYcKo97%2FICziKuMBXGKaHmg4ziAX1dFxPdzWIRN25qh0bN43RQIpU\"}]}\r\netag: W/\"6969a620-34\"\r\ncontent-encoding: br\r\ncf-ray: 9c7397881c870b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":52,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"11aba037f81b99aee9cfccef42d46597","sha1":"b6a999bdd45e5d83078ee83c1c197b79f519ad66","sha256":"39bde915096e20a55c26208a751b006e228bfbcc79a3111a16f448ab84614a20","sha512":"99ecfc9640c83f13cf02fcaf0ab8f1b083c61d0fe6936128c770cee44fdd53df77efdc9ad82e0669020614f04a94101ae89f2d3c075431975cc4d7c79321dbd6","ssdeep":"","tlshash":"9d90025104210ab2066d74889362c541504103247565436593245546b5114509007d64","first_seen":"2026-02-01T01:52:12.618906Z","last_seen":"2026-04-05T21:02:23.456104Z","times_seen":3,"resource_available":true,"data":null}},"time_used":581,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":581,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/liwuA-BB1-3833.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.918Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/liwuA-BB1-3833.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-7ac9\"\r\nexpires: Tue, 03 Mar 2026 01:51:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KkYzNERPePb7lftCnhQKU5y9UwWP5zkadbQckkamkaYRxJFQuQ5Vx%2FtjCLkBMIBYLaH%2BCdzpR6vLrXUro%2FyW2MWVZk5n%2BZ%2FvfLHnY031\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397910c460b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31433,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"32d7e4f6ec2caba0512b9ba646514980","sha1":"ccf46e78e7fa3a64e197d08e43bb935f72a3e2ed","sha256":"8ecbb142c11504892fbaa90cc80fa95275be7d2576c273143c23679f48d60c29","sha512":"6ff973b1ea9b6369065b54cdf0d54214900ad4a5553cc0815901026d18966fc1e07d422ef0fa3f8ebb7461079e62bae82d22e5be51918eaf3ce668d469e08e57","ssdeep":"768:gizk/e+bjswXjB5+2DvChVd8MXOPCheIBiyC2ZBUqS:giAeEjzXjT+276H8MePChe9y5KqS","tlshash":"bfe2e1d75ae493e756db8d1a603846fb87a572d88e164de0d38e72da0ccc31218f896c","first_seen":"2026-02-01T01:52:12.69185Z","last_seen":"2026-02-01T18:43:30.980248Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":11,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/shareA-kipXpyrw.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.930Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/shareA-kipXpyrw.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-9f39\"\r\nexpires: Tue, 03 Mar 2026 01:51:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fyCeaMN7zuOYccdxGfb82qHqsp9bzHXY4slMHhMG7UQlWhWsASyrhY0C3BORJ2YtAHhAELdRPu7MGFiOVa09UZzk3yhg%2BYNLqk6fbdp2\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397910c540b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":40761,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 163 x 162, 8-bit/color RGBA, non-interlaced","md5":"6cd84f66d5f693c6691d690c161eb21e","sha1":"02bd573281cd6456026a907a859f860650f4924f","sha256":"98ab7998deabdd3ffdeed19c1c81aedd002b0c27d907c1ff5809b26ab7871ac0","sha512":"586ff7a987dfa6c54277d96a18ef68db56f39367d3458b10d3711a6647a3e511f5b39ee7594b15980f703c7fd6261dee83ad032f2540b3ce40600fc5f25aea2f","ssdeep":"768:+XGrPKSP8VdFraBp0IuZRoFHsoAYHIXv3thpHLVy:2kKSGFy03ZaSoAYHEZRy","tlshash":"490302bdc7c04a3b503a6613ddb850008e66c7b7df68101872f5d9ba0f1bdca5b69467","first_seen":"2026-02-01T01:52:12.628385Z","last_seen":"2026-02-01T18:43:30.982711Z","times_seen":2,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/userA-BAyBLmAC.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.944Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/userA-BAyBLmAC.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-7b65\"\r\nexpires: Tue, 03 Mar 2026 01:51:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Bn9Ri3UaUBSnuiL44x25mlQzzNdhhHiAtRpPietjXFFSeL9P1eMSMydsylHv4YajVXd79Fy0A6OHZ6FO97Bl%2BwXjFVDVs7bW743uG%2BAP\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397912c750b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31589,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"80889b48e20781599712258194f37f67","sha1":"a292e429012425107d58f358e27e627dfee6e938","sha256":"f326cb4f0a8e7e1e59955ece2d3c25715542e73fe091944b11e7a7bcc1aa2259","sha512":"5209c0c012e9613a63fd758cdbde2a00d168193b24711687dea8b25af2eec12be6e6b753ca54f69bc45596a09ec507b804fe80f10a1c49a997dcfa0c7e154f83","ssdeep":"768:T9nUwnm+gjq+wjAAx4CGL2yB2WM14CslZ/o4R90omuCGFICyE08B/:T9nzm+qqYVxXOSnlr90okGZyE0G/","tlshash":"cfe2e1feccb772a029cefc261067297c6865eae67dc42ce0cff1718401689d245e4e0a","first_seen":"2026-02-01T01:52:12.641314Z","last_seen":"2026-02-01T18:43:30.985687Z","times_seen":2,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":18,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/tg-C4yI2fnL.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.944Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/tg-C4yI2fnL.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-1338\"\r\nexpires: Tue, 03 Mar 2026 01:51:43 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=J12l7z%2F0xMZoDH6TEwHOLxnh3Zrl6E16Mdu8w8ymScTCyZEPZgAVtorBPQyDF1UR12MPeh905QiTqOWF8Nskse5Nl%2FXAwvCHpIaBSKgX\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397976aaa0b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4920,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced","md5":"d22ce2d3820c9a53158dd6b4ed3e7f0d","sha1":"b598f419a5e209dad7eb1fef5e50c618c6b1ae49","sha256":"390564e496b5fbdf502f1afff2b86816a87512f880ca68e0c05423fbd9e968ed","sha512":"d52a614b6e5e2b0e72e6ac2f2d1e15202a46fd351b13f1a292f3f00620d65d00dffbe89c6fab1b759a6250bdac529197d4cec057f6a89a4aa8e2dd0a5e8f1372","ssdeep":"96:87STUQu9xhmzBitmJZcqjS9P1+gl2fIPdtdFEYfS2yPS9RYQddiu0:WS492CiZcqG6glfdtdFEwS2US9uQSt","tlshash":"5aa18ecb423692c5dbb47aa515cae0d6035d23a340a864a50fb23a8c58328883ef2894","first_seen":"2025-12-04T03:31:52.290021Z","last_seen":"2026-04-05T21:02:23.476806Z","times_seen":4,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/LockOutlined-DKLoBkB-.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.688Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/LockOutlined-DKLoBkB-.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/assets/index-C7z3N1dQ.js\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-460\"\r\nexpires: Mon, 02 Feb 2026 06:43:01 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U6Z1R6KE70E2m85BP6kuMWgijbbXGcMx%2B5Vh%2BM0l7yH8jzGlnlRhd3k4QQc5ZHhsZ2QQpXGqmFKsmXHv7IaaTU4kYd0Wb90QcHyt8YSE\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73978f8aea0b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1120,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1119)","md5":"a77c03b31075fba2418b02e4cbd75fe6","sha1":"ec7dc2a9f74bbc8a4db96de2b71a8138df324d7e","sha256":"dfe8c69bceadae7b054675dd10b4f90524c27ab6d1ce572cebb5e08c65c3b885","sha512":"2a519c7c1da7e330b9e881acedfdb6cbd953e402de9055b35031820f3c4854e6ee2145aebf30af9804a7d42dc8f7944b5d1c4017865590a7b6f54558d83bf004","ssdeep":"","tlshash":"59219698256cbafa47fa55948c3ff242b119686520687c10b6e0ccc069614cefc85f1b","first_seen":"2026-02-01T01:52:12.619769Z","last_seen":"2026-02-01T18:43:30.990621Z","times_seen":2,"resource_available":true,"data":null}},"time_used":193,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":193,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/bxgq-BKq56oMt.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.690Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/bxgq-BKq56oMt.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/assets/index-C7z3N1dQ.js\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Mon, 02 Feb 2026 06:43:00 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\nage: 0\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8WIXlqPcnCEGspL9bdf3AZYWwE8B%2BFX%2FywsckYEYxr%2B2aQotY7fUoTEVpuwmELoRlGuPe0y5MWp7BuNNZJkNEUHktEjDQAyofhR%2BMSfb\"}]}\r\netag: W/\"6969a620-34\"\r\ncontent-encoding: br\r\ncf-ray: 9c73978f8aec0b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":52,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"11aba037f81b99aee9cfccef42d46597","sha1":"b6a999bdd45e5d83078ee83c1c197b79f519ad66","sha256":"39bde915096e20a55c26208a751b006e228bfbcc79a3111a16f448ab84614a20","sha512":"99ecfc9640c83f13cf02fcaf0ab8f1b083c61d0fe6936128c770cee44fdd53df77efdc9ad82e0669020614f04a94101ae89f2d3c075431975cc4d7c79321dbd6","ssdeep":"","tlshash":"9d90025104210ab2066d74889362c541504103247565436593245546b5114509007d64","first_seen":"2026-02-01T01:52:12.618906Z","last_seen":"2026-04-05T21:02:23.456104Z","times_seen":3,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/logo-DcKe7oKP.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.946Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/logo-DcKe7oKP.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-285dad\"\r\nexpires: Tue, 03 Mar 2026 01:51:41 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60680\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2VtlNmH59AGheqn5GMzGReqhK%2Blnsal8IalW4xvZHZX6lUXH%2BjoenKHvFrPEpx16%2FreASmcZELbtZqF7fBRCQM7VadDX9pjWSkZw5pJp\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397912c770b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2645421,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 3738 x 735, 8-bit/color RGBA, non-interlaced","md5":"5faa8c17a3dc16f01e89b33363281686","sha1":"ec234a57ca8ff7bb4ea31344c9d86b1dc04e4aab","sha256":"c85f48295395f95c231cdbe5105c6a0a1557594f71b22bb71743843cc40d82d5","sha512":"871fe6880d8d962a233db9d8727986a5ed0a7a209dd0f9e34fa5dcfb25159ada63c7bf4b8b7377afbe8a86c88ead5a59862fa7973b2ebb50cf4d22cb271b2e35","ssdeep":"24576:pLITlfJvZmYGqZfxg1ZivMOXJbdmKYZ/0BoivZvPLCkbF:BITvEYfW1ZihJbMKq/0W0vPGS","tlshash":"2625232ebea18e09bb59f1729224f81d97f2d0f76902d41fe150b5b11962e38e51f03e","first_seen":"2026-02-01T01:52:12.682046Z","last_seen":"2026-02-01T18:43:30.992579Z","times_seen":2,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":68,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/uploads/2026/01/15/319da2ac1b0504461a225551378ed088.jpg","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.032Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/uploads/2026/01/15/319da2ac1b0504461a225551378ed088.jpg HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 125114\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 696956169A1B3E3036B15CE3\r\naccept-ranges: bytes\r\netag: \"B5BAC9D29994AFDA8A36BA3BAD583DD2\"\r\nlast-modified: Thu, 15 Jan 2026 21:03:17 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 2346122932549630079\r\nx-oss-storage-class: Standard\r\ncontent-md5: tbrJ0pmUr9qKNro7rVg90g==\r\nx-oss-server-time: 6\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=s0iyb1Vdpuz90F0bswxF2n8UKnsAhi8mBdb0c7qMAG8kZCdDh4Tvz%2FBb3gc3i17Jc2bT%2Fnhmn4glRfj1hMqh4LDf%2BSbrFB0cDvKlpswr4A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c739797edceb517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":125114,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 719x1280, components 3","md5":"b5bac9d29994afda8a36ba3bad583dd2","sha1":"ff94fb8a3414010e9c2bdcb58a88009846fde9e5","sha256":"54ac162ef6df9162ab40952a96f63eb0d63b6dd100a61caa25d63576c89aed8e","sha512":"e15d3a36510589b739e36ca7632273702783984ae16cecd33d976af5572f53fdd8c0414e1df3abaf0b101286e3801f8b740b134f5cf48d4516137d38ff19356d","ssdeep":"3072:9+44/e9RsxLG5kOPltarth64ECMsuTRrPs8zoiSZ4PS:9/gLGzPbaePs8ch","tlshash":"d3c3127b225cf07fc96c0e7422c28600fba471ba8677a3f52481ad7c2a597787d152c7","first_seen":"2026-02-01T01:52:12.61806Z","last_seen":"2026-04-05T21:02:23.503066Z","times_seen":3,"resource_available":false,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":214,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/pg_5/PG1623475.jpg","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.378Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/pg_5/PG1623475.jpg HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 94519\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 694EAA0B663D703036A40ADC\r\naccept-ranges: bytes\r\netag: \"5AB7D9357865BB527DCF05DFA479C35E\"\r\nlast-modified: Fri, 22 Aug 2025 11:05:31 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 18077642957744186234\r\nx-oss-storage-class: Standard\r\ncontent-md5: WrfZNXhlu1J9zwXfpHnDXg==\r\nx-oss-server-time: 42\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3dhKhEhaJIxivEoXih75D0giT7tF0QcLZidQnUBo1%2Bcz5e5DqC65Ay0iFdX3jE9j4rxRKULn4coQYpbZLgG1I74nXRAdsfe0mHUsWORFng%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73979a18b9b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":94519,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 680x890, components 3","md5":"5ab7d9357865bb527dcf05dfa479c35e","sha1":"969099604ba2d438243c654d886b4a9a28425cac","sha256":"3d7b0d81967f50d018a1181956c8d0f5bd9a1de3f1a3a98ed65518741c3c0352","sha512":"a71a277a57b6ccc9acd85303b3ffc129a4d056e8afcf200664f99fb5b238a04e32e921aa587b72514d1afa1c2c945de8c0ddb4c9ec69dd4c9f6dc43263c23037","ssdeep":"1536:WaRBkM08P/pt2M79V3lTU0wdnEpoIEqGNn5XDNJXfE0jitXwsO3Oma2mZWw:WaRrj3FT+nEpoI85zT9jwwsO3Oma2dw","tlshash":"089322b8c1dee305e95c6a56d234addcdbe124b166e3168a4110f7892b318820fdfbcd","first_seen":"2026-02-01T01:52:12.706662Z","last_seen":"2026-02-01T18:43:30.996963Z","times_seen":2,"resource_available":false,"data":null}},"time_used":126,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":124,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/activity/oi365gemini/vip.webp","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:12.089Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/activity/oi365gemini/vip.webp HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 49030\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 697CD017D2310439383F568E\r\naccept-ranges: bytes\r\netag: \"BDC78C3962B9A4068EE538D4D70B815E\"\r\nlast-modified: Thu, 08 Jan 2026 06:25:14 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 2958621794519962368\r\nx-oss-storage-class: Standard\r\ncontent-md5: vceMOWK5pAaO5TjU1wuBXg==\r\nx-oss-server-time: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Nnh018BUufe6WBeNPcytJw9NJaGNdZpsM3Yn0u7vtYj9CWMys7gdhvo7IzK%2BxTqwWMD%2F1%2BqwetK%2FbH0UFfi%2BHsx6%2FMNrCj76EgF%2FCBTYIA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397d09d71b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":49030,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bdc78c3962b9a4068ee538d4d70b815e","sha1":"1c89cfb930ea7a2c3bb7c397d8b8d29a1659adf9","sha256":"f98b152bb19e3b156c0f6e549f4f520a52e20b784db0184e6c79d9ff844aac92","sha512":"89874a038e3d83e39e0e1e9d850afc2b4aea031fbcd39bdcb103bd42a791b11b5c46ac7a80d8dd66be890bf63e1aa342ca01e6f54120000905462d7e29d4752c","ssdeep":"768:6T0omTFU0Byd3QF6mqZpvZO5TuLv0ifrEkqAbkrJyCgHtGWZswgUUkAnAlzBUqrQ:V/ZU0B2LZp4DW5bNChW0rBWBUuj8","tlshash":"432301f86732bdc2db9be471ec5b4798e86e30d75b248be42a0558e3323ca0150b9593","first_seen":"2026-02-01T01:52:12.658715Z","last_seen":"2026-02-01T18:43:30.99878Z","times_seen":2,"resource_available":false,"data":null}},"time_used":132,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":129,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-01T18:42:58.724Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 18:42:59 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nset-cookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=23TL7bYIOoZe7X6HQPWK%2FUxkHxoPLx1ha%2BD1VC%2Bg9u5w84wJzvbBdX5dYuMt8Z8nihDDk%2FbZ3Z3u5EvADHL4Hr2DgUyUm1Hy411JyidLBDA%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9c73977d5c2032fa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1126,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"f3cd0992debad23f899ee134471c46f2","sha1":"4b801bf91856ed09faacd89f25d7a4a6ce65214c","sha256":"e42f4f28759bba46b4a621171c6d7c0d5b67b8d0f0a7cf9063c8624d4f85e305","sha512":"f0d336768c5e18c808258707d14e6135d1bfca4b52854e63778ae16a3da5480ef6de2edef601ee4bf4fb8c11e8613f084b265c48aa9f81c3695a52fa66a58535","ssdeep":"","tlshash":"6f21dda3da00991983b54308adcaf0088556d542c6289a94e3ed92ed48c1bb6cefb23d","first_seen":"2026-02-01T01:52:12.596016Z","last_seen":"2026-02-01T18:43:31.000764Z","times_seen":2,"resource_available":false,"data":null}},"time_used":674,"timings":{"blocked":47,"dns":28,"connect":1,"send":0,"wait":576,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/index-Dw2UbQiz.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:42:59.505Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/index-Dw2UbQiz.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:42:59 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: \"6969a620-1d076d\"\r\nexpires: Mon, 02 Feb 2026 06:42:59 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: REVALIDATED\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cSeRZHa%2FT03itC8JrjH5xPykII2TeBmRyAfdrl7nEV67QCfS62ZEMAIZUEiq%2Bu5F7IvSxykNdJAcNfiqaXE6RZapdgKW0znIp5hj0A8w\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c739781ee440b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1902445,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (42942)","md5":"fd50f33286af4b040e33b3bac0206392","sha1":"0a5babdccb6eb89bf1e007ee9ec109109e7ee207","sha256":"6d1384d411ef4f3e733fccf1fc75867b6d2bd8106cfe2c9412647f5aff8e1125","sha512":"369f4fab666b54fd7e1411cc3b95a7703fd1a6946651b14a09adcbdf0cd8d9a11dec3d8dd0fad1a61cd694950ec2cc078127684d5f84d1c4b18b83c07d274abc","ssdeep":"24576:MoYfGyljh+OGv0vVvcxUzVwgCsMgk9ZDur9iqIIhqlFmgWTyUXE4ZlieRgbEgtZ:MoYfGyljh+WVvcxUzVwgCsMgk9ZDur9i","tlshash":"6f255dd47285b4a24377c5e5807b0505b23a1b40b80dc8e4f1bd98ab3ba6e1d61b7f7e","first_seen":"2026-02-01T18:43:31.002619Z","last_seen":"2026-02-01T18:43:31.002619Z","times_seen":1,"resource_available":false,"data":null}},"time_used":222,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":203,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/logo2-DZfgpJVy.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:00.442Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/logo2-DZfgpJVy.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:00 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-48765\"\r\nexpires: Tue, 03 Mar 2026 01:51:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=h%2Bi2scw8tgUx1PTTv%2BjQX5CDZgS2T45TonHDNoaQPY2onTqHrYlyQnqhU0f3RHRjre5JZraYfGzNMXZhnpegExSO%2BHOSWKjqbhzGN8eX\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c739787cc230b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":296805,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 997 x 999, 8-bit colormap, non-interlaced","md5":"bfd21b07ca0e89cf2f770990b5e0678c","sha1":"443f50da253ae2fab6fe2bb8d1da62ad9cf784cd","sha256":"c0990d7cb8f85e0112cf55c50f7e97ee62bdc1c4833400dea3313061d1043364","sha512":"ee3f78fd17f79074ec8df1e32700df557b13e90a90147f166df780aa7e6ee7532e78dd4ceb3a1b22b3ebf6da32b4c2c4ea0b1261bb5acfdb21c71e448b43e216","ssdeep":"6144:KPtxinSBKoJM57fqqdGgFcRf5Bn2seoL+UEcAQlU6hBDQ1aC:KVgnYKx57ggFM5Bn2seoaUB7lzAaC","tlshash":"3f54233fc53e00ffb870dab0755c7eb54c622a71c72758abb4c89c6506ed70aa99b190","first_seen":"2026-02-01T01:52:12.696782Z","last_seen":"2026-02-01T18:43:31.004832Z","times_seen":2,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":10,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/index-BI7wg9GG.css","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:00.487Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/index-BI7wg9GG.css HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: \"6969a620-c2ed\"\r\nexpires: Mon, 02 Feb 2026 06:43:00 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: REVALIDATED\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=X3a3QkdTwAAFN42CYnfq2taUvQcIeCEIWHdTFK%2F8qaLvkCRBa9JKhLCfkBPOw%2F6mOEvO1fc2%2BIyG3JaQoFnztxnlWP%2BV2eJjXvbKqYOO\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397880c680b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":49901,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (49900)","md5":"5709c26b179dde5e033e4b712004efd1","sha1":"faab6c47f93a483d0f1c842f7e5a9f1c45595886","sha256":"e4b380bf8f0b5945c0ad3370d2580ed97fd779c3d1c884c2b35baa50eecf2dfe","sha512":"58774799e3eb6a725cf76b19c9b5df738e8f6f600363a396861e781ee08a98ad5e14ad90506e236b8530af7460f7ea2f2979975b96bd9eea38dc3a59d10d8ccc","ssdeep":"384:bUbehJPdKW+SJZpbpur3ze2lDLpZ3zgn3JhLdmdk+kJcumAadnarSWj2Fu4l646:Ib8JPLDJZpbEzB83LLdmdkTaharQq","tlshash":"f123a63d730c181e9537ca1124e065cc1e29b26fc743565de693ae19cadb3b3293abc8","first_seen":"2026-02-01T01:52:12.580908Z","last_seen":"2026-02-01T18:43:31.007464Z","times_seen":2,"resource_available":false,"data":null}},"time_used":573,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":573,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/home1-DjEP7wTI.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.017Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/home1-DjEP7wTI.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/assets/index-BI7wg9GG.css\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-6289\"\r\nexpires: Tue, 03 Mar 2026 01:51:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60680\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UgiMJF4CTvV%2B%2B99wIP3%2BWzH9scGQQOvhUNigvfUeoyympjELyoeYMW2WLhC891n23WsMQ7gAxkwrrE2jEuVWutJtuBE5TnvW9zzaPMDQ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c739797db300b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25225,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 218 x 58, 8-bit/color RGBA, non-interlaced","md5":"627d7765bbb4f15e27eb531b3b36efac","sha1":"b053865d673c38d8e47a3d0b5a6978d8f64325aa","sha256":"9cf684965c426465011e9c8dd3a41f772d7f965d637de23ef7b327e2c7cfaa28","sha512":"d5a79ba7609c3e8acff20ede9d234edac0cf013d991f60101c03aca057aa4af498a1cb09ab26e4453b2d19f2666fa25f363ec13a9ad710718a39ecb023a88d1f","ssdeep":"384:nCvNbRLhTeiKWoC/7IZGSo55pKisTV9swby0lE0+LPIKZtbCt0gRzdipAMQhQIG:mNLGWpt95J0V9pby0uhLI6Ct0oSA/Q","tlshash":"d0b2f16d62c215fb52196b77d983804ea23f4223f831b07ac264533e2b3921cc775062","first_seen":"2026-02-01T01:52:12.602083Z","last_seen":"2026-04-05T21:02:23.496482Z","times_seen":3,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/pg_5/PG68.jpg","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.368Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/pg_5/PG68.jpg HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 97124\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 694E7B045486FA303383A90F\r\naccept-ranges: bytes\r\netag: \"4930C3F7BD2A0D9823646CCC9A7F9EDB\"\r\nlast-modified: Fri, 22 Aug 2025 11:04:26 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 4945648507123509775\r\nx-oss-storage-class: Standard\r\ncontent-md5: STDD970qDZgjZGzMmn+e2w==\r\nx-oss-server-time: 26\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZfO%2By9SW9Rhj6rHFa50OS3YCY%2BPtNkls8KOHbha%2F8ZA9WqfnHmyxeGaQEythiRuyX0bpPPM%2FcHwz4iVxA1Q6jSTsDqgxYmtpYyerXqGTXg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73979a08adb517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":97124,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 680x890, components 3","md5":"4930c3f7bd2a0d9823646ccc9a7f9edb","sha1":"add43e081c764aa492e5a86a9b7f0956969c977d","sha256":"381fa9ba9d160509422939240042492b8b12be583bcc0f7701c961df38605d01","sha512":"d7893e12a63b89f65dffeb5fd4bc6c659b09c2a91be8f34efb6d2bea7a11134fb09e33db8b1d1d611402ca369926bafe36ce400548bde1903529fdce95ab62f5","ssdeep":"1536:h/7ulBY1KHKoZZKc6e9mj8rArrnYFWBK21557/elRfEo5hm807lj7nBv:h/qf0KHlZKc6e9mYKrdBK0XqXMo5107D","tlshash":"cf9312371acf56a7e7076addbf4283908ae144597805aa4ca3ec5e0638f68f70cd6374","first_seen":"2026-02-01T01:52:12.623045Z","last_seen":"2026-02-01T18:43:31.011679Z","times_seen":2,"resource_available":false,"data":null}},"time_used":237,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":234,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/SignIn-CVRz0Ipv.css","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:00.484Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/SignIn-CVRz0Ipv.css HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: \"6969a620-122a\"\r\nexpires: Mon, 02 Feb 2026 06:43:00 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: REVALIDATED\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xcNome4%2FZW7FBx%2BcsrgdCnvx5uYUjwwLRsHlXw71AqOLZm4747UQuQTTx%2Fe94QCFt9j7grH0Jk4HFgyBQXb3tN5AQ8yJFFY%2FyulYVc%2BN\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397880c650b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4650,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4649)","md5":"6dc2f3cdf05016720e96d5c0f58cd447","sha1":"e8e73370aa2a868067b0a517608bc34629948812","sha256":"058d6ece764943ace954646626255b67037f9edd4bf6c30fe9b506c302991271","sha512":"65bdfde522741e096621b30e2297ece38733d36d4062efd4ab418134fd3478736b349b64d1e139b9b894716dc1aa3c4f8307a49e32c610edddc7deb5751e35b5","ssdeep":"96:/dHo/+Z3Wlij9C1yQgx9xsx83zpxrLuEGM2AN:/9pAMj6spxrLuHMjN","tlshash":"0ba19f37a2db34442976c4412d383fd5727e6186e2c3164d818a2e2b49c79936f7bb4b","first_seen":"2026-02-01T01:52:12.697629Z","last_seen":"2026-02-01T18:43:31.013836Z","times_seen":2,"resource_available":false,"data":null}},"time_used":588,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":588,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/index-gfA2LmCy.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:00.515Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/index-gfA2LmCy.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://oi365-gemini.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-1841\"\r\nexpires: Mon, 02 Feb 2026 06:43:00 GMT\r\ncache-control: max-age=43200\r\nset-cookie: SITE_TOTAL_ID=e4b7d4784194077fce5619285c650541; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: BYPASS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=C%2Fu9m2r39GVNNRtYusO8By3MHhYBacfJgTWhckpP1ZGlceEoFe0urK40DFpngSbEgdkJLrp6Pge4btPmIB%2BWb%2BGr7U1ZAYQ2vS%2BuSX4P\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397881c960b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6209,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, Unicode text, UTF-8 text, with very long lines (6196)","md5":"6329efe2d626e11ab21873c86b8f1f28","sha1":"0d2091f1b51ee56fee09c62b93c202f0bb889715","sha256":"256be4265eb7fba7973557312628943bf2410356c8f592cd264528f8ade25802","sha512":"6e552989f61250ff537717b41b7cc41b54b87f57cf92cd727034d8741705ed3abae7f5aa7713c7301efcb00824ce33b2c514b2807da1fec273413e07508f753f","ssdeep":"96:HYiFXzGdzFNyUVHOXet57AYH3jmz2lmJlojFmCRpa8J6oQ:4ixGdzb5HOXu58yqz24J2jYCR3J9Q","tlshash":"bdd1961fb869b43ee7b2842421442004268c2f8ea1b5c4e175dd6d3177e5d7c7bbeba4","first_seen":"2026-02-01T01:52:12.614954Z","last_seen":"2026-02-01T18:43:31.015794Z","times_seen":2,"resource_available":true,"data":null}},"time_used":580,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":580,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"accounts.google.com/gsi/client","fqdn":"accounts.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"74.125.205.84","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.305Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"accounts.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:38:48 GMT","end":"Mon, 06 Apr 2026 08:38:47 GMT"},"fingerprint":{"sha1":"E4:C0:5D:A5:66:E2:46:B4:2F:03:75:21:49:F7:F9:8D:CF:C9:58:65","sha256":"F0:D5:B4:51:99:C0:CA:94:30:60:81:61:A0:46:DD:77:A8:77:6D:94:6C:E8:6C:A0:2F:6D:03:CB:36:2E:96:88"}}},"request":{"raw":"GET /gsi/client HTTP/1.1\r\nHost: accounts.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\nexpires: Sun, 01 Feb 2026 18:43:01 GMT\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncache-control: private, max-age=1800\r\ncontent-security-policy: script-src 'nonce-OymQ5VFtsnpcapI2yhKQqQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"coop_dd7de8473bddc59c6b748810a67a39b1\"\r\nreport-to: {\"group\":\"coop_dd7de8473bddc59c6b748810a67a39b1\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1\"}]}\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":247403,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2265)","md5":"f1c62ffce4275f180d1cf3d57909b0dc","sha1":"6461bceae0cdd16d6a9b4dffccb50f3ca7b48090","sha256":"d91599426b3a178e187c2a32c441d516f3ddaf3a2fc746ccfb0653ac8bb9a904","sha512":"a48b272b4836a35bb0b1c40dcb774ce5a0e97aa0b98dd68f197e7895a281db53bef705c688db4f65c1ba42dd00f9493eb9248a0afda7716f990723f7ee3a7744","ssdeep":"6144:RmZd7hxy5ChtJytS/w/oAkwnR8AiuMKCj1UupNQ:QPhPH/w/o5sybuMKCjKuLQ","tlshash":"ff344bdcb6e270315213f9b5d43f410ab03aa669f0498cacfa94c5f5acb1d890167f7a","first_seen":"2026-01-30T08:41:57.270658Z","last_seen":"2026-02-05T13:52:09.288028Z","times_seen":642,"resource_available":true,"data":null}},"time_used":421,"timings":{"blocked":197,"dns":2,"connect":15,"send":0,"wait":25,"receive":0,"ssl":179},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/maintain-LTx9tNmU.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.696Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/maintain-LTx9tNmU.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/assets/index-C7z3N1dQ.js\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-e4b\"\r\nexpires: Mon, 02 Feb 2026 06:43:01 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4k%2F9NnLPERJr%2Fi120PcGBGb%2B3N3WnrJvjFVLMvHo%2BkDMoxhqVoipToQCVYy%2BASj%2BXVRStC5nzwpsVBhA4yi9RXK%2Fpnp2FLtg5d1pGVGp\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73978f9af90b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3659,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (3658)","md5":"bfa0351a3eab3dfca6aa0df24d81c978","sha1":"c330cb53b42c0ff25f27eab435a8bf5f8599c490","sha256":"051baa130e2b3e6cddae99f47226d15c0d7dad9f6d43c89854efa965d2b6b75c","sha512":"f68e43c6e57f127d199c8cfb70b1548560eb99d5d86c204cbb6e4996429231af2334d481dc5cffe0479187f7d1d64932605574f896b58ebb9c4cd66df4063abc","ssdeep":"","tlshash":"387112fd4c041acdf838ca3b3a543b15e03326f9af6a488ddde27159d9b544429e893e","first_seen":"2026-02-01T01:52:12.608174Z","last_seen":"2026-04-05T21:02:23.389602Z","times_seen":3,"resource_available":true,"data":null}},"time_used":196,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":196,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/tg2-Ds3ycOsw.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.947Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/tg2-Ds3ycOsw.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-14d3\"\r\nexpires: Tue, 03 Mar 2026 01:51:43 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LsNMb19EoprYSEQLvYs8%2BgqlCcOIQu6i7AB0MaCVllcTby0d92OGvCeNILYowKrAm4jgpk0OT9y7mUiasuS3AoHoDZcOi99t%2FAuaWsc9\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397976aac0b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5331,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced","md5":"0070b205184ddb3fafdf2c4ae82ca3dd","sha1":"1ad6a0d776a03074ab3df7798bda361dddd6da18","sha256":"be6965b4db1104358836a9b055f478eab73d5892260d692fef340ee0b0bd3923","sha512":"1ba4deb236b32dc38304ec14b0cbc8588e3b4fcbd842b5180d19f9348ce6f3541c66674481ce1336d7130252931cb3d331a39eaf0d1e3a01a941e7c5cc9131e5","ssdeep":"96:88knmWI13vbHkcIHxbuHrGRzj8mY9uEmk4HKv6f5LXvRK17ruxiotRNrILEqP7Vx:Vkn8bHARbuCZj8mYmHKq5LpGruxiK/sP","tlshash":"1cb15c8df195ec020b0c55c659fa995701aac9e4af42d1d0bceadd433270afe9d0f9d2","first_seen":"2025-12-04T03:31:52.236673Z","last_seen":"2026-04-05T21:02:23.491915Z","times_seen":4,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/home2-CatWFuiU.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.024Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/home2-CatWFuiU.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/assets/index-BI7wg9GG.css\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-6049\"\r\nexpires: Tue, 03 Mar 2026 01:51:43 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=A2XGp%2FkGFilETMYKC%2FwX8b7c%2BicsdajdpzO6x3bHlN46SeBU9lHL3ypq2ZNnGnPEXPN1lfNMUjaVz9dfE9tnjOPI8%2FpYQiwmelRrT0XT\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c739797eb3b0b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24649,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 218 x 58, 8-bit/color RGBA, non-interlaced","md5":"65132829fdb4e805e8273c833caf47e6","sha1":"b0024021bd053ba9d5a463de33e5f612c7060345","sha256":"9626941d9675590fbff31cfd1e0940721f2ad1859791d5c9c8ca0c1ef985ec45","sha512":"da2179d2146e68d3750adef1d0693a2963939be435b5384552257d3ae78026812c2f28e8a5f817bb5c691c0a62b11031f305c3a7643198a12dd9c611736eb82a","ssdeep":"384:prTKCY2ms0bzQo8IBIJUP2sw37dRrnDqN7xo50fGoV9mSc7gy68m8osjPonaN3v:prTKrDBErXU+rLqN1o5OGoV9fz8m+oSv","tlshash":"7ab2f2f0f4d29b085badc3d4d6542938a063959589a5693fc7c6703acecc4264f863fe","first_seen":"2026-02-01T01:52:12.695031Z","last_seen":"2026-04-05T21:02:23.510474Z","times_seen":3,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/index-C7z3N1dQ.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:00.499Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/index-C7z3N1dQ.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://oi365-gemini.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-25656\"\r\nexpires: Mon, 02 Feb 2026 06:43:00 GMT\r\ncache-control: max-age=43200\r\nset-cookie: SITE_TOTAL_ID=bd44e3c6f016de29ab144057c77d281d; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: BYPASS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jnPU4RaR0dCRA3Ry3Vsi12nfHKpZXWm5pRRJA1dY2UNFqYGgeeUOvoQ9ZudRI8LW25t8RdCrqHgWSTxh%2FibPEBIWIUQe8HfJFvj%2FxZNm\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397880c710b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":153174,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"57d8b99a62163ef391379a10819368f8","sha1":"15aeec2cb766bc9407f1f5c68b38e23afb62ad8b","sha256":"24256633d362b8ff35a6052609d30499d6ce8b2a5331e4f5dda9c684dbb0ef19","sha512":"d4e8dd48687dc1f3cf796c9e094fe8d278cc1825dc6abe5b1d187796eec55695b8796dcf530afe7ebf99070fc5a7e2c32eed4baa4e053764a967da1517c55d23","ssdeep":"1536:OryoY8S7PCM8ZJLbfFPefpSicXwzCGbBDzyFBlxvHG94WckhXiA6wwKk7/kEJ1SR:0m7uFPkawLyL5gk244y7+","tlshash":"5ee349adb124b96781f3899712614100b1750a9ef829c8e4f0f95d6b89bed1413eeff8","first_seen":"2026-02-01T01:52:12.614229Z","last_seen":"2026-02-01T18:43:31.025279Z","times_seen":2,"resource_available":true,"data":null}},"time_used":961,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":772,"receive":189,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/index-gfA2LmCy.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.694Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/index-gfA2LmCy.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/assets/index-C7z3N1dQ.js\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-1841\"\r\nexpires: Mon, 02 Feb 2026 06:43:01 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=W7eZCXS7lT2x1PldcNDPACksUIW0%2B%2BMAQVEBWeIYwsg2yvPKJoFN5q%2Fa%2B3jDBMtBmBjpGWEn8SxCKhvgVo6GCj0RkZnoLfmbY1lhN6nH\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73978f8af30b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6209,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, Unicode text, UTF-8 text, with very long lines (6196)","md5":"6329efe2d626e11ab21873c86b8f1f28","sha1":"0d2091f1b51ee56fee09c62b93c202f0bb889715","sha256":"256be4265eb7fba7973557312628943bf2410356c8f592cd264528f8ade25802","sha512":"6e552989f61250ff537717b41b7cc41b54b87f57cf92cd727034d8741705ed3abae7f5aa7713c7301efcb00824ce33b2c514b2807da1fec273413e07508f753f","ssdeep":"96:HYiFXzGdzFNyUVHOXet57AYH3jmz2lmJlojFmCRpa8J6oQ:4ixGdzb5HOXu58yqz24J2jYCR3J9Q","tlshash":"bdd1961fb869b43ee7b2842421442004268c2f8ea1b5c4e175dd6d3177e5d7c7bbeba4","first_seen":"2026-02-01T01:52:12.614954Z","last_seen":"2026-02-01T18:43:31.015794Z","times_seen":2,"resource_available":true,"data":null}},"time_used":197,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":197,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/na_VIP-JcIOYsVi.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.992Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/na_VIP-JcIOYsVi.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-6a16\"\r\nexpires: Tue, 03 Mar 2026 01:51:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dBVtJ%2F2oVSPCuB0rimLt0dtBUTOeOQ9k3bbponltbhGTaEduCAN5JgGI2%2B1MpXDP1PGLLBZdWc0jCrUoQWouNfhX8w5dj%2Fh%2BP8NTrzSv\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397916cb80b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27158,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 170 x 110, 8-bit/color RGBA, non-interlaced","md5":"4fdfe67a1f55bdd4b151f9cf24b4dd8a","sha1":"78de402d8d3743b832165578703ae5423d9d8809","sha256":"99da2287aaf1b93cabb9c896bccd5b792d4748477415d9305bb567c9cfaf25df","sha512":"b1c345ea591fd2ed2fb0e664c2f905a96e1fc136e6a7518a7721104d1853651a3bc6940318288716be270400db1669162da70edba2a22c32e1bdceeb3159e79c","ssdeep":"384:DuWQd0fL0HsvoiRgFSmrXLwqgZx0NskWzOx/QNCLxElAsIHelcJnJj2PN:vPfAMMdrXEqgZxOxQAEW9+lQ92","tlshash":"5cc2e1f411304ec9b3395c593a3ff13f700a9955b9dbecb18ada756b0180c81aa6a7d3","first_seen":"2026-02-01T01:52:12.699473Z","last_seen":"2026-04-05T21:02:23.486735Z","times_seen":3,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/footer5-VESUAflX.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.969Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/footer5-VESUAflX.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-46fd\"\r\nexpires: Tue, 03 Mar 2026 01:51:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TJz3iV%2BHKdQ7wZHVplFtQXGxVTjWdJGgPZD5hRFsX29MY0cd8e7ADqsprXTNMs%2BajMj1wF8IYs97Lr0161iiauAQh9%2FEajjQpXMvhbuW\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397977ac40b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18173,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 450 x 186, 8-bit/color RGBA, non-interlaced","md5":"e796164b55b41ece289a657e7e84802f","sha1":"b34889330a6178e311af2979d5cd34534e6eaddd","sha256":"31809f730369367754114427dffe16491d8c3ff3b116bc3d3a57494612e40667","sha512":"18cf7926078d9673a472eb8c603a400f789a5eb6f9fde1e082a5cc3edd89af7a310acba1c366f666245c5010313658580d77cabefe5765c3df56b35dcf37ee34","ssdeep":"384:6IxKF/Uz/IzJUVtn2TrFMrgyvlET4I7pQhk8q0DbbwwEruVSjEkLw5:6WTItM+rFMcyvlEvpmkR0MzGSDw5","tlshash":"4c82c08374432184c53ac0ae98edc835a71e2b00fb5972cff1cfc6756d276a1999963a","first_seen":"2025-10-11T10:32:16.818497Z","last_seen":"2026-04-05T21:02:23.458015Z","times_seen":5,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/footer7-DBbacz7L.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.975Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/footer7-DBbacz7L.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-1f84\"\r\nexpires: Tue, 03 Mar 2026 01:51:43 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9wm2veDPn8o1DZKchPAHHHt%2BlprcMdDCHM8E6KhILLOjSE5E779HIt3Zw29L4sGuAZvhtyPxnaX7k%2Bop%2BSWd7oXNmrjoezSSt%2BRZWYKT\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397978ac90b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8068,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 450 x 186, 8-bit/color RGBA, non-interlaced","md5":"50cf72bd091e65ef1886ce92e35e07bd","sha1":"2e0e79c8a81e6424152da6be2200ebcde04a8c82","sha256":"f87fed4e62ede5d81c670fe1ae970ada115af8b5f9d1a48e4ee67b4f2a3c35d3","sha512":"e6dde27a31600e754338bb6759a333de0606a9e1148cb4583759a492695558c245499714b5f2d2aa4979f61d06e82cc8e0cb105fc22509ef630a5f9166df378c","ssdeep":"192:67FDLVSUx3XexiOIFTvYUpPNZZkZ4odhZZufR2222222222l:6BjxVFTvYURZkldxSp","tlshash":"90f18e0a6413d8cb754860a250c779f264bf8376eae467b8128cc81e976317f0d988cf","first_seen":"2025-12-04T11:42:54.823797Z","last_seen":"2026-07-13T04:35:34.890563Z","times_seen":7,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/uploads/2026/01/15/b12a30c0b28fd438d3e456e6db54ae0c.jpg","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.039Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/uploads/2026/01/15/b12a30c0b28fd438d3e456e6db54ae0c.jpg HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 216384\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 69695811AFEE6F3936080748\r\naccept-ranges: bytes\r\netag: \"5F401BF03BAD468B2FF59C45BD0BA4C6\"\r\nlast-modified: Thu, 15 Jan 2026 21:11:44 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 551874167144471198\r\nx-oss-storage-class: Standard\r\ncontent-md5: X0Ab8DutRosv9ZxFvQukxg==\r\nx-oss-server-time: 5\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MqCcEPr7kuPBt5nzZbd5QKqFzo5QhE2w09Z6HtTWcsJG8udQkXfpg8b0a3lnS1C2%2FPDw5xziZip36mrHGtV7I1tEO8p9oWsq64pp0yBaSA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c739797fdd8b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":216384,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 750x1334, components 3","md5":"5f401bf03bad468b2ff59c45bd0ba4c6","sha1":"1b5e3f779bbf93a5377ceb8f353d1493f0c914d8","sha256":"005e52f9088d58868c9a3e03143237983da3fee08b0ab0f7be5c757cb6d9917e","sha512":"9236b75870a9f098b4fd7ec580faba0b76374054f62c61c599dda743c66fdad59918003e6160078c447081008817a17d9429debc7cdf52c66d77224e37c91ea8","ssdeep":"6144:bMMYjDTmfb/BN8rB20yIXBW1os02PRnw17OfEXJ:VYXSfb/D8FDyDos02Rw17JXJ","tlshash":"f82413c169b623b81b03c5b0d6287b197e0ec65d4fdfe692b665c7c0d6bf2648b6b001","first_seen":"2026-02-01T01:52:12.64703Z","last_seen":"2026-04-05T21:02:23.490209Z","times_seen":3,"resource_available":false,"data":null}},"time_used":221,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/uploads/2026/01/28/ebc4b95defffd1b6144380e8adbab32b.png","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.047Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/uploads/2026/01/28/ebc4b95defffd1b6144380e8adbab32b.png HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/png\r\ncontent-length: 317589\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 697A37FDE37C953132F159BF\r\naccept-ranges: bytes\r\netag: \"81A67954485FE0C85EECB1A449204DDB\"\r\nlast-modified: Wed, 28 Jan 2026 16:23:24 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 4029486933481902772\r\nx-oss-storage-class: Standard\r\ncontent-md5: gaZ5VEhf4Mhe7LGkSSBN2w==\r\nx-oss-server-time: 6\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZHOk5Q%2BpLByXSJ5eoaLEr9yMwFAiR67RmaFGkiEsr6Hfwc2Klw258dK7Heh3xuSTF9KdLJi45L68nQ91sCHc18LU7yetysoenZZUrToOWA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397980e00b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":317589,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1000 x 1000, 8-bit colormap, non-interlaced","md5":"81a67954485fe0c85eecb1a449204ddb","sha1":"e9a7b8d84d7b242836414dadeb4c0d7b12bd861a","sha256":"c306ea4026ade1a9cfba37614f6cd01c2931b6fcf9c2f3073096c1e7915348ed","sha512":"6cc7cb3f62b8616cd26d208d917023a198622287c2bc0ff76510f3e63d71adc48b9fc24acd045c92707b18a8a3b37d24ff72a898bbe8cd2d38f90870a8fe74fe","ssdeep":"6144:BXBTygWUTqpxD7CcBi5E2cFQx9cm8twYSefuo37LId4q:BXBTX0pl7NBKHpczt9SeGoLLImq","tlshash":"dd6423831960a9447735e6fd1a4fb527d5098732d4e6df2a882f88d33539ea13c9cb2c","first_seen":"2026-02-01T01:52:12.689822Z","last_seen":"2026-04-05T21:02:23.459075Z","times_seen":3,"resource_available":false,"data":null}},"time_used":158,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":129,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/SignIn-DY0ncZ66.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:00.504Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/SignIn-DY0ncZ66.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://oi365-gemini.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-eb2\"\r\nexpires: Mon, 02 Feb 2026 06:43:00 GMT\r\ncache-control: max-age=43200\r\nset-cookie: SITE_TOTAL_ID=512a0143bbbab3b4e76d5a018353a97e; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: BYPASS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7gwqPfvp7eOfnABzYHgNUHGtPVQOj4IBa9MEAHPZleUMZQg0ZRDy0s6aoo7bYSCq2p5TtRcTi%2BIs%2B%2F0BWefkYQEGnZrLT%2BqtZHJBrM0S\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397881c820b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3762,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, Unicode text, UTF-8 text, with very long lines (3721)","md5":"3ea90c688691eafb51bea37712e6bff3","sha1":"86ac75791f908e4d87e599690541dcc1b5a7f10e","sha256":"aecf7926c0a649a9f5b697b1ead2f17028db062caa47811b3929f8b471cc7878","sha512":"ee12ddc52065f4b56ef5c9fa03942ae3e837f1ff84b509924d9913c47613969c766ca401a5829bc8b01cb1abaeab7aed2aa50d0adde7a0a1042d9e61aa3bc613","ssdeep":"","tlshash":"8a71632da0578639feb31041564878a4a10d7ffae2228edb74ee8d003350db8b79f714","first_seen":"2026-02-01T01:52:12.589442Z","last_seen":"2026-02-01T18:43:31.036349Z","times_seen":2,"resource_available":true,"data":null}},"time_used":582,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":582,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/LockOutlined-DKLoBkB-.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:00.507Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/LockOutlined-DKLoBkB-.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://oi365-gemini.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-460\"\r\nexpires: Mon, 02 Feb 2026 06:43:00 GMT\r\ncache-control: max-age=43200\r\nset-cookie: SITE_TOTAL_ID=7652912ac06f41df65e13c6ef4bcecd7; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: BYPASS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8Tb2LTArQc47CN%2BG%2BNwgJACYyFyoec9oA0mIukuGkeKSc8TEMTtaB2F3Be9eNt%2FYP5zrZaV%2BlZVsXry99uoa4ozHpAzffuTaxtshyvE3\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397881c840b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1120,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1119)","md5":"a77c03b31075fba2418b02e4cbd75fe6","sha1":"ec7dc2a9f74bbc8a4db96de2b71a8138df324d7e","sha256":"dfe8c69bceadae7b054675dd10b4f90524c27ab6d1ce572cebb5e08c65c3b885","sha512":"2a519c7c1da7e330b9e881acedfdb6cbd953e402de9055b35031820f3c4854e6ee2145aebf30af9804a7d42dc8f7944b5d1c4017865590a7b6f54558d83bf004","ssdeep":"","tlshash":"59219698256cbafa47fa55948c3ff242b119686520687c10b6e0ccc069614cefc85f1b","first_seen":"2026-02-01T01:52:12.619769Z","last_seen":"2026-02-01T18:43:30.990621Z","times_seen":2,"resource_available":true,"data":null}},"time_used":573,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":573,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/supportA-BStDyBTS.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.939Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/supportA-BStDyBTS.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-7e22\"\r\nexpires: Tue, 03 Mar 2026 01:51:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HuHulU1bPjVDRJ%2FPiE1%2FC5sFFgH%2Bc36Bk8nS3EcZziAwDkxM8Adg%2BabfccJBPFDOKY9QUf%2FBhp1ApTibABKKXBu9CSvto6bssqMndpA3\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397912c6c0b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":32290,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"00833f79b57f771826af2b5f942159d1","sha1":"47da7c65cedab18772476267cb2148babaf17e23","sha256":"798ae4ca95e490c6ebdaf5226ef2e6214dda140e6b7f9f14e33e87039e56d580","sha512":"f1abcf60e83dc763fa5fb3d2b84880270d1e17f99e81bccdfe1fea08bdbccfb12a6151211a594052cb2063b5e61c26ee7f9c0665672fdb0e69d81a6dcc329439","ssdeep":"768:hBkqeycEfJoKe9lK9AAAGB4t1T2QJiWg8EN3tY6cvWX1LKmnVrj62Mws:htcCJ12lKmGoSQsWGTB9flkws","tlshash":"cae2f21ca59039307bb42663e8445bc2c7e95922e5ddd2adfed1709a21343f277109db","first_seen":"2026-02-01T01:52:12.609068Z","last_seen":"2026-02-01T18:43:31.03795Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/na_Pendente-CevYK1Gk.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.987Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/na_Pendente-CevYK1Gk.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-67db\"\r\nexpires: Tue, 03 Mar 2026 01:51:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BSKFWstP8IoDUobJGgNOvQTO1aw3H%2FfDYw0%2FcBSk7Ebmo%2FWFgE2hBPPtSjA6a9uItoxdR1n%2F6xSEKtaKl4KC5ApEsc7fFOotbDtHSPFG\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397915cab0b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26587,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 170 x 110, 8-bit/color RGBA, non-interlaced","md5":"d5e47f9689a041c7e0f228da220e0367","sha1":"3d367e6411ce73ce5a1d9c6ef07dcab9ceadbcd9","sha256":"568600bbdca6e5b75810bcd9bd95ba62005ddd507b4fe0f12d19e1ea66e74848","sha512":"c983a424e6f727218e1a6f3c755e85113a0b82fd3bcec47503b4ad8049e7eba395dc8423679f433df789dcbf8d793f38acc2afb03da5ffaeacd370c7b34572bd","ssdeep":"768:TfT/ULTvhA2u7fZVERIl+F+ELJ08xRoWq:T7/ETvhDuVmIcYO+UoWq","tlshash":"02c2e1919b591c76928aa06ddbcb932fc5f3b4d0361a9144ff101a42b40d2c4da6eeca","first_seen":"2025-10-18T02:18:36.515205Z","last_seen":"2026-04-05T21:02:23.485897Z","times_seen":4,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/comm_icon_gb-D-86XLDa.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.474Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/comm_icon_gb-D-86XLDa.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-148e\"\r\nexpires: Tue, 03 Mar 2026 01:51:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60680\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6uxRJS%2B8FRB9N2AjWoqQ2v6RwG%2BLxvuCyWCFf9qVuloclNdbU4eNRZOrs4TuC75Zq673EoKn3ZeYI3X0YK4MHbmz1EDhQiCCRUCYOAVF\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397947fb40b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5262,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 56 x 56, 8-bit/color RGBA, non-interlaced","md5":"4f90e44ed58509d026c0af4e1c75268d","sha1":"993955c19f7141f81a4b9a0510f69d2658d32409","sha256":"bfc0d6f532aec69c0959f1362950cc0b56272f9049824b7722e65356e8999204","sha512":"91b2725774323cbd7347252c39b2bff5ceca9560a7053fc5c428beada85320a7f30541da2f6653bb6b9d607dbd6b71118ecad536102af808168e18a62bb33520","ssdeep":"96:dX9oEf3HO8v99NREO7lniWPjfrJz+BXuPM4QDO8JrCOvhtZy5XSRQ9:Dow3HO8v7NRHnimjfrJz+t4ORWOvht07","tlshash":"68b1ad71a826b062a667df83720a7268b7b06035110a4da2367dde2985ccfd0e47c2f6","first_seen":"2025-03-19T05:10:43.565498Z","last_seen":"2026-07-18T21:09:20.464881Z","times_seen":53,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/footer2-DnXcEfSS.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.964Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/footer2-DnXcEfSS.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-6f88\"\r\nexpires: Tue, 03 Mar 2026 01:51:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2h%2Fb%2FNSigr3sMyNsDhjtssdHIhH6zAFpA9Hd7vMWFM3ZDvllYQIwH69Ak1xUKNdGSdfCFQnLLVFe7u7rFJ%2B6DIr6u7Bu7P%2BxrA2HFPdt\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397977ab60b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28552,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 450 x 186, 8-bit/color RGBA, non-interlaced","md5":"3390e3aa5bbb55e0ab1920f1e25178f6","sha1":"f92cc968244f5e34d6d712c7926ff8871e7beaa2","sha256":"6282df878befec8af268d00670451e5471e436ce1997e7761db4fd09e409d71f","sha512":"d9594754bd89c112a54d42ae096b6d1dfcefb7aaff2c732ec6c44156669b4e85bebcd58a0d5c54a800d7026e0ab53e73b64e75fd446ed3259eb65a47c73b44de","ssdeep":"768:hyFwiHlsjs2n+QaDtM9IfMCg2ugJNsvM/O8f:Gl6svtM9t2fvsIO8f","tlshash":"fed2e100993186958d7d29abf424fa9ce1f04b50bce496033252bbdabb4cb624b4dd7d","first_seen":"2025-10-11T10:32:16.839882Z","last_seen":"2026-07-23T14:14:22.598549Z","times_seen":11,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/fb-SFSBBuUD.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.678Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/fb-SFSBBuUD.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/assets/index-C7z3N1dQ.js\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-eb1\"\r\nexpires: Mon, 02 Feb 2026 06:43:01 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=efUhdG1NMYgUh44GakWtSm5anN%2FaZ2tomdixCKrACxEd14flTeeov1V2IfhT%2B3f2z5AANz2LHkFgFskueHGYTxuI0C4aI5DQOuypb6vp\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73978f7ad70b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3761,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (3760)","md5":"5e8b98db69b00956a17f4419fb1eac66","sha1":"40fcc641bc6737b513491355f99da8774f80a8a0","sha256":"9b858ea9056cade151793275c9facd054ea5bad137ae8468d099f12818feb5cd","sha512":"7e76efbdf1ccc2c391f22522e86b00a8fdd5375522c4cfd605fedbbd89b233f1f5c435cb7597be280282e8e995f07f7169d74d5056d6cdb19dbfb999ec4c4ecc","ssdeep":"","tlshash":"ab717db4a66a48e660fa2c87f2219511898f7b4fb108a160bcb5f0c18b50786df37a60","first_seen":"2026-02-01T01:52:12.58682Z","last_seen":"2026-04-05T21:02:23.40155Z","times_seen":3,"resource_available":true,"data":null}},"time_used":194,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":194,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/homeA-NWXMZ6O-.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.913Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/homeA-NWXMZ6O-.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-7991\"\r\nexpires: Tue, 03 Mar 2026 01:51:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=P1nha%2FFtXnxVjpYygZp9kLcAbbMFiKLe%2FCpeXmm%2Fw%2FLvzYWhCQCMC4koTjESQkg1pAdnJ9gsv3JuV45qwZrwzNLsP9MjCHuyyMoaUUFS\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c739790fc3d0b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31121,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"720a8853194a9493b8b16610a2f6c008","sha1":"0425eb38e5f97746a86a09622bafce0ff37a23da","sha256":"9648567a94965d34c3cde328077912e2cebeaa8ed9a9b770e8883171d224957e","sha512":"c1d0445badfc9cbb5894727e827dd5feb94738e4d71f1e1d35df7a09d6ba674928742c7dc9c17d045b53d1479d1c4fd71e1ddb6a88145ad3736acca2f97b891b","ssdeep":"768:Vf1995bUt+bKn8lHcS7Cb6w+P/kKGMLcXejdl5R3dq8UaOgrq8:rTStYK8NuH+Pf+0ddW18","tlshash":"81d2f1eea860211521823cc62bf349cb1d92a951d8169fd6f2bdd154d4c3931e85cefe","first_seen":"2026-02-01T01:52:12.690967Z","last_seen":"2026-02-01T18:43:31.045456Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":11,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/pg_5/PG1738001.jpg","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.382Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/pg_5/PG1738001.jpg HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 106884\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 697777695486FA3337559A04\r\naccept-ranges: bytes\r\netag: \"101A9EFBFC5594EA9F83CE05ABB3ABAC\"\r\nlast-modified: Fri, 22 Aug 2025 11:05:37 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 2319624864957180302\r\nx-oss-storage-class: Standard\r\ncontent-md5: EBqe+/xVlOqfg84Fq7OrrA==\r\nx-oss-server-time: 108\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bsGchSyWbZRGVcZ38ZVeTo3%2Bg2wmhqXM6N%2BftQh45eN4MA%2Fk4cux%2BA7v%2FSH3Twd7sz2LC3AtPGecHY5R%2FsJ4hKEhFhBt6ybNGOw9vD8UHg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73979a18c8b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":106884,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 680x890, components 3","md5":"101a9efbfc5594ea9f83ce05abb3abac","sha1":"1fe65a2c50c8d6d30f23735ebd51a8dd3ecaf9bb","sha256":"e5ab1c4f9bdb83c56f007d032f3cea5868957fe6f1ff46281f5c40f6bbcebd16","sha512":"f2099ca8124d4488609f2fe76eae6118e1f9b71d9d186ed13f1e9fdc35a5ef7a054efad4d5ff08bc0e438bb7251ac751f782e0158725e1c9d8cc333586695db0","ssdeep":"1536:D2SO9OHDw7hp0Ipc8DEKFaIcTeTarfJ3a+t2jvbt76BmKZuCDbKsa:DrNM7v0IpTaIcTXk82rR6BmKbSsa","tlshash":"51a3123782b35d303a51b48069304c9cbb543b9866e927d42265fd71f07aaaf4f10abd","first_seen":"2026-02-01T01:52:12.613417Z","last_seen":"2026-02-01T18:43:31.04688Z","times_seen":2,"resource_available":false,"data":null}},"time_used":141,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":139,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/activity/oi365gemini/sign.webp","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:09.103Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/activity/oi365gemini/sign.webp HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:09 GMT\r\ncontent-type: image/webp\r\ncontent-length: 41750\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 69730DCFB55BC037335739D2\r\naccept-ranges: bytes\r\netag: \"F43DFE53E23AD90BB3E6640C10DA0F3E\"\r\nlast-modified: Thu, 08 Jan 2026 06:25:13 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 4882525745101076813\r\nx-oss-storage-class: Standard\r\ncontent-md5: 9D3+U+I62Quz5mQMENoPPg==\r\nx-oss-server-time: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fadSWH5tUhQGkR%2F5RtmIKOW25HVBHVKjqMMexHen2iuvj%2Fp1i4APod6eg9hPObiEgUlbtN1DFbjBAz1Cjim5mht%2B6QBY4rqskVw%2BY9GldA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397bded3db517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":41750,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f43dfe53e23ad90bb3e6640c10da0f3e","sha1":"dcabb47b044bfb542e67038c5228e6256c8c7801","sha256":"7c21f4d86c70185ce04851376c88bc63f939deba065274e09ce885f5d93cf6fb","sha512":"1dcf35f7b7230887f5e1ef889bf0c6e80cb3fe24f24e61516c3704e6b5f27ecc7b211802d891844721a8ed87bf527e7e9972ccbae9162ab488a7ecc08cf749f2","ssdeep":"768:WTwg8eulG0teCe+lTo1RzoDMTz7AOXVGQ5bPzjdnJgW9ESQPZldS+iR84:RNbeARobzTvAaVl5bPzBmSEHBlI+94","tlshash":"d413f180231a876bed4b563108ee1aa2f5d1a7ad84e396840087db6e275366f07c31f7","first_seen":"2026-02-01T01:52:12.623803Z","last_seen":"2026-02-01T18:43:31.048467Z","times_seen":2,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":151,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/Quente-BACTiY4E.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.886Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/Quente-BACTiY4E.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-218c\"\r\nexpires: Tue, 03 Mar 2026 01:51:43 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QOZ86Ovg%2Fo5Q97RiKoNDbS7iNJtzuPeXYj999NEiWMSUOoW2Dn%2Feh4s4xTvdvpzclLz4d6RkrMNhBWJ9J6ZqIpp45%2Bx7f11FpivUr8B2\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397970a480b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8588,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 76, 8-bit/color RGBA, non-interlaced","md5":"544dcbb285891445c4e00981aaa24c29","sha1":"dc1efd2ef2d93231f46aafa4bd7d1c97bc700aa7","sha256":"d49212d6319bd8fb59d021a0eafcb165bcc8c8def598d69c232d0bd7cbde563c","sha512":"bec22153b2180026aaca681c6ab125942b7fe9af5c0d96214b1c83b3233af8339f74cd96727c8870bbe6d2131d4ee94af1a2eaca39a832ecfd405b4da5f31ab3","ssdeep":"192:QSJ/nEdv8ijG40cjweBbeRyMww1EEDHbrQ6Ppk9FQCI:3J/iYDsFMFBD7r5XN","tlshash":"e502ad204f1ce12d017a6b09c6d34b2e5d1244dd035aa96e3efb7e5db83a057ac36392","first_seen":"2026-02-01T01:52:12.687128Z","last_seen":"2026-04-05T21:02:23.466801Z","times_seen":3,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/index-CG4NAUoy.css","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:42:59.507Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/index-CG4NAUoy.css HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:00 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: \"6969a620-341da\"\r\nexpires: Mon, 02 Feb 2026 06:43:00 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: REVALIDATED\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DegHDLF0F3ilP4lODyRWDsrEsfCA6wkzJxfxGFiXFmZGIssVTz4DxH8AecDjxedd7eCRFInH5cU74%2B2NcZHYNq2W5%2BGlOl806JFXUgog\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c739781ee480b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":213466,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65018), with no line terminators","md5":"0a40e86a72125a1224bd8422ab0c5a5b","sha1":"65d5cd26d6cf9484426ea332dff280e770737ec6","sha256":"e542b237292f12c25bef3d1063587725902426ce0b33e3456c61505e7f6ecadb","sha512":"5f9acbfa452f04c7b1b824987773465d5b5fa55a4da37f5a3f2a4790be099f0ed93bb92398ee5615f7f2b80331a29947756e776f0e5757934c511cf55de56155","ssdeep":"1536:glYIyNBi3MFYaQj7FCwsBlDOFIxuVoxwP3+Ii71Al5a4zBAVeVKxIUr:glkNIClDsIxuVSHkpQIUr","tlshash":"5124b559e69091bcaf27f275abcb96dcf23cf560dd01caa4f101a1580ec7bf5062361a","first_seen":"2026-02-01T01:52:12.610679Z","last_seen":"2026-02-01T18:43:31.051142Z","times_seen":2,"resource_available":false,"data":null}},"time_used":583,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":582,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/UserOutlined-Bcc9dr-u.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:00.505Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/UserOutlined-Bcc9dr-u.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://oi365-gemini.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-5b2\"\r\nexpires: Mon, 02 Feb 2026 06:43:00 GMT\r\ncache-control: max-age=43200\r\nset-cookie: SITE_TOTAL_ID=ae06e696d24ca253b9d26ed34e0bbcb3; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: BYPASS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mrxLWjPRay%2BcckJcsdFvLmmvFF2en3JdyuaUTn5JrGhuUfikYvHLSi7bRW0IxBVxpfsdaBv%2FkJHlwv78MFHFRFyL91TOxyM8zpBXrFpA\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397881c830b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1458,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1457)","md5":"9d19913bf8d04f7687d77b457dbeb09b","sha1":"fdf85319f71decb0d4b86dd3352bb3db7a8fd73f","sha256":"88e9a9dc780f414abf4248aaccd4527a698247f86e096f639012eb5c111815b2","sha512":"782079c7e425a8c43bab7f9ad6f506e02381ed89d8d3be5ef610e79e4d14424cd28bea50a563bc421fa7d2bebcbba2e306079ee4303f4c622c3725880200e3df","ssdeep":"","tlshash":"523196596440b7fcbc89d2d8483b7500b04d143764e6be2cca62d8e081660dbd1fae4f","first_seen":"2026-02-01T01:52:12.684945Z","last_seen":"2026-02-01T18:43:31.052969Z","times_seen":2,"resource_available":true,"data":null}},"time_used":570,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":570,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/logo-CihcioOD.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.692Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/logo-CihcioOD.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/assets/index-C7z3N1dQ.js\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Mon, 02 Feb 2026 06:43:01 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\nage: 0\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wedmDVx1TCTWRBfnutzERDhzd0PncW5pstibmLTDXn8LFVrVZCJr%2FJ8tDtvqXNY4mixGebokRxLBJhBGz8%2B6hOt93uG%2FGAzeeQ4iJpX4\"}]}\r\netag: W/\"6969a620-34\"\r\ncontent-encoding: br\r\ncf-ray: 9c73978f8aed0b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":52,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"d5d71d8d1e5cfdc8e40b110222fb9fec","sha1":"48a00a1b89795f492abd91c6f4263b6cb133979a","sha256":"c072553c28432adf9b80f9999199525adc9e0f0248ee6d79a8fb5746dcb2f945","sha512":"eb6451bcfb271bb5a2cc4c08ed42917d8ffe0673c4d1f8dc10c76d56bff23bcfc87ea248e03e0ccdf76f36e88c2c801c7071b7a95ab212bad360e36d348d4049","ssdeep":"","tlshash":"7a90022acc0414a40098204851a394424015121c6167a29ec4555195a37158c8886c20","first_seen":"2026-02-01T01:52:12.704024Z","last_seen":"2026-02-01T18:43:31.05451Z","times_seen":2,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/icon/whatsapp.svg","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/icon/whatsapp.svg HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-oss-request-id: 694316493FAECD39329DFFD1\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6%2B44quH5xMKvK99yng5E9DMZDcadVwytfDz9hvMwSXD5fh%2B62Mj1n0RaK3bbqyAd0svVJbjtkBaVGxm%2BFX2jLNZIJoPOyu9Xxf0X37YM5rts\"}]}\r\nvary: accept-encoding\r\nlast-modified: Tue, 04 Nov 2025 03:06:57 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 1637077111378749866\r\nx-oss-storage-class: Standard\r\ncontent-md5: /9TT3Zpoo1y/AQifxQ2PHg==\r\nx-oss-server-time: 61\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\netag: W/\"FFD4D3DD9A68A35CBF01089FC50D8F1E\"\r\ncontent-encoding: br\r\ncf-ray: 9c739794fe8149c5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":2663,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ffd4d3dd9a68a35cbf01089fc50d8f1e","sha1":"d6d9d5c8f8ccae676c9a0984b230f3ee2a6e0dd5","sha256":"f879a309c6118eaab9f8b5184d163c0a1f5e4d512c7f2ef72757abada9e8f997","sha512":"99d00d57640b79e844a446dcaeb45cc598a03cb641e4dcdfce086869c76866e2587b18a099e13d935c5a4dbc75964c548e7ee294be1a2214dce0018188d44100","ssdeep":"","tlshash":"d95182a6a3edb1e1f049f3e8c251a479729702ff7b27cb1843e85e30950615d859c894","first_seen":"2026-02-01T01:52:12.593996Z","last_seen":"2026-04-05T21:02:23.455225Z","times_seen":3,"resource_available":false,"data":null}},"time_used":383,"timings":{"blocked":91,"dns":64,"connect":1,"send":0,"wait":199,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/icon/teletram.svg","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.469Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/icon/teletram.svg HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-oss-request-id: 6949FD1D838A68343067E277\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a2KWN2YZUBGYCrcY%2FRy8gCFfc%2FybIGEa1ROhXsHhrIfEjbry7ZHdIA%2BTKFNpmtcQ7FNoMWbQdd34uGMtkYO60qynHfUZU0Ic1XqHkrc%2Bnzb%2B\"}]}\r\nvary: accept-encoding\r\nlast-modified: Tue, 04 Nov 2025 03:06:57 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 7514641159294633824\r\nx-oss-storage-class: Standard\r\ncontent-md5: RbdYL0mAdKM42hJgXdB/yg==\r\nx-oss-server-time: 53\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\netag: W/\"45B7582F498074A338DA12605DD07FCA\"\r\ncontent-encoding: br\r\ncf-ray: 9c7397950e9049c5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":1609,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"45b7582f498074a338da12605dd07fca","sha1":"1c6237e996db213d5ae70d6f1b73ae4100df3a1c","sha256":"5497a57ea2fe379633630f4d1953f1204a9905d2f70f39de4ffd18d9cce8ee87","sha512":"a6634c7e504d50c475e4d9de4fa162dbb520f46055a32178faa1e74910b0176c2c43640e871d401e1f9fff92deca2d53e8a35eeb9b20c492233a39eb8cc29545","ssdeep":"","tlshash":"ce3133b9b3dce0b3a348f3744218e42525f351aa7603ca14b3dc2e66bc2108e1e49999","first_seen":"2026-02-01T01:52:12.617297Z","last_seen":"2026-04-05T21:02:23.471322Z","times_seen":3,"resource_available":false,"data":null}},"time_used":393,"timings":{"blocked":93,"dns":63,"connect":3,"send":0,"wait":205,"receive":0,"ssl":23},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/uploads/2026/01/28/c0be6cc23b0fea76ff23e917d47c5e5b.jpg","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.047Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/uploads/2026/01/28/c0be6cc23b0fea76ff23e917d47c5e5b.jpg HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 743300\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 697A37BD851C843836ACB1D7\r\naccept-ranges: bytes\r\netag: \"AF3B002BBB491A53C579547628A4312E\"\r\nlast-modified: Wed, 28 Jan 2026 16:22:21 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 15003873909877611286\r\nx-oss-storage-class: Standard\r\ncontent-md5: rzsAK7tJGlPFeVR2KKQxLg==\r\nx-oss-server-time: 6\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=44AQWF0LWK9YERou7sTbTrruwWP5Zu5gDqb8%2FNsNsuzU1gz2YTj6rswzKA%2FRFg%2Funi%2BaeAD1WNJO4P3qT05upBeEGOGWnmMwYOz6uu%2FvZg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397980df5b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":743300,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 750x1334, components 3","md5":"af3b002bbb491a53c579547628a4312e","sha1":"69326a44568d14576941dc1e6fd19efae288d243","sha256":"0c39b168ccf51fe7775f796ec98c417aef9c482930e017670ebd8e138a467600","sha512":"5d70a3a6ce1f55bf9262d8ea77657ca583c7f293618a4e67959283209df55c98e62c158c8f12c87263271da5761c3ac913d7d7292d82ba5388b3fe1b35937852","ssdeep":"12288:WeLghkUt+VSWn9lfv5J8p3he4ZH08fcZT7rNU1YiE3+f3zxqSWQgexdNShSDdJTH:WeUkUtCSW9lfUZg4U+6HNUKFuf3Vqigy","tlshash":"c2f423377a8e12d5b5ad76ae95feccc5f36f58f4a0d4cc4b1a09260d9394f9000d287a","first_seen":"2026-02-01T01:52:12.652388Z","last_seen":"2026-04-05T21:02:23.442276Z","times_seen":3,"resource_available":false,"data":null}},"time_used":284,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":220,"receive":64,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/pg_5/PG1682240.jpg","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.370Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/pg_5/PG1682240.jpg HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 132908\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 694B49F19557E53031C814B4\r\naccept-ranges: bytes\r\netag: \"29C3315EE643398FA106F6147B370C11\"\r\nlast-modified: Fri, 22 Aug 2025 11:05:36 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 15966007151644938868\r\nx-oss-storage-class: Standard\r\ncontent-md5: KcMxXuZDOY+hBvYUezcMEQ==\r\nx-oss-server-time: 28\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tmxeDMwprmqd9J2FJyIrQcdiYGc6tSU5XTJFBQYdCcWUNS6QB25rn7ZnKrVVwL3Pl%2B1k4v%2FENcqTPwLyGoV5kJhbSuyszM5pdfcVoe86Rg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73979a08afb517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":132908,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 680x890, components 3","md5":"29c3315ee643398fa106f6147b370c11","sha1":"bce8589a41fa49a949ca2bd027f58b7b408c47d8","sha256":"71356a572ef3c3ba20c2a13c8239dc14d8380466bed369e924253019ea0805d2","sha512":"2e226af15497dad4a02dcbaa560ff1d098aecbc24f6b8ec68fef8f74bfea4e1b6a87e868f1cfdf0877da11f20372a1fcab308bc1c0359d5dec8d29f57485148c","ssdeep":"3072:bzHzlMY4nTlBzTiVI9xdWBq4Z+0YJif41IeZF:D+HnT/fiVw4c0YJpF","tlshash":"3dd3120d9bb6dc1212390b1daaa772993fb73c5cec09ad7a4117deab5173081b7829c4","first_seen":"2026-02-01T01:52:12.702333Z","last_seen":"2026-02-01T18:43:31.059479Z","times_seen":2,"resource_available":false,"data":null}},"time_used":145,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":143,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.bet777medusa.com/api/home/connect?type=oi365gemini","fqdn":"api.bet777medusa.com","domain":"bet777medusa.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.022Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bet777medusa.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 10 Jan 2026 21:01:14 GMT","end":"Fri, 10 Apr 2026 21:58:44 GMT"},"fingerprint":{"sha1":"18:1E:6B:32:AF:CE:8A:25:6F:F0:6E:28:69:63:26:12:9F:66:6E:A2","sha256":"06:98:5B:EF:27:02:9C:B8:CA:8C:8D:D8:DF:95:1D:19:8E:D8:8E:F0:4B:EE:BB:1F:83:F5:BE:0C:46:6F:B3:42"}}},"request":{"raw":"GET /api/home/connect?type=oi365gemini HTTP/1.1\r\nHost: api.bet777medusa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://oi365-gemini.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: application/json\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\ncache-control: no-cache, private, no-cache\r\nx-ratelimit-limit: 6000\r\nx-ratelimit-remaining: 5998\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FdypcxCQiEeZlxij81vgt7BnkMb5c2ufs9EfgYP80ssrxYYL9HrigbKP4LGnNnvj3HJ7B4nNbA280xEwOzB7yxJkY4E%2F77z1C9KUFFA%2FLEOQEQ%3D%3D\"}]}\r\ncf-ray: 9c739791ff700b51-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1199,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"0011224aaadef24ed5e4dfa39364d896","sha1":"43338fed9069a93f052762171126ae8d03105cfc","sha256":"7501ebb3110e1927de88ad13bd9dc690e0033f5a6a6af9ae965017c5893ac537","sha512":"412155d8c5bb6614707fbbcbebc0dd1a002cf3604a85a666998621d61eeb212900be1d0c7352b3d46587306fcd4d00dc4b5396bb8538445ccc7ff8917298f67c","ssdeep":"","tlshash":"81219bb56be449a903c4dbd1fc4ea32cd99c301b6954d90381afdc3c00f2ba4056d763","first_seen":"2026-02-01T01:52:12.679243Z","last_seen":"2026-04-05T21:02:23.47391Z","times_seen":3,"resource_available":false,"data":null}},"time_used":452,"timings":{"blocked":51,"dns":27,"connect":3,"send":0,"wait":349,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/shoucang-BRUno2e2.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.895Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/shoucang-BRUno2e2.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-15ef\"\r\nexpires: Tue, 03 Mar 2026 01:51:43 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7te0vP382viVt7mBDpuQzu8dLT%2FiK%2BRHoDX67HbjVPtavcDaqbw%2FGhAPQf2CFqiDUUMLneLJsbiPxuGz%2B0ggNBwiDfTaDiqX5uE6js%2FO\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397971a580b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5615,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 67, 8-bit/color RGBA, non-interlaced","md5":"655262e402940bdd2b7dbd8309777c73","sha1":"b3f4cf2a9f99309dd011d375f0f502107103aad2","sha256":"62f5bdbbccafe8b6d42ccc114628379a1b61e66c0f3027899b81f2f14b9216ba","sha512":"8ba8d823e98568a65fb7b6f679b961696cdec95d0d667f09ed76edcb310791c636958c7657b83ffeb70d7bbd2750d7d68efca8f122deb93ab842e921e2d98c94","ssdeep":"96:fS6CUhHX+VBWed2dYOIEGOe/N2HLtGdmW7+HGiApll+4Kn0Ta7pWWK4:fS6LHX+VBZ2dIEGOe0HL4m6+HGiApdKF","tlshash":"67c19edf240423eeba5e4abe590b558459f756c3f0ae0b8138f330e0fe4de416b46294","first_seen":"2026-02-01T01:52:12.615801Z","last_seen":"2026-04-05T21:02:23.445457Z","times_seen":3,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/jackpot-But-3T4B.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.913Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/jackpot-But-3T4B.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-188da\"\r\nexpires: Tue, 03 Mar 2026 01:51:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pUceAVYvaDAB6s6sSF%2FwBFf1ZiITXpFr%2FeohpR7iRhBIIQM9kkWKX6Qk1%2BOO1vpjVBo%2BthaSrJ46yZ48kT55xwZTBmEKaNkShQDpFhyW\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397973a820b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":100570,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1050 x 329, 8-bit colormap, non-interlaced","md5":"86e428429a548652471cbc5e9420d265","sha1":"8e6864c6212f3b2b51604c398d32c4f9a275cf03","sha256":"ce02635e3563fb3bdb8eba581cd117d9a2758d437d214357dbccc37ccc15e5b4","sha512":"2cdb0c0a754344a293a0559ca5f72f9a48da52f77bc9860338e029cede4dc82b0b6ccdb8434f3f210e31b423d701995af0a97d6d646ae422b3d0c5a589063085","ssdeep":"3072:KomYZ3Uk7p89nymcbdDsCapCfOpb2g9WnF95ZtGyzCar:j3Uk7p8ifapG4b20c9ntRTr","tlshash":"0ca31294226d95de909c0b606d82b69122cd33f9a2efecdaf37e5dd1dfca0381391245","first_seen":"2026-02-01T01:52:12.57496Z","last_seen":"2026-02-01T18:43:31.063674Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/logos.ico","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.308Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /logos.ico HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: image/x-icon\r\nserver: cloudflare\r\nlast-modified: Mon, 29 Dec 2025 08:21:46 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QvCoMEleudcEem0d707M6guXAWr1iLxpBinxIGrLwov7Pz5Uf1JyrqOPqy4s9JNxhbDm8GhOyPLptezzSISi35NcpmHTD%2FCarlCXZEZd\"}]}\r\netag: W/\"69523a1a-17311\"\r\ncontent-encoding: br\r\ncf-ray: 9c73978d29090b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":94993,"size_decoded":0,"mime_type":"image/x-icon","magic":"Targa image data - Map 32 x 29435 x 1 +1","md5":"dcb49337115f8e08db86d9fea16731ba","sha1":"2801ca52f2a5460b5253fa4702dd05e6aedf00e2","sha256":"ff0dd75ba69a7e8d8bd1213ab28cf2efb7921a52200ec5ee76b01e0f0a0f6f64","sha512":"3afa4a2aaa246e07519942ca3458585bcb7888a455c8d6e701ae27105c7498ea7c88606db1f41307a411699f6a872ee68e5d12d66d48e8f9477b0a7b5ec0634d","ssdeep":"1536:2BqOVuUmLNy5aMzk9wm1E+DPHIRM/kkNhWDJJs3EUI73lcUoE5hMCP0yId9GP2I:2BqOoUmZy+wmfD/wyJhuS3i5c1EjMCPH","tlshash":"6093120fce61a4983407f417c1f61d695cf4b4ba0fb433922587fa81cad66f96a0571b","first_seen":"2026-02-01T01:52:12.686285Z","last_seen":"2026-04-05T21:02:23.387637Z","times_seen":3,"resource_available":false,"data":null}},"time_used":585,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":579,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/SignIn-DY0ncZ66.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.681Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/SignIn-DY0ncZ66.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/assets/index-C7z3N1dQ.js\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-eb2\"\r\nexpires: Mon, 02 Feb 2026 06:43:01 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=W91A1JWAaY8n1uQUIolbDIi96bxHTmbQ3JTmuGe%2BoY4Mud7O0udu6gKioLZ7bL%2ByGOXHBuXH%2FeYftafQOqFtMcq3G4kk74aoNsN9wGf0\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73978f7ae00b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3762,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, Unicode text, UTF-8 text, with very long lines (3721)","md5":"3ea90c688691eafb51bea37712e6bff3","sha1":"86ac75791f908e4d87e599690541dcc1b5a7f10e","sha256":"aecf7926c0a649a9f5b697b1ead2f17028db062caa47811b3929f8b471cc7878","sha512":"ee12ddc52065f4b56ef5c9fa03942ae3e837f1ff84b509924d9913c47613969c766ca401a5829bc8b01cb1abaeab7aed2aa50d0adde7a0a1042d9e61aa3bc613","ssdeep":"","tlshash":"8a71632da0578639feb31041564878a4a10d7ffae2228edb74ee8d003350db8b79f714","first_seen":"2026-02-01T01:52:12.589442Z","last_seen":"2026-02-01T18:43:31.036349Z","times_seen":2,"resource_available":true,"data":null}},"time_used":197,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":197,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/na_Rebate-D2MLFnDi.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.986Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/na_Rebate-D2MLFnDi.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-6779\"\r\nexpires: Tue, 03 Mar 2026 01:51:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f45lFWEDRL2y0otn%2FT2KaAPCGi4ud2hviDCDdqaI1Xulr4diBABDy3ZaQPOSs3vdROtGUFvL2XVVj1xg7Xa8zr%2Fhv2N5yqpxd4M2GQk7\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397915caa0b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26489,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 170 x 110, 8-bit/color RGBA, non-interlaced","md5":"949224eaa5efb396d81d37f1dda8eda3","sha1":"f7e30844471de0b2bc5f201d3482b05c7787809a","sha256":"d1029c9e91d67ba461c42dde283542586d7ae8d696a9dc57e5478d8f8c1551f5","sha512":"1876da3b8aaa13897ac716097331b86120dbff3048937d182b0ec76646a947e19a4d604a8db6a0688b2763dc25fd1a8710bb66ec5d31fbe1fc7433a91cc0afd7","ssdeep":"384:DuWOeQ2oiyDnhKHQJk/UlmnG6ruCfvD6hsE0Z3iCXyi7pwIek0HiBFgL:AJDcwflIfruC3D6uE0Z3iCllQL","tlshash":"35c2e0bf673af0b1abdd1a91255d090c1487836511b08f6d0887312f3ea7beb58e9e17","first_seen":"2026-02-01T01:52:12.632625Z","last_seen":"2026-04-05T21:02:23.470514Z","times_seen":3,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/uploads/2026/01/15/f30539cb081e3a1304f1b80c9c841c28.png","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.044Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/uploads/2026/01/15/f30539cb081e3a1304f1b80c9c841c28.png HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/png\r\ncontent-length: 394292\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 6969573858D56436367AF28F\r\naccept-ranges: bytes\r\netag: \"D98DCB367735266D0AF2F864BB206EE6\"\r\nlast-modified: Thu, 15 Jan 2026 21:08:07 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 17706129169912575141\r\nx-oss-storage-class: Standard\r\ncontent-md5: 2Y3LNnc1Jm0K8vhkuyBu5g==\r\nx-oss-server-time: 5\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HeT9CPUOpdXiV3v6Adv7RHKHBM78B%2BwAJOzzFtHdgRTnmyx%2FIUH7r14IspHZugUGy%2BCMtTebV4TVd%2BVKZDwY26Kc8RZdEqhsHk3DKWL%2BXw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c739797fde5b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":394292,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1000 x 1000, 8-bit colormap, non-interlaced","md5":"d98dcb367735266d0af2f864bb206ee6","sha1":"3c90a7ee78540a946ef390f77993cb86bf058007","sha256":"f508a4e244bcac4d017f570aa625b072a3e5f5c9b459f0b090aa9591f169b493","sha512":"b7b2ecee276b7dd9601bd3ee197bf5315c98baa801370c8377298a35612952547637b86e0c6e08ecb8e0bbb38a6d5c5a24e262d232dd279ab4e77b8a043300d1","ssdeep":"6144:7xdG7isI4hQRJdLYtvcVWSk4hbXBAj4gBezbRmgxsyYGwFJsheqKvBnWyySLeWPC:zMeRJtVWT4QNBezVG/FJ+GdA7JBb9","tlshash":"e184231f42d0c178f5bb4cab5950fc4b1c4602dea920ba66c06fe9aceb5898592ddc3d","first_seen":"2026-02-01T01:52:12.705769Z","last_seen":"2026-04-05T21:02:23.479692Z","times_seen":3,"resource_available":false,"data":null}},"time_used":243,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":198,"receive":45,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/pg_5/PG1635221.jpg","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.380Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/pg_5/PG1635221.jpg HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 87748\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 694B5271E37C9530305BF124\r\naccept-ranges: bytes\r\netag: \"558E442D7CD60536D4A47FE34AFA638A\"\r\nlast-modified: Fri, 22 Aug 2025 11:05:31 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 16244290583778837332\r\nx-oss-storage-class: Standard\r\ncontent-md5: VY5ELXzWBTbUpH/jSvpjig==\r\nx-oss-server-time: 49\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ezTds6%2BL1ffN86EVVPCARKWTPLv3Pa%2FPWuFmBGfO0mR64WseJ03vBL7REK0Pq5YqiItFwaWZSHrHrXIgAmU7g1rs35IdmsdLVDYR71Y%2FDg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73979a18c2b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":87748,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 680x890, components 3","md5":"558e442d7cd60536d4a47fe34afa638a","sha1":"e34c6b1d830cabcb80181fc5d80c0a91d65c17ba","sha256":"7fde435cd0cfd8375c96bdbee8bda28d81dce2db3f63b9903cd7acd5d6c87717","sha512":"ec1b5ee34e1b6eb60f720646841623e7696b619bff1f227a9539147540cb8a51a7cc44e219a5b260a8f132e617ac2fcd73fa6d850a50ba70e9684b699edc15d4","ssdeep":"1536:EqTuO9UqRtMd0DvPXXZOZnOYMluiCKxUWPH+uEw2v4TfBMwEHfoSaoTpQkmLbNCu:Eq9UqRtMd0LfXZmxWBH+q2v4zmwEHvtc","tlshash":"c78302a263016f0f8191d5ce01fc5aae31a67709df40e8c6175caf7ab86d22fb1d416e","first_seen":"2026-02-01T01:52:12.677656Z","last_seen":"2026-02-01T18:43:31.06983Z","times_seen":2,"resource_available":false,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":177,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.bet777medusa.com/api/home/index?type=oi365gemini","fqdn":"api.bet777medusa.com","domain":"bet777medusa.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.021Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bet777medusa.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 10 Jan 2026 21:01:14 GMT","end":"Fri, 10 Apr 2026 21:58:44 GMT"},"fingerprint":{"sha1":"18:1E:6B:32:AF:CE:8A:25:6F:F0:6E:28:69:63:26:12:9F:66:6E:A2","sha256":"06:98:5B:EF:27:02:9C:B8:CA:8C:8D:D8:DF:95:1D:19:8E:D8:8E:F0:4B:EE:BB:1F:83:F5:BE:0C:46:6F:B3:42"}}},"request":{"raw":"GET /api/home/index?type=oi365gemini HTTP/1.1\r\nHost: api.bet777medusa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://oi365-gemini.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: application/json\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\ncache-control: no-cache, private, no-cache\r\nx-ratelimit-limit: 6000\r\nx-ratelimit-remaining: 5998\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=q9UjqLxoXWDykLwJOQ4ZJaiqR9pbhRdOgOpQJ7BwnTrLaQgwJiF%2FABvMjKkZ6fEbYjFP3tZCjIydXCPfidQWpVjfPFv9xZNeACY02dF8aMv1ag%3D%3D\"}]}\r\ncf-ray: 9c739791ff6d0b51-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":951028,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"efe865c5d8d03dc8fc5350007785fa80","sha1":"059cc9c27e1d73116cc1a4f5cbd5994cb5a9842e","sha256":"da34304956dfbbb3490b4a3abae3d8d255ddf9b25bbc9af95147791ba33a6bbc","sha512":"b6a30332c4f15cad0ed30691109c16b164eeecf05ec33a831314cb75ad1233c4d9b705ba0a977c818fc0d7ecb8bdeb00d4f09160238fe23e21eb61408a979435","ssdeep":"6144:7mEasan4z5saEBdsxr9dX/osonFF3fEBJzFUG8mu:zahOxJdczQUGw","tlshash":"b0154ac9dafe9ca5d6f340a44c4f3392b4ec750fbdcc6588eddc5a2882d6563830a54a","first_seen":"2026-02-01T01:52:12.678408Z","last_seen":"2026-02-01T18:43:31.071488Z","times_seen":2,"resource_available":false,"data":null}},"time_used":520,"timings":{"blocked":49,"dns":30,"connect":1,"send":0,"wait":419,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/icon/ins.svg","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.471Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/icon/ins.svg HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-oss-request-id: 69786D17E3972036310D5065\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Rtk0f%2F3q71P0ww4wuDTvGLAvIrX1VUgsl5kqmKtjCFQkZQoqVp6ea%2FH%2FfhLngvo8UV%2Bx5pzOairHAfAXHAJetMIbzctOJHKwTBU7Z0BVrbaD\"}]}\r\nvary: accept-encoding\r\nlast-modified: Tue, 04 Nov 2025 03:06:57 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 3282498400672204268\r\nx-oss-storage-class: Standard\r\ncontent-md5: 8Ttw8waeMx5RcD7AUcuAvQ==\r\nx-oss-server-time: 40\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\netag: W/\"F13B70F3069E331E51703EC051CB80BD\"\r\ncontent-encoding: br\r\ncf-ray: 9c7397950e8e49c5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8789,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f13b70f3069e331e51703ec051cb80bd","sha1":"21d5d5ef6b23424047157003034ea8c4f7f0e471","sha256":"3250de996d6b0e19ca81a1192ed894e197cebae2dc041d642183a4b077dc3893","sha512":"c2acfcfd0e5fa3aa7d1d615f15b754ec06f0823da5ab83946dba9857ed6163c809a017abea18e1121d915e0601a40eb00a106fe1d1342ce0c4fdfde8a05f5361","ssdeep":"192:iK4LhcK4LhtK4LhOK4Lh3Dv0B0sm8OvKrt6u:idWd3dEd9o0shdUu","tlshash":"f502a7e083b5c3e0f407eb4ccd779c342b4619f67e82e18a47b19e96c26248d0a58dd3","first_seen":"2026-02-01T01:52:12.669348Z","last_seen":"2026-04-05T21:02:23.507305Z","times_seen":3,"resource_available":false,"data":null}},"time_used":386,"timings":{"blocked":90,"dns":59,"connect":3,"send":0,"wait":206,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/footer6--t4tDeKU.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.972Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/footer6--t4tDeKU.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-6a39\"\r\nexpires: Tue, 03 Mar 2026 01:51:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0TTvrvEbfxr7ItWx89jBJfqKNwuQof1LlWzNEO2BN6MK%2BqPiQ59GMRWUpIB2a4Vqi1CysXLTWz61hvsqX6lEaGCHQBtPRKkDMOLl6SP2\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397977ac60b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":27193,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 450 x 186, 8-bit/color RGBA, non-interlaced","md5":"738d5d625c23d92d7d7503d519ca23c7","sha1":"fd260c93899b851cd72b3524054941ffa74d48ad","sha256":"a9ee43d225766f5fc8c9c013bd7a06a6805d8be8ca4cb66fca77d59c6da0e149","sha512":"da4df9cc9984d745769d2425bb16570f4803a8f602978d4e3b7b81a8fee365a9714afb4f4bafff09931e7d4c696c756cc136fd6dd03ca198d910f24a304b2aea","ssdeep":"384:6l9rXaAZml7lykwAdX5lAYzm25xH6EUXSAGi1nZAnDTzSc5F8ytvr6i7IHKahnC:6xIsOJl/m25xHbAXOzSc5FbB7I1C","tlshash":"26c2d1d03654e9c7dfc6f11b1af0e4285f3a91a0a0e22114bfea9707352303e5e76a53","first_seen":"2025-10-11T10:32:16.877306Z","last_seen":"2026-07-13T04:35:34.955444Z","times_seen":9,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/activity/oi365gemini/proxy-gift.webp","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.145Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/activity/oi365gemini/proxy-gift.webp HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 37764\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 697B6D9372F1BC3238DBF361\r\naccept-ranges: bytes\r\netag: \"A6351E09F3862B9619EB75A90FFF1877\"\r\nlast-modified: Thu, 08 Jan 2026 06:25:16 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 16474726540910048633\r\nx-oss-storage-class: Standard\r\ncontent-md5: pjUeCfOGK5YZ63WpD/8Ydw==\r\nx-oss-server-time: 13\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aoMDbry%2BvNhygMhkfRBTLuDDAJ%2BISXSFg0xNqWzlj9HgbfXGZCQO5cOudi1ehPylYx5mcP2TjtnZo8SESs5Z0T7SP8g%2FUCCxFa9OgQGClA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c739798aed1b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":37764,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a6351e09f3862b9619eb75a90fff1877","sha1":"29a88613fa1677f414e0ade704c2de7ec85d0319","sha256":"54ad0b6ec327dbf8c9436351e8c5d7f89fab727f11b29780208b44284e58995e","sha512":"d5ec2936d5668d4f7099877c8b79c94cdc3646eddb68984a4af880eef6d669f2ed8c7231b0312316f22b0f2129aa4ac66001e926948e96a00d3f344e12c18b88","ssdeep":"768:ETQ9cIbRATsQUGNrL91hQVpeeSms99wjzr7JdOya0Gu+bB8dfXjcoFXF:vHY6irxvQVpnSF/wjzrNoq4C7coFXF","tlshash":"4303f10850fe8755e0bff93519c32a1e778d0f026e6c89566bd1a78d28170ae2f0edb0","first_seen":"2026-02-01T01:52:12.559444Z","last_seen":"2026-02-01T18:43:31.076866Z","times_seen":2,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":159,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/pg_5/PG1695365.jpg","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.226Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/pg_5/PG1695365.jpg HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 120308\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 69354B0C7D083B32368548EA\r\naccept-ranges: bytes\r\netag: \"A1598CA821A363CD98BE89C69B7BF97C\"\r\nlast-modified: Fri, 22 Aug 2025 11:05:35 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 14448308905453959484\r\nx-oss-storage-class: Standard\r\ncontent-md5: oVmMqCGjY82YvonGm3v5fA==\r\nx-oss-server-time: 19\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fPtbBjYOv6UsYdN8b1NrBlDe8E%2F0aIP2FFaSNjkGUl9jdatr%2BkI878bO9%2B1eFiq%2BscVnWDYU7eUWtjXZo0Hd5vD%2B%2B3DA7GM5zHqhI%2FSLTw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397993f7eb517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":120308,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 680x890, components 3","md5":"a1598ca821a363cd98be89c69b7bf97c","sha1":"04fe7ed31eda1d2033f60eebfb7ddda8d16dccb7","sha256":"2c339938eff1e8d330242e8100db49986ad56847cc173e13c0d07832f0bb8606","sha512":"22626c2780f06053e3aa1fcbac64451f25c0a4586e76290e2c4b007fdb6d5a7a61b9dde54b6f614f5995bc5bcf0b60cd2fdc1e0598dc81131d90522f440f7779","ssdeep":"3072:v+FJms+DJr4RXK7ofhhTcbH8BXVSegLBpRb5L/NmRsE:v+Fks+16XxhhT0H8RVSegLBb9NsP","tlshash":"73c312480b3cc3abe67778b923d7c4a85f1cc249a36eb84926fa57cc70510b7d359525","first_seen":"2026-02-01T01:52:12.695943Z","last_seen":"2026-02-01T18:43:31.078526Z","times_seen":2,"resource_available":false,"data":null}},"time_used":191,"timings":{"blocked":11,"dns":0,"connect":0,"send":0,"wait":175,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/themeVideo-Bh8MZ919.mp4","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.224Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/themeVideo-Bh8MZ919.mp4 HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 Partial Content\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 718729\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\netag: \"6969a620-af789\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-range: bytes 0-718728/718729\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jU2AkdtOpTbBRdU58%2Fyv03%2Fw6dMXKs3OJW%2BVKTqhR0%2B%2BzYX3zX9hUAF80iqhOTZ%2B4vsnYEZdhiDdMmvdU1nCWz4w%2Fm8w6B%2BkFYWDSnGl\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397993c640b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":718729,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"7b836b02d0b2089dc3b68b232b4ca806","sha1":"2d3ed6e6acd6f982db675d9647174eda6db86687","sha256":"e6036ec35104bffe2fbef3aeffb6bb0a6ffd7cc4d8935238f5cde11c68a0eea8","sha512":"36ec84ff9172e4973a1797264336371851d11c7a320e45f4e60f23c893612d9ce43d053331f1a729cea7c351546c1d973d1d954fad1c7cd1a46bd1d9bd24a04c","ssdeep":"12288:3gZMofvNgPEEB1wRki4bCHwHfgbeY6/O+yu4jADe2Y0O7WC+rWkyDeFAr:wpfvBBRt4bCH5by2wOVgWJ20","tlshash":"65e423645fd4e398c343dcfeb4d623c5b276a4b71a0ce5dc276aa28121824f89c975ce","first_seen":"2026-02-01T01:52:12.612343Z","last_seen":"2026-02-01T18:43:31.08012Z","times_seen":2,"resource_available":false,"data":null}},"time_used":682,"timings":{"blocked":12,"dns":0,"connect":0,"send":0,"wait":587,"receive":83,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/na_Promova-DmyySfX4.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.985Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/na_Promova-DmyySfX4.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-6e7c\"\r\nexpires: Tue, 03 Mar 2026 01:51:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uKvil%2BEXTYa%2BeUkTUE6gfL2%2Fg50Ixq3MgK2unCmHuZUDa7rZbmilqwFjd24CKj0jrA4fyzdD2pBRfesIB8X7wBABQzHov4gm7ViLLv0w\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397915ca70b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28284,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 170 x 110, 8-bit/color RGBA, non-interlaced","md5":"774f1545e25e427dfc18a2827e7e2b02","sha1":"3bfbb4679ef4df3875ccd0ed9bafdb85abbcbfde","sha256":"4527beb1da7cf7d767a68ff3f5d65d396742df436a1e34c46b6e93e75d0535ea","sha512":"3828bfd8bd028c1dc906a2ac55e61914f8744dde0b0091ee8d8e13b1d6a08c11cd97497728b66aec60a489a44ffe586ba0beb250d2e033e8993f25a949574eda","ssdeep":"768:VhBaGHCpaR287HT158SUP87kOFqMeAFo4seb8:bcOHT15Y8VPDlseb8","tlshash":"4cc2f15f3b341e2f85dbb7e52735e625bbaa003f86c5624393550a3ec00a5a574f7053","first_seen":"2026-02-01T01:52:12.616552Z","last_seen":"2026-04-05T21:02:23.435107Z","times_seen":3,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"accounts.google.com/gsi/style","fqdn":"accounts.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"74.125.205.84","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.611Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"accounts.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:38:48 GMT","end":"Mon, 06 Apr 2026 08:38:47 GMT"},"fingerprint":{"sha1":"E4:C0:5D:A5:66:E2:46:B4:2F:03:75:21:49:F7:F9:8D:CF:C9:58:65","sha256":"F0:D5:B4:51:99:C0:CA:94:30:60:81:61:A0:46:DD:77:A8:77:6D:94:6C:E8:6C:A0:2F:6D:03:CB:36:2E:96:88"}}},"request":{"raw":"GET /gsi/style HTTP/1.1\r\nHost: accounts.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nexpires: Sun, 01 Feb 2026 18:43:01 GMT\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"coop_dd7de8473bddc59c6b748810a67a39b1\"\r\ncontent-security-policy: script-src 'nonce-43i10Gpv8UZ3aFGcMhVt8g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http\r\nreport-to: {\"group\":\"coop_dd7de8473bddc59c6b748810a67a39b1\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1\"}]}\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":696,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (696), with no line terminators","md5":"ee570cebd6ae40b9567844b080aee1e9","sha1":"2b7b0ffcfe8aca40ced147fb7ce107010392d6b9","sha256":"d49e8f04be7ccbb69e87ae474ee50f6903b780451989e66d35ffc247a80510fe","sha512":"836c832111c285f7cb692c4eb62e2bca615017b6ab4af6920674f17df0ae1da040f7171208d5d312c3c43ed8ed7e49b653e7fce0948f24076d0548f7c8e8f25a","ssdeep":"","tlshash":"430197321aa2602eecb3ab3bf04a9d8c023aa117eeb705ccb59cca15c38d95874a5041","first_seen":"2025-10-22T21:08:41.081019Z","last_seen":"2026-08-10T08:52:04.83266Z","times_seen":81960,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/Pescaria-D8f-cTVR.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.891Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/Pescaria-D8f-cTVR.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-23fd\"\r\nexpires: Tue, 03 Mar 2026 01:51:43 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tKlbYHlzA82MNZd%2BrOCo7W1fk90ucV26uuEIvMmgUjOX505if%2Flauo8oQLQ7zC9EVb9LjGXsLTB08YUAmImLBbUfXDrgnBDP21xEAI0i\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397971a500b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9213,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 76, 8-bit/color RGBA, non-interlaced","md5":"e24d0013b4f95d14e6436939d4493735","sha1":"a29ec1f2ac0d8eef88f8c6fe6769266a7de4e5ec","sha256":"75f774d009808ea57b6e3768dfb214b44a1db1cd8229e4d7fa9f4db8703230c6","sha512":"3a50441bf32b711b02cf751d08386a8ba5cf426cfa4d8cb59095f78ba900575f556506eaab6511fe6efc5c9bbbde7363cec7106bf8dc5325e051289321003125","ssdeep":"192:QS+HJxOdW0MGoCJQmBqQehFM3/VYZenq37qFTufJi27Ce22c+Sj5aHdDv8cQ:3+HfOECJ/EQVYZeCyTMb7CV2c+Sj5qJQ","tlshash":"1812cf088e800ab2ef3e61bbb409533f9cf7460772a706750c681479f5586187bbee95","first_seen":"2026-02-01T01:52:12.569425Z","last_seen":"2026-04-05T21:02:23.504856Z","times_seen":3,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/Slots-CtY5niFS.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.888Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/Slots-CtY5niFS.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-2616\"\r\nexpires: Tue, 03 Mar 2026 01:51:43 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=thANGO%2BWhEzU%2BPgnWdx9OcNucArSzmMJrjDaN2zDT7lajuwX50uJ1xF02VHnzRKVVn8eBsU7S3AfKs%2FsCrtcKpKMkXFamhINDSguYCWF\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397970a4a0b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9750,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 76, 8-bit/color RGBA, non-interlaced","md5":"68e9631b714b8da1d800f370a34e131e","sha1":"d536765aa18f0b59b10e78cd6d040d0428758a43","sha256":"c4c8df7646f72c70379a8d23386ae329890a1c66c99b5038080eaae0cdaada55","sha512":"2ab9ed5aad751a5c6721fecf4b3d29d3f3f0802fe2667266b7085cade2ab52fb3a6d44a6ead0d75f9699fe7010d1a84928f892b3e1c0edf42769b6345e9fbdd1","ssdeep":"192:QSUzc6Y+BAYxoi+FWflVyzEPz7g9Nyzbv7wk/lJA4O/J:3UzcJUxy0ffYEY9IL77t7Oh","tlshash":"1c12c0f60ccef878eed25364564f1b1924bd331bed919e725a8db9510d0e13ae700b40","first_seen":"2026-02-01T01:52:12.688078Z","last_seen":"2026-04-05T21:02:23.498351Z","times_seen":3,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/footer3-CWRuWrWW.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.966Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/footer3-CWRuWrWW.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-7418\"\r\nexpires: Tue, 03 Mar 2026 01:51:43 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cgFp4uqNaHkukEq7LasSCj%2B5nbGMrB38OQ%2FOVnDONLiXs%2BmkP7WG0xy4PEQdslQoUFBZtlx3BbceG49snzUjht8YUy7fWMZKyi7NlpcC\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397977ab80b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29720,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 450 x 186, 8-bit/color RGBA, non-interlaced","md5":"140b8ae62012debf5618e7771a2f433a","sha1":"3b61cb36f02c6f405ac7ccef604a285ed3ed1a16","sha256":"21d2b13555458e209a5430c0f0d3e06eb554d14927f951b3c1f3c7a14001a8b7","sha512":"f5a5ddb892c7422118b446bc439990c00bf95eae34993d266d3ebf538f642d2067ae2d614f67717f6b90f351886f596d1e0678f3fa4b91585c253e6930d6e16f","ssdeep":"768:XKW7KuSWCjGm9GzbjT0DF6GJkLl1EjiEMXt+/O:hfIUbkjJ21EjitdOO","tlshash":"e8d2e05d84d8ce734cefd4ebda8581a2720c437f4e63252a72a141f6dc913d0c9a86ba","first_seen":"2025-10-11T10:32:16.834117Z","last_seen":"2026-07-23T14:14:22.570902Z","times_seen":7,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/footer8-8C9pCVdC.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.980Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/footer8-8C9pCVdC.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-9952\"\r\nexpires: Tue, 03 Mar 2026 01:51:43 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=St%2BkCyLHFRBdz3vPsdHXpPhGwtASzl%2BS94NGi1PToBA%2BRXCaBox%2BMQgr6JzPfOBMRRp7jObt1mSus6uM6kMIwO1qOckLm9tSc7tCe4Hk\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397978ad00b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":39250,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 450 x 186, 8-bit/color RGBA, non-interlaced","md5":"6f35e63cff8d6dd35b8efb07a8a92639","sha1":"48a5336c241433be9966fe0c814c13429507d302","sha256":"b95f4ed8d8d642adf85dc999266488dc91e15fb376c61ab32704bbf179c3e2ca","sha512":"dca18448c147b41d276047ca4c25f9eb4971a303c53fc1dde2f1de4c96eb8e91851d2d5e8629fea9aa09914b1f47b3753acf2468a408a634b8f9d564bd5ef1cc","ssdeep":"768:Cv/hVYZuE7uz00YBvwlLUv6ft301rK7yhIaIDbnjBt6nhs/ut7oUltZKJ:iPauECvYqlm6fN09wmIhbnjBt6n75zgJ","tlshash":"780302293d2f3c8868cf240a68ed53a85e977c8b5c54739f0df799c8088153927e0ed9","first_seen":"2025-10-11T10:32:16.827426Z","last_seen":"2026-07-13T04:35:34.967506Z","times_seen":9,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/uploads/2026/01/15/54c6bec819261015930fb39792849ccb.webp","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.041Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/uploads/2026/01/15/54c6bec819261015930fb39792849ccb.webp HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 101890\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 696956A59A1B3E33374486E9\r\naccept-ranges: bytes\r\netag: \"09772CECDC2B80BD673E19412265099A\"\r\nlast-modified: Thu, 15 Jan 2026 21:05:40 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 7684462935601663984\r\nx-oss-storage-class: Standard\r\ncontent-md5: CXcs7NwrgL1nPhlBImUJmg==\r\nx-oss-server-time: 4\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nQvcLlDwsV5rqXf7SIC%2BslABbI307cS%2FHLflww8tqfCtGV2QqPJ%2BPmRUnmz00J9h1GYRBtbNhiX50KwzIhK0rbbnrWYJCCcCZOmDg783bQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c739797fddab517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":101890,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"09772cecdc2b80bd673e19412265099a","sha1":"e0bf12ac109ae0fac4fa4220167e4e53f1348f7f","sha256":"64c16fa54eb4553f578624e84838ab6462c1291ec899b76008ea791d9088ad0d","sha512":"3a4be65fac2766437e42935f568b5599192cd04978d0314725fc10351e51936688b43828f23442f9434797fbb1885d4177414b9adcaa4702ac3a7f296387923e","ssdeep":"1536:mUan3CqtL6LWmRUnS54SVGM5gbOoampbMG240c1BEe71hs1XvuvSbq0Sc1i9:mHxtLgWmRUuJebbbN2rUyMO9mvSbXo","tlshash":"4ca312baf57975c0993542fde0f1e20b360a3d4722f3fd996846b88aa779cd1090e358","first_seen":"2026-02-01T01:52:12.603498Z","last_seen":"2026-04-05T21:02:23.500407Z","times_seen":3,"resource_available":false,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":125,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/pg_5/PG1727711.jpg","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.373Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/pg_5/PG1727711.jpg HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 80630\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 693FB8438B23C132301C9694\r\naccept-ranges: bytes\r\netag: \"50160055278298A40E1A3E4C0C202A9A\"\r\nlast-modified: Fri, 22 Aug 2025 11:05:36 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 8514245663181885114\r\nx-oss-storage-class: Standard\r\ncontent-md5: UBYAVSeCmKQOGj5MDCAqmg==\r\nx-oss-server-time: 56\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=h2hUG1LxnwRv3NMXHcw1R%2BeG9R58OlJoShB0or4cfp1sjHHBVK4ehOkqp9hClenCNd5H5vz58haZ4qAQU3ccr2E78Q1RLb32XEzBSMRvlg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73979a08b4b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":80630,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 680x890, components 3","md5":"50160055278298a40e1a3e4c0c202a9a","sha1":"a5c56b8dca6a88cb0f231db32c00a31b5d24ec03","sha256":"3baf105b80f3d097da245a1be3d52a4d4c8826e988933d3c9dce88f8aff0f5ff","sha512":"087a102760eb003c73cdb18139b51ba9c1db7005cd764aea5ffb228c79861d240ed1d561cd71cc86eee17782a8422fef1af296beab1cd3e544510d40f37d572f","ssdeep":"1536:4LTFmlkt426KQsgmWN+ONoGYBYdoKK2RcWQ2KHu2Nc3H5X/TOVHxPK95PjHgnspV:4LTFekO2MsANjCBYdoKxcT2K5S3ZvTO6","tlshash":"e473123e95b52c905028f42dbd82cfd90641fdb561689f9a848b0f62ef3b2c71b1c292","first_seen":"2026-02-01T01:52:12.606859Z","last_seen":"2026-02-01T18:43:31.090933Z","times_seen":2,"resource_available":false,"data":null}},"time_used":136,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":134,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/h5_loading-Ci3D-mH1.webp","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:00.435Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/h5_loading-Ci3D-mH1.webp HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: image/webp\r\ncontent-length: 81654\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\netag: \"6969a620-13ef6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7KUqVNgyUZAb1o%2F8Hx4DovazYKgFF%2B3gxpyWA5qkYjXFycZeOerLSI6PEEIomSvV6n2gbOq%2Bl7c55BVDK9nkzzhIfcpn1Bd60%2B7GyPgq\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c739787bc150b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":81654,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7d6b3ed479db563e67c62610836ea0b4","sha1":"054db3b8b9e5fe2b5112c8a31ba83c62d8252f36","sha256":"fb00817a718aa8ce1df4b7985e61c2a99eeacee04507cb98bf0737aeedd98f5e","sha512":"73912a0783e306c22b5964617e3a56c3e4b6d109f562b81346e5079c0ea8ae8d7e5ad90bc5144927469469f05ed6b0980c3a757c187195b0911946f137c78326","ssdeep":"1536:3xOz7qa3WgaIC1WHQEq/3VdIiWikxsFDl5fLIEydEsQBUOquesPs0lggQ:hOz7qqha3qQEadMieqD3AmWOJlggQ","tlshash":"4a83026e65084407c9bd11fa245279133afae5386cc682551e81eed4abf0781affd23b","first_seen":"2026-02-01T01:52:12.598647Z","last_seen":"2026-02-01T18:43:31.092466Z","times_seen":2,"resource_available":false,"data":null}},"time_used":580,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":575,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/tg4-Cg3j-mvG.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.675Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/tg4-Cg3j-mvG.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/assets/index-C7z3N1dQ.js\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Mon, 02 Feb 2026 06:43:00 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\nage: 0\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Myk8eytOwiPNRS%2FopsZzzQQnE6%2BB7UPjVwKdX%2FYTDan3RhyfDrT2efKlK%2FyxmS25zysztsvSMYxUdE3Tx3HcHG7nyeUlJ51%2FyI%2B9tkSu\"}]}\r\netag: W/\"6969a620-2e\"\r\ncontent-encoding: br\r\ncf-ray: 9c73978f7ad40b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":46,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"f151fad49277f1cdd825fe2a08725f21","sha1":"93de407efdd35a63f8b5f90e38fc128ab543b61a","sha256":"b2255faec2db9723bb5a63461da1747ac34eeaacf9edfad6e26672923370ec08","sha512":"41d1dd8fae51b1d2213b9bcad732cd16108e2bae03e4697a850a2d10e05c710583de5827c9ff7067d821b6f1ff6dc0d8ef2dbf4028de276a441c3b2c5db5b119","ssdeep":"","tlshash":"d59004031440050101147170d373d457031117c4f35d4775c054510df057c544305d30","first_seen":"2026-02-01T01:52:12.583622Z","last_seen":"2026-04-05T21:02:23.450519Z","times_seen":3,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/na_Eventos-Bffdm8Z6.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.984Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/na_Eventos-Bffdm8Z6.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-65da\"\r\nexpires: Tue, 03 Mar 2026 01:51:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hnzaAEnT7VQBEQxYQdgFf1DOZEzAFAHI19%2BBWHPaOnFk7vpSWujoFyE0LYPhWjpv%2FS1ljuuzb0QaEdwcMfWgNaVwp0MeznX3WZV3F7JT\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397915ca60b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26074,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 170 x 110, 8-bit/color RGBA, non-interlaced","md5":"733025166c96692f671eae3889751c55","sha1":"5286f989845c3a3f10a9ad59e44b2209708fafe3","sha256":"11469ec1f2ac128c31c4b506919c3af2533a0f8ddf23266243cddbf715947701","sha512":"a46c444bc4d973338f687c294cdc0e36396762434d65e01f066cd60b399e35db20fdd25df3b67e9beda1301bead8bd35b1b299ac1ba1ab9a4a3197d31fb14f9f","ssdeep":"384:DuuDKs15zfzEUzmwGTMQebOLRxip5KWG+xkKycLJle8fUnAeBlp5MDsyTE38759M:TK45zYUmqFKz+xC42A8MPTE3Y/PS2U","tlshash":"52c2e1e938c0b695de4eae254a078527e484f3ef75716a9f4b27a71304a0f5bc29c128","first_seen":"2025-10-18T02:18:36.624996Z","last_seen":"2026-04-05T21:02:23.441343Z","times_seen":4,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/uploads/2026/01/15/52d1fbad71d2812e47b718d339de18fb.jpg","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.045Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/uploads/2026/01/15/52d1fbad71d2812e47b718d339de18fb.jpg HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 212967\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 6978B7626ED6A3323144E6D3\r\naccept-ranges: bytes\r\netag: \"A1911037A590B2BBC4938C2CD7E195C5\"\r\nlast-modified: Thu, 15 Jan 2026 21:10:56 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 17549600939990439226\r\nx-oss-storage-class: Standard\r\ncontent-md5: oZEQN6WQsrvEk4ws1+GVxQ==\r\nx-oss-server-time: 22\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3jP3HOwVsUeLpkrVJsI%2FLt0qrqWrsnn7xLPrCLDzf8%2FDfF497YKGdjzpj1zj94tMTVVzvma%2FXacrfTjOaRc699QlAA03afQ1TRfk11k5lg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c739797fdeab517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":212967,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 750x1334, components 3","md5":"a1911037a590b2bbc4938c2cd7e195c5","sha1":"243b1dd1258a6c7ebc85f9ce6def893feec8b7c6","sha256":"c1ec89e1674b23d48a04c049d90901213e6eea0b8046b14beb8fb0b785b3f608","sha512":"fa10b7051055610a307ffeaa577e5ccddb61a3bdcc736155d3723ac4cd6df9bd95b8f7f718ae86ed30f31baf47b91b88703e291a06cc9076051642525d33e126","ssdeep":"6144:BNIB4BEzttIPPwN6A1M8SAneVWlH35qg55:kwDGvllX5qg55","tlshash":"7d24236bf35392461b2037b8c29827def106d7a1d0632bda889df4117bfd4e1492c99a","first_seen":"2026-02-01T01:52:12.604746Z","last_seen":"2026-04-05T21:02:23.477911Z","times_seen":3,"resource_available":false,"data":null}},"time_used":221,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":200,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/activity/oi365gemini/rebate-2.webp","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.147Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/activity/oi365gemini/rebate-2.webp HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 52288\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 697CC747851C8433396DF8AC\r\naccept-ranges: bytes\r\netag: \"28B844069A2214439E54C44E06C3D777\"\r\nlast-modified: Thu, 08 Jan 2026 06:25:12 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 15769897394398485107\r\nx-oss-storage-class: Standard\r\ncontent-md5: KLhEBpoiFEOeVMROBsPXdw==\r\nx-oss-server-time: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DmRTdHc8sfstdYDk3IJP1ZMFLS7GUgraJCYM%2BkCBZebS8n2HrX%2Be6bQKJp78o8A9XQ%2BuoMscJMlXF8z%2FqTEocCUQiulSw9%2BZCUedXXwpIQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c739798aed4b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":52288,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"28b844069a2214439e54c44e06c3d777","sha1":"782083ae7d0335ff5dd0817d3e7d9810c2c595c2","sha256":"dca4689a6ee2d4f0074a25b11f0eaf4de7786255e6da3bde9d130685922b8acd","sha512":"2d823ec47f1ae810916cf0e3356196bf93a3faac95ee2c02d37b5324bd3fa9453b22b5a143aafd2bfdfc6a75f843af85d7c8bb07fddca514d337cc4a950266bb","ssdeep":"1536:LXMZSwm0PSK17MkIn4WOS3COBeNKuOuOv/c:zxwpSK17DIn4SyOI8YOvE","tlshash":"bc330272c7c6bf41dc207db2248b62a351e033857a366a9d14d734b3c52d968bd5a43f","first_seen":"2026-02-01T01:52:12.605792Z","last_seen":"2026-02-01T18:43:31.098325Z","times_seen":2,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":155,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/activity/oi365gemini/first-code.webp","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.146Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/activity/oi365gemini/first-code.webp HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 43552\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 697CC747D01B2A31348005BF\r\naccept-ranges: bytes\r\netag: \"A7757B0CBF5E33695E0B7769A476EBAB\"\r\nlast-modified: Thu, 08 Jan 2026 06:25:15 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 1524649515539646069\r\nx-oss-storage-class: Standard\r\ncontent-md5: p3V7DL9eM2leC3dppHbrqw==\r\nx-oss-server-time: 41\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Lly7%2Fl7fVmEcPaDnjcD0hqdHAy8oz9SvYanTxP3UVITWV%2BNBiMIyu7bGcfqiTujN0xQV9Lync8VNsDheuZwYyB5V3249bTJTByfazTT9zg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c739798aed2b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":43552,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a7757b0cbf5e33695e0b7769a476ebab","sha1":"1c088538ee4c38fd57082386c3fa024da6567823","sha256":"6e55ea8a95ad209c5c77eb3de0ad1cebf1c4bb87ffd0a6f9e03c8f741fa6142f","sha512":"db65c5cb3d48ab5feb3a8cf32d0e669a31b19eb030225be140b8bbfda04344ba5f23b38ceb8a90f798564b65faed017b4c86e01ac6ddf47e3afb1317622336a4","ssdeep":"768:zTLySIM1bIi695HhXxdgMXRRFDkDu80ChYrUQDn5ITtmWLXf/2kUAh:uVWID5BXxdpDdTFLD5ITcWLPenAh","tlshash":"2013f16e0221a5e7eeca63f75e3292b1d07dc46f1277b202e301006b65996069ff93d5","first_seen":"2026-02-01T01:52:12.61153Z","last_seen":"2026-02-01T18:43:31.099697Z","times_seen":2,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":181,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/activity/oi365gemini/uni-code.webp","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:06.090Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/activity/oi365gemini/uni-code.webp HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:06 GMT\r\ncontent-type: image/webp\r\ncontent-length: 41396\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 697CD01142FE4C30377D6A3B\r\naccept-ranges: bytes\r\netag: \"1ADA4EF40441D795CE5E18B1294570F2\"\r\nlast-modified: Thu, 08 Jan 2026 06:25:14 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 3034338268486470725\r\nx-oss-storage-class: Standard\r\ncontent-md5: GtpO9ARB15XOXhixKUVw8g==\r\nx-oss-server-time: 29\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sGZw76v8bWGmVqAhl98alNHrc%2BpVdvIWyYmpU%2BGRgK125jhYkcqHvlFDkex1RhNknkyfHE%2BMyhaarISgtQPpyO%2BILyWGzfatSSGYJv08pA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397ab1e63b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":41396,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1ada4ef40441d795ce5e18b1294570f2","sha1":"eff2d98dc083f9ae14b54c77b6a7ccd7322af304","sha256":"581903a19f26aeeeb0241a76ec594bf7c019f2722ff50867921081d0ffe1b00c","sha512":"2a93282de500e294de7720e4e2c70de0cc5e59de21a115206bb7fc805869e4af19b2e7f90b547de69d3f813b1d224a26c3d4c8475db2a90bddf697407b40e78e","ssdeep":"768:6TVFo5arJJKm+sPkDSChf9Za6v1I3NPGkjT5IPCgcTU5AQohAjsANh:WCUdcmAeeL+3xGWccQ5XHISh","tlshash":"bf03f242b3b29914d6386b763af93941c9cf9e5e070ee68ed8ce617544f1a49528c340","first_seen":"2026-02-01T01:52:12.566662Z","last_seen":"2026-02-01T18:43:31.101056Z","times_seen":2,"resource_available":false,"data":null}},"time_used":127,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":124,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/footer4-CWvE69Fu.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.968Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/footer4-CWvE69Fu.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-8340\"\r\nexpires: Tue, 03 Mar 2026 01:51:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60680\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SAUvn06tu7seUEmpY0QH%2BMZ4WBG5%2FTwXB4w43NmOYeek7do2KAbwzhgnj%2FnGx5rllzlEcneF7%2Bagd4AO8tl2LvlKkmA%2BBu2PliKcU4Tu\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397977ab90b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33600,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 450 x 186, 8-bit/color RGBA, non-interlaced","md5":"25d0355f858c8e6b0013d15707c23deb","sha1":"ce0682bc6ba9b8c38522e4c966714f2ae221a49c","sha256":"25b323452e0a53bb0ae79f17525ce53adcb697c8cfb877e740297bf29b192d9b","sha512":"ea2e2f0175372e2e66c23e126ddbf3a2005751c6402121df81a2dd38d8ad1f2257890f56b7cca58b6541cb83b215f10bb82f7f2ce6cb7c0fc38724c083adf35b","ssdeep":"768:JA9KdxJRDEOY7Ey9CGnTUUWREWyurTWrG/Hu6QWBwxLgri:SqxJgsGTUXNT/Hu6QWaxL4i","tlshash":"fce2f1c795391cddeecf3c530ead96ca45a11cd4f698234732006b350ea5fe3a9a216d","first_seen":"2025-10-11T10:32:16.845918Z","last_seen":"2026-07-23T14:14:22.5534Z","times_seen":11,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/tg4-Cg3j-mvG.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:00.501Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/tg4-Cg3j-mvG.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://oi365-gemini.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Mon, 02 Feb 2026 06:43:00 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncf-cache-status: REVALIDATED\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZN%2B%2ByTxvIGXPFmVVMS2GbB%2B8%2Fnd%2FmDcnxwPZ9e9pqlm5QqeuxKE4Nro48sFGZovFyUOrYyla2DmLKlRapc%2FD1WUiBWPzspI0DRCP7xAe\"}]}\r\netag: W/\"6969a620-2e\"\r\ncontent-encoding: br\r\ncf-ray: 9c7397881c780b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":46,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"f151fad49277f1cdd825fe2a08725f21","sha1":"93de407efdd35a63f8b5f90e38fc128ab543b61a","sha256":"b2255faec2db9723bb5a63461da1747ac34eeaacf9edfad6e26672923370ec08","sha512":"41d1dd8fae51b1d2213b9bcad732cd16108e2bae03e4697a850a2d10e05c710583de5827c9ff7067d821b6f1ff6dc0d8ef2dbf4028de276a441c3b2c5db5b119","ssdeep":"","tlshash":"d59004031440050101147170d373d457031117c4f35d4775c054510df057c544305d30","first_seen":"2026-02-01T01:52:12.583622Z","last_seen":"2026-04-05T21:02:23.450519Z","times_seen":3,"resource_available":true,"data":null}},"time_used":578,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":578,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/logo-CihcioOD.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:00.512Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/logo-CihcioOD.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://oi365-gemini.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Mon, 02 Feb 2026 06:43:01 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncf-cache-status: REVALIDATED\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nmZz%2BZFbK7swp71jyuC5CWTkdl41f4XoNtqsKEKcixWQ2zvmdIUGSLgHleY0NUE52jFy%2F%2FxecurBtWwXBjOiU2MhQgIdkPAEWNox7jEk\"}]}\r\netag: W/\"6969a620-34\"\r\ncontent-encoding: br\r\ncf-ray: 9c7397881c930b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":52,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"d5d71d8d1e5cfdc8e40b110222fb9fec","sha1":"48a00a1b89795f492abd91c6f4263b6cb133979a","sha256":"c072553c28432adf9b80f9999199525adc9e0f0248ee6d79a8fb5746dcb2f945","sha512":"eb6451bcfb271bb5a2cc4c08ed42917d8ffe0673c4d1f8dc10c76d56bff23bcfc87ea248e03e0ccdf76f36e88c2c801c7071b7a95ab212bad360e36d348d4049","ssdeep":"","tlshash":"7a90022acc0414a40098204851a394424015121c6167a29ec4555195a37158c8886c20","first_seen":"2026-02-01T01:52:12.704024Z","last_seen":"2026-02-01T18:43:31.05451Z","times_seen":2,"resource_available":true,"data":null}},"time_used":591,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":591,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/UserOutlined-Bcc9dr-u.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.687Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/UserOutlined-Bcc9dr-u.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/assets/index-C7z3N1dQ.js\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-5b2\"\r\nexpires: Mon, 02 Feb 2026 06:43:01 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0apDjpcAJ5FrkJP37j2sxRPSqonKKMUJKgLGr6aLZNP05oo0jFdfJKG691WI8JM80XFUL%2Bc2AvXxZHenkVvAveUhXw3KAVGOiXF%2F%2Bfs8\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73978f8ae80b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1458,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1457)","md5":"9d19913bf8d04f7687d77b457dbeb09b","sha1":"fdf85319f71decb0d4b86dd3352bb3db7a8fd73f","sha256":"88e9a9dc780f414abf4248aaccd4527a698247f86e096f639012eb5c111815b2","sha512":"782079c7e425a8c43bab7f9ad6f506e02381ed89d8d3be5ef610e79e4d14424cd28bea50a563bc421fa7d2bebcbba2e306079ee4303f4c622c3725880200e3df","ssdeep":"","tlshash":"523196596440b7fcbc89d2d8483b7500b04d143764e6be2cca62d8e081660dbd1fae4f","first_seen":"2026-02-01T01:52:12.684945Z","last_seen":"2026-02-01T18:43:31.052969Z","times_seen":2,"resource_available":true,"data":null}},"time_used":194,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":194,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/Apostas-BgfiQzaz.svg","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.970Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/Apostas-BgfiQzaz.svg HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: \"6969a620-121e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZTIY5n2YrpaxaFcZroomIo8m4sZp2s45OdnltQ%2FJNNbIvLPUAxXhsXaohHXyKsI1cwAxtqKtXfB7juITpKvivZSUR59b%2FWQaMExDvee4\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397914c950b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4638,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d80373811617fb0ded56f99770c15b22","sha1":"45cf86b8d42ebedee2d50a527b5a1f46bf57617f","sha256":"ab45fb6d1aa9a577f36ddae9cc597841b9e064dad93a1dbe7da7a95d333c1965","sha512":"9a53ef39d6cb1f9d7a230548852d079f86f9564921a1fe8e1976e0a97c32d18ec72012a9557e4e5aa5550b011d43ef2699cf37b90e6af75f7064b4d1f899a499","ssdeep":"96:XnuhvnOVdr+wFExw/ILZwdQ44inhPB0xrM3QiOgWrSCYKGIUJIaitkbo132ADqPO:unOvrdFSwgLZwRRBUMAiOgWGCLXk8cBO","tlshash":"02a131e5f3e6a2f0e887d3e09a205575ba8724fe6932c74c47b4aea5b60105e858cc90","first_seen":"2026-02-01T01:52:12.704843Z","last_seen":"2026-02-01T18:43:31.104176Z","times_seen":2,"resource_available":false,"data":null}},"time_used":578,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":578,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/tg3-D8KEkBPx.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.954Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/tg3-D8KEkBPx.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-2d1e\"\r\nexpires: Tue, 03 Mar 2026 01:51:43 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=O%2Fsl4126eBY4i7GxBNNk80G2n%2Bsks9GVUGXcwMC6wljPOhu8NFtrtA1jYTZfnWIbagdPQdzgx3dmwZF%2FvvmvkIQ6bcHlHhuqG5LJzPnO\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397976ab00b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11550,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced","md5":"01ddbdb1120c205584b5afceda29c4f1","sha1":"a6a63203951d1218a2fb69feed77de41647ca8f5","sha256":"0b8350455cbecf034f9ce3da80b71c6c718618c2de3408c9af89709724931119","sha512":"1354500374051d117b58902b7379e194be906f63742078ab95187133f86d839aae558fca19fc0e43f3fb4802169da7cf7a806980cff6a554d5e1dc56190b885b","ssdeep":"192:+ueG/BuB+d7BNiR4YAYmNTNnfdKleIfA7sBSSBZe3nkxuDmN1ABSf0GrPnOFuAF/:mG/oeYmNThfdkMSBZe3nksDmsMsGT+u+","tlshash":"0032c070cf08e904fcc9759312332a34c7aa592ab233ebb4d54d53e9969dd9e41c34b6","first_seen":"2023-11-19T03:15:38Z","last_seen":"2026-07-22T00:58:38.410776Z","times_seen":80,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/uploads/2026/01/20/1ed7efb7e99b404d483921b7830dfd7d.png","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.046Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/uploads/2026/01/20/1ed7efb7e99b404d483921b7830dfd7d.png HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/png\r\ncontent-length: 983376\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 696FA2BD7BD4BD3637524CF6\r\naccept-ranges: bytes\r\netag: \"06D77C7D86AE6038238B7B9D1AC4BDBF\"\r\nlast-modified: Tue, 20 Jan 2026 15:43:56 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 1847717398948346627\r\nx-oss-storage-class: Standard\r\ncontent-md5: Btd8fYauYDgji3udGsS9vw==\r\nx-oss-server-time: 9\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BNnfEG2LWkPaKKcz8yJ2tmJp%2B2%2Fb%2BZZnZRQrnwWUiV%2Fcy7ht72e5W5RawOgEXo3yJb08JaMrpKDKqwT1ldYMn3Mtsed0bx2lfDcakLNqeQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c739797fdf1b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":983376,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 750 x 750, 8-bit/color RGBA, non-interlaced","md5":"06d77c7d86ae6038238b7b9d1ac4bdbf","sha1":"2ef23647b315d2c5304e0b3478761a65a63097ea","sha256":"e088db7a9be0e875edab1d3af48ff826a4d1681442660a6f63bad8fe3c19354a","sha512":"117a81f4d8a364824051b5762d86ef96f16da1e1c0a5872e70eb2a557b304e46f2ca304f1601c92bea02b091c54cda7a71195009bfcb70ae14f76e3fe78fd155","ssdeep":"24576:5W/zUlxOMV/qNehJqAFF0huaOHYUdSLeCM71u46iaM4qYg:0wxOc/vq3DRJXXMx","tlshash":"092533b944a7803cf79b6f5fc0d1a1d060fb6d6cf9e8620a582ced705ba646f115af08","first_seen":"2026-02-01T01:52:12.7079Z","last_seen":"2026-04-05T21:02:23.436026Z","times_seen":3,"resource_available":false,"data":null}},"time_used":194,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":129,"receive":65,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"image.win7777.xyz/img/pg_5/PG1717688.jpg","fqdn":"image.win7777.xyz","domain":"win7777.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:03.376Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"win7777.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 17 Jan 2026 06:14:26 GMT","end":"Fri, 17 Apr 2026 07:13:14 GMT"},"fingerprint":{"sha1":"31:87:99:40:89:9F:E6:70:15:4B:69:38:2E:F0:7D:93:7D:F8:B3:B5","sha256":"DB:D9:0B:7A:28:C0:4C:07:CA:40:26:79:C4:D7:88:5A:23:F0:13:DE:95:C4:AA:95:35:37:8E:2B:E6:E6:28:FB"}}},"request":{"raw":"GET /img/pg_5/PG1717688.jpg HTTP/1.1\r\nHost: image.win7777.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:03 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 81499\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nx-oss-request-id: 6949FD1D91911B3931A15AB1\r\naccept-ranges: bytes\r\netag: \"8CE4F2510148FCEED5B3DA1E0BFD5640\"\r\nlast-modified: Fri, 22 Aug 2025 11:05:35 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 574379302006804812\r\nx-oss-storage-class: Standard\r\ncontent-md5: jOTyUQFI/O7Vs9oeC/1WQA==\r\nx-oss-server-time: 57\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SUaybvgOPg%2Bvipi5tTubrc3XvlZrGneYy0DDESLLIfXHOzXiTVpA5bkOJXva0XhLxTXTHSTbnJJGYyCTUcAzNLnJ6m2ULCnhxXxRMU5KGg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73979a08b7b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":81499,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 680x890, components 3","md5":"8ce4f2510148fceed5b3da1e0bfd5640","sha1":"628c55ce79a94ee8b05e86498000e5cef5746aee","sha256":"77de5603de05ce670a5f0bac4c8d9993986aa1e017ac97393d9e376a80bc23c8","sha512":"c597c0fcf413e795b9a91fd029b2916cd258985a3e319479d1a1441a57f576f6f828c745f190f21c9a0a0af49e3f432cdf64a92e9096ea9f02753a3df1ff0ba0","ssdeep":"1536:OqwKbjtiYUP6RcW91udmOyxHJHUNZmpFdyjoKncn8ciJeQhoYEY:2cjtsXgemfHJWZmzohnY/iJHF7","tlshash":"4783027282b81c1fc3a33711abc20cd127e6aa5bce75672735452f9a5c27b0315cbc46","first_seen":"2026-02-01T01:52:12.703175Z","last_seen":"2026-02-01T18:43:31.108321Z","times_seen":2,"resource_available":false,"data":null}},"time_used":138,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":136,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/fb-SFSBBuUD.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:00.502Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/fb-SFSBBuUD.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://oi365-gemini.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-eb1\"\r\nexpires: Mon, 02 Feb 2026 06:43:00 GMT\r\ncache-control: max-age=43200\r\nset-cookie: SITE_TOTAL_ID=4d9193a2d7cf5d0af2d48d52560c6684; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: BYPASS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7qbsPH4K6Z29JIiMT46LHNqPzARsUfR6rdzTrsvI0YY6R4O1mTWYaStXb0Ja1sUHNip9otjcVT%2FkO1jgAEeiFlYSpIlN8ghwVQzlSAzn\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397881c800b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3761,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (3760)","md5":"5e8b98db69b00956a17f4419fb1eac66","sha1":"40fcc641bc6737b513491355f99da8774f80a8a0","sha256":"9b858ea9056cade151793275c9facd054ea5bad137ae8468d099f12818feb5cd","sha512":"7e76efbdf1ccc2c391f22522e86b00a8fdd5375522c4cfd605fedbbd89b233f1f5c435cb7597be280282e8e995f07f7169d74d5056d6cdb19dbfb999ec4c4ecc","ssdeep":"","tlshash":"ab717db4a66a48e660fa2c87f2219511898f7b4fb108a160bcb5f0c18b50786df37a60","first_seen":"2026-02-01T01:52:12.58682Z","last_seen":"2026-04-05T21:02:23.40155Z","times_seen":3,"resource_available":true,"data":null}},"time_used":574,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":574,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/maintain-LTx9tNmU.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:00.516Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/maintain-LTx9tNmU.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://oi365-gemini.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-e4b\"\r\nexpires: Mon, 02 Feb 2026 06:43:00 GMT\r\ncache-control: max-age=43200\r\nset-cookie: SITE_TOTAL_ID=b9324c603d9a6f69502b6ce9fc48a052; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: BYPASS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bpBADEckRa7vbI%2FGf8CQz6PX8jc64izURne9jpeZtaM79UFpzWTdA4YoserzULXNgK%2B8X9esKu17QAd6MRJJ1Z%2FLizorVwLuS%2FZMzpMp\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397881c9d0b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3659,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (3658)","md5":"bfa0351a3eab3dfca6aa0df24d81c978","sha1":"c330cb53b42c0ff25f27eab435a8bf5f8599c490","sha256":"051baa130e2b3e6cddae99f47226d15c0d7dad9f6d43c89854efa965d2b6b75c","sha512":"f68e43c6e57f127d199c8cfb70b1548560eb99d5d86c204cbb6e4996429231af2334d481dc5cffe0479187f7d1d64932605574f896b58ebb9c4cd66df4063abc","ssdeep":"","tlshash":"387112fd4c041acdf838ca3b3a543b15e03326f9af6a488ddde27159d9b544429e893e","first_seen":"2026-02-01T01:52:12.608174Z","last_seen":"2026-04-05T21:02:23.389602Z","times_seen":3,"resource_available":true,"data":null}},"time_used":574,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":574,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/index-C7z3N1dQ.js","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:01.108Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/index-C7z3N1dQ.js HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/assets/index-Dw2UbQiz.js\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-25656\"\r\nexpires: Mon, 02 Feb 2026 06:43:01 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=X7uV2o8mev%2FORzVbmt6my4vKV5R64ITMGhuhx0iRbmGhNqFevLnudwPg3auMPt1%2F9eAWBON0qgFTZuLADu5rHw%2BlfQF6OIBxw2EqoQPY\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73978befe20b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":153174,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"57d8b99a62163ef391379a10819368f8","sha1":"15aeec2cb766bc9407f1f5c68b38e23afb62ad8b","sha256":"24256633d362b8ff35a6052609d30499d6ce8b2a5331e4f5dda9c684dbb0ef19","sha512":"d4e8dd48687dc1f3cf796c9e094fe8d278cc1825dc6abe5b1d187796eec55695b8796dcf530afe7ebf99070fc5a7e2c32eed4baa4e053764a967da1517c55d23","ssdeep":"1536:OryoY8S7PCM8ZJLbfFPefpSicXwzCGbBDzyFBlxvHG94WckhXiA6wwKk7/kEJ1SR:0m7uFPkawLyL5gk244y7+","tlshash":"5ee349adb124b96781f3899712614100b1750a9ef829c8e4f0f95d6b89bed1413eeff8","first_seen":"2026-02-01T01:52:12.614229Z","last_seen":"2026-02-01T18:43:31.025279Z","times_seen":2,"resource_available":true,"data":null}},"time_used":529,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":344,"receive":185,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/footer1-BojGPvEs.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.960Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/footer1-BojGPvEs.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-5118\"\r\nexpires: Tue, 03 Mar 2026 01:51:43 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pQEC1b4%2FEfyZ%2BAPRgEjbhY0Y6szSqOsmI6Y7LIn5j7t%2BKEVcHGROiWU%2BlKbiqOPu5QhR5mbJaEPmQuE7h4eAZuaI9mPU%2Fsrs79XXofm4\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397977ab50b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":20760,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 450 x 186, 8-bit/color RGBA, non-interlaced","md5":"1ae695c435e6456aee867beb60b70a80","sha1":"e5535c9c50657fb26d19c79f86e351a66e11260d","sha256":"bb34d46b363b0d204c5ca0926970514322e7f676dd85ff5d586cc84941a5415f","sha512":"df4de18bf97d7319f7f6c6a30c1ab08bd939c0150b0d9fc8c0ba1ae27a8fdeb32236f9c23b5596f0571fa8c31d7a70bb3ce4964cd1ac21b9683ae2ff8b39f487","ssdeep":"384:Kq76obVpEXlhJOe1NiPjaOU5RzSJOT0WHjnoo8HMlwsTfcst25JYOED:Kq79xpEV3Oe18PeOURzSJ63Hso8sFHtr","tlshash":"8b92b0c3c6f35b8b70ace8e2bb750c578e9d54134212f64a3a8f5af8525500a79c57c9","first_seen":"2025-10-11T10:32:16.8446Z","last_seen":"2026-07-23T14:14:22.542675Z","times_seen":11,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/history-HyHfE3Li.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.894Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/history-HyHfE3Li.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-1d35\"\r\nexpires: Tue, 03 Mar 2026 01:51:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60680\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vS%2BFj4%2BgceY1EWwi7BGHTOsWxf%2Bp5KG2aWYKoRsVLseswDafCgYHl17%2BoHR7h%2BSJbuVrcrcrDxZ6dsKOli9zgNU9BsX9Ipg8s%2BejwHp6\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397971a550b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7477,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 67, 8-bit/color RGBA, non-interlaced","md5":"5de8c6ca3c22093a8a6606cc6b851333","sha1":"6c4db71ab56628a5abad34fb562a34db687a2cbd","sha256":"9891ffe5b254f31f2277d17dd01368c83d1a6585e29e0014b664f7e21cca5f9a","sha512":"e9eeaa2af3f166bafa69de1787e14981cf54232def698bc2720ade9a67c74ba08bf03cfbbade6d8eb08bce3543a0ad7610ebe9e486f78bc0b37469fd2d90b888","ssdeep":"96:fSlZJWB7UVUAnuCjgBQzJBk693CydAmjkyd7vytrGLl/AF98SGNb+8SjCMoFasb:fSV07/AqB8JagHxp7vy2ZETETVb","tlshash":"d4f18ffafe60f7d404bdc142ea6f7d81d7970d104346f027a79aea64002b5a8a45b17a","first_seen":"2026-02-01T01:52:12.68299Z","last_seen":"2026-04-05T21:02:23.482272Z","times_seen":3,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/tg4-Bhe98j41.png","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:02.938Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/tg4-Bhe98j41.png HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed; g_state={\"i_l\":0,\"i_ll\":1769971381607,\"i_b\":\"naKDjZWZiBl23bnTvarKsom55whsMVto0Cw4pEXkpW8\",\"i_e\":{\"enable_itp_optimization\":0}}\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:02 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6969a620-19c7\"\r\nexpires: Tue, 03 Mar 2026 01:51:43 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 60679\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=e1oEH1sJAnf5ebXjQLp1%2BGG%2FFSwDhZwmsaHpt0EOWhAZ5x6ZzLYwJQb%2FoOEZ%2BZxCjRdwRFT%2BmLl83Hz5Lda1LK90w4MrVKEJnp4hY2S7\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397975aa70b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6599,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced","md5":"8d5951fda4c20a0dff5bfc99b97af980","sha1":"22e865417f1e9004fc51ff277956aeeaf4e61956","sha256":"fc1303342d77111393803f69b89ddf075189a8be81c25429dcec9a593fb804d8","sha512":"d7d555aabcb2f9cd98c79b83fc74eab24a0375f029ce9c68cee47f68c8614dfe7daeb51da2248b0c5f53c628b2d4f052935b2a3eee432a7dd958d66430cd4a04","ssdeep":"96:j2cD9txKFcA2zArqkab6QCZiUbWlblMvy6yftx9Wiwz8KcwPG+Ugk6GzWO1ccA5U:n+cAoAeksBSW32yjfgoKcltAG6RpvC","tlshash":"d7d1b00ef265a5407f107b502cb6e22c21ce1476e6e420d5b5dbc19f14cb281ed9ebed","first_seen":"2023-05-21T15:13:44Z","last_seen":"2026-07-19T23:30:45.785063Z","times_seen":138,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"oi365-gemini.com/assets/index-CLlpW1dz.css","fqdn":"oi365-gemini.com","domain":"oi365-gemini.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://oi365-gemini.com/","date":"2026-02-01T18:43:00.485Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oi365-gemini.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 08 Jan 2026 05:16:34 GMT","end":"Wed, 08 Apr 2026 06:14:15 GMT"},"fingerprint":{"sha1":"80:76:96:E6:C8:8F:4A:71:44:26:4C:87:6A:34:92:DE:34:05:91:2D","sha256":"53:29:C6:CD:E5:EF:23:97:0A:A4:2D:4A:FC:C8:BA:97:5E:35:EF:44:05:FE:A4:FC:AD:7E:EE:BD:56:E4:99:C4"}}},"request":{"raw":"GET /assets/index-CLlpW1dz.css HTTP/1.1\r\nHost: oi365-gemini.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oi365-gemini.com/\r\nCookie: SITE_TOTAL_ID=5414cbbea979d3e9c2fe37e3daeed8ed\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 01 Feb 2026 18:43:01 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Fri, 16 Jan 2026 02:44:48 GMT\r\nvary: Accept-Encoding\r\netag: \"6969a620-1cc6\"\r\nexpires: Mon, 02 Feb 2026 06:43:00 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: REVALIDATED\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KlWHA%2F2fRBSwVjjLd03rgCY1o3b9prcnrx4OhhUX%2FHlNckJZGGhXu6n8aslpIrjy9LnlCJFc5r598N%2BB8K5P3M6XNH1T9%2FTYG6c0RGo4\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7397880c660b61-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7366,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (7365)","md5":"6227f05e48d65d3d3bf09a23d8107b41","sha1":"6601acb7f6ee4f5fda72797025baa9f5cc8fa215","sha256":"9ac5fb088b5df709411606e84c3726dfd21dd272a0985dfab9ec888800799173","sha512":"a8558808841fc22330583a5fa147abec1c3a30d18fac2ae7e5127e9f56708b706a54ece4568015bbec6f4ee34d125e2f22f3456425cced8713f35e9533f3a927","ssdeep":"192:Owy9A8+nfR04ekrDuniggIKpD2A0K3EfNjg:OwEVC","tlshash":"cde1c43d345d12682f27da3158d4b388500be266c68537dc51c7fb1e8acb74639aee8e","first_seen":"2026-02-01T01:52:12.698596Z","last_seen":"2026-02-01T18:43:31.113466Z","times_seen":2,"resource_available":false,"data":null}},"time_used":577,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":577,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"oi365-gemini.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}