{"report_id":"adc801af-e852-4fd5-ae3b-ac314d34e0b3","version":6,"status":"done","tags":[],"date":"2025-11-01T02:05:37Z","url":{"schema":"http","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":0,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"title":"welcome-BET365","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":""}},"submit":{"url":{"schema":"http","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":0,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"tags":["openphish"],"meta":null,"user":{"country_code":"zz"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-12-06T02:05:37Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"openphish","sensor_type":"url","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz/","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com","meta":null}],"urlquery":null},"summary":[{"fqdn":"x78d.xyz","ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-10-23","domain_rank":0,"first_seen":"2025-10-31T13:58:59.721045Z","last_seen":"2025-10-31T13:58:59.721045Z","alert_count":333,"request_count":111,"received_data":13105898,"sent_data":56831,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"img.365live88.com","ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"domain_registered":"2022-08-16","domain_rank":0,"first_seen":"2022-08-16T10:26:51Z","last_seen":"2025-10-26T13:47:52.318951Z","alert_count":0,"request_count":25,"received_data":1094506,"sent_data":12175,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"img.esportsdata.cc","ip":{"addr":"104.26.3.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-06-01","domain_rank":0,"first_seen":"2023-07-06T16:47:53Z","last_seen":"2025-10-25T13:12:01.176933Z","alert_count":0,"request_count":4,"received_data":325840,"sent_data":1901,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-22T13:16:31.170257Z","times_seen":235572,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/65246.1756903329400.c090be2c.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"9695de283c01f0fadf4795c612b010e2","sha1":"9e9b20c41d8eac731f465f87713f570eee532180","sha256":"82d3d78a522caa25376deb145964490b699e6d2c976ae6cdad15f2c4e57cfc7e","sha512":"5f583070eebf753cebbbad1720360c270ec09391ef530c0efb982a92e03b1a10689136cbb74c005fa386f20111b32a602557c0fdf5e2d716062da09d942e2f6e","ssdeep":"1536:r2+iDvYvNjx4Uyao0L8oDNzAuMMsTAQ0mqt2pXYzA4dANV1:i+iDYvPo0L8oZzAuMMsTA7mqt9zA4dA1","tlshash":"c773a501f78272384fa7e290220f2026e16d191505ac5bd8f179ffb93ef4954aa7d7b4","size":73516,"data":"","first_seen":"2025-09-04T00:49:32.778143Z","last_seen":"2025-12-29T13:58:58.019409Z","times_seen":420,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-22T13:17:08.917606Z","times_seen":730438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/theme.config.a0ea1565.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"81c0ad2c8936f5f90cc4ba2b2e53366e","sha1":"8abbe251b908b7d81c73d8537d9d144d3ded3ff7","sha256":"61e7b259016e16c5f842da901c3b2f8202b73db878acb4366eccc217a4dc0b58","sha512":"f295e613097c68b8cb8d0a2530d07c3e883ffc75fdf6d0cd35c23040f1bb182401671c0f70781b64c97db7a37fe9d6d8163de658aef95ce9327ae0068afec7f8","ssdeep":"1536:D2JREob3mtlIRM4Sb2mc42mnzyJog9Cc0hM:qStlGu1pnz45HX","tlshash":"a1a3bb7ee20c963a6177a9bfb46ce111c12e9c0cab1d5fdef13e10a25710669c831de9","size":106213,"data":"","first_seen":"2025-09-04T00:49:32.985127Z","last_seen":"2025-12-29T13:58:58.024831Z","times_seen":440,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-22T13:16:31.170257Z","times_seen":235572,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-22T13:16:31.170257Z","times_seen":235572,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-22T13:17:08.917606Z","times_seen":730438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/index-a3dad144.1756903329400.268893b8.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e70d98f5d06556fb2df3ec9ecd519e37","sha1":"f15f33973e2498e949a62791b8fa6c7ff03c7a98","sha256":"7c6448354a71dab7081c1a9083e1ef15f7c59ff568fb924930620b4758169df2","sha512":"d225d0cca1709f789e457dd14df16ceda4bf4118d6c8f9db25bb9cbd5f30151e6b23d497ba51761a0eba97686323b0393dcfe43652e832dbaecc97b69bccf802","ssdeep":"6144:G4InKyBbhFOuyKO0VPoJBR58n3inyHpZolRlY1z9f7ZwTl0A+:izc90VPoJBR58n3inyHpH1z9ftM+","tlshash":"d7743b94f76cf1bd874e55be793290a4902c1b41b0c89d58d29e2944ff6b385eeb08bc","size":348653,"data":"","first_seen":"2025-09-04T00:49:32.964012Z","last_seen":"2025-12-29T13:58:57.98751Z","times_seen":435,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-22T13:17:08.917606Z","times_seen":730438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/configPage.js?v=9/3/2025,%2020:46:11","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e6aa74bb352ef198ba3e1c9a4b01b014","sha1":"2ea8bd6b5045475a36432f7665a129728e822d9e","sha256":"73828e873c0b6e847b37d78941ca436247471dfc90a12f743964f869f75abd5c","sha512":"2faaf24fdf1e4da637af8e9f82d1778bf061b00752dfca0c8f73432ba236a7b69410a7ad2a73727bc83e6cd631fd6555c3cc0d9d3a5d8a7f81818dd66566011f","ssdeep":"","tlshash":"be117aaf57444dffcf1d7e00a08b0a5ea8bc61d261889d4da8e9cf29e1c99002378978","size":949,"data":"","first_seen":"2025-09-04T00:49:32.949926Z","last_seen":"2026-07-22T12:19:11.25103Z","times_seen":2665,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-22T13:17:08.917606Z","times_seen":730438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-22T13:16:31.170257Z","times_seen":235572,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-22T13:16:31.170257Z","times_seen":235572,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/17600.1756903329400.89772027.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"537a1190cc025f0707bbb2a736630283","sha1":"1ac2e221c5e4e26737c6e1b7fddf2d363e4b65c3","sha256":"296f9d35557dc9588e8c6bed7134ca0e3055473306531756660582a6886bfedb","sha512":"3202114c8afb764ea0c4cd32bd78e7ad51295face85601b71b7316535d8fc29ecfb314bc1ace4ff0f54ef46a2016d09e764078ea1d7bd08ae75077ad6eab2341","ssdeep":"1536:+D5AxGst7xILpT0iiRs1vE/yKLJdLI065veGiHjLFIEfma5/xY8SbF9JiNp/QQbU:+DqxNfns1v4yKMpBesDz7+I1ou","tlshash":"d8e32a94b380717887a743b5b21f5196d22a08601098bca4f26eed94bf749ddf63ecdc","size":152171,"data":"","first_seen":"2025-09-04T00:49:32.979776Z","last_seen":"2025-12-29T13:58:58.065817Z","times_seen":421,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/64906.1756903329400.e9e9ec75.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"18789db02e1943b9b6e2a4bc1db4cc9e","sha1":"ab3db8b123be3580e4d5198c5ca7b99e0cd00d4a","sha256":"381bb6518856ad825c2e3fa1ec233fefa0ef52a11dd2a2dbca840381687dedb3","sha512":"6895a97c1c487d492779c4d0166bcdf0599a8634c8af8c051b573d84f001b730738eb8194f5edb5ca5eebff733289c293cd9889ea0b373330a3d9860cea872ca","ssdeep":"6144:9MhEyLkbLniyyeBHlBfb08rzZAncbtiTisXuLCoSltnIwb/mmtMDj0Rts:9MhEyLk3niyy0HlBfb08rFAncbtiTisY","tlshash":"3b241b94b690b17883bf85ff7224a164e24e1f9860cc9de4d26e2b407f12706b8775ed","size":217749,"data":"","first_seen":"2025-09-04T00:49:32.707517Z","last_seen":"2025-12-29T13:58:58.048456Z","times_seen":418,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-22T13:16:31.170257Z","times_seen":235572,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-22T13:17:08.917606Z","times_seen":730438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-22T13:16:31.170257Z","times_seen":235572,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/home.1756903329400.bfa8c420.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"caeef6f42deb46a855ccb60a2ed5b445","sha1":"13594059c305a13f3f001270017ab9aaa21443c2","sha256":"ede9bdf96f357afd7f61662fc1654334932bdf9d3e0ad7e9581a792bf2912530","sha512":"0f28cdf6693505cf9c674caa54a226cb16de87aead1b75244f3c6e68ee5d206b133b3e5f081aa9a1db2b285e8ac607f1a1a289401afb0b6404b3e2865d0d9d03","ssdeep":"3072:f1E8oNSIMrtwsAFJBuokQvFUqlGSBJZhxffj7TEOiGRA3:f1E8oNSIMrtwsANKUFHzffjAGa3","tlshash":"c3040880b5f0e275575fd2bbd7371024b22b1686d0ccac60e1f66b187e18799b236db8","size":186713,"data":"","first_seen":"2025-09-04T00:49:32.93504Z","last_seen":"2025-12-29T13:58:57.964054Z","times_seen":424,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-22T13:16:31.170257Z","times_seen":235572,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/52388.1756903329400.521cb32f.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"cdd31eb0b7ccfc1eafcead314123dfda","sha1":"2bd4708c1e30cebc08cdada8ef890baec6ef8622","sha256":"669b207d5cf11b0e229699f6e54104836b252c5398e20c4bb564b89b2525f0a2","sha512":"9c48059df23c4a9632eed22a28d883786e40c593fe3ffddb9144fbca21a45322121e36580084fc642e9058f086d3657d819f5d2b9528a91633aeb2085cd5ff06","ssdeep":"768:f9Vl3u/ffsp3aNWchZ4IIATAJ016fkmD19mprq2xd7QjDv1gyT8CpYCVc5WsNiU:8308O1cq2TlW0","tlshash":"84c20a80d6b4f5fd636ec9ab8a3a8464602637c5b0c8ace095ec6e8c3d4475774788fc","size":27418,"data":"","first_seen":"2025-08-29T11:05:53.257205Z","last_seen":"2025-12-29T13:58:57.988641Z","times_seen":422,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-22T13:16:31.170257Z","times_seen":235572,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/index-399e2569.1756903329400.c784c4ca.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"6117cdb5accd41ccb0125c70452306f1","sha1":"80f85cd8a495c476087fa382198b2a06f5d309ae","sha256":"794e522144c7d6885ba07f4654bbf62f0b06f1b985a897645092cdf029afcfea","sha512":"1737016527bd862c7804e4dd164e109c7f3a087b5c0a751764c22f8b2fa9a10f4fddb8f98234d4da33eaf7a314648d28eed89c0750dabf2006ee105b6f8a2cc8","ssdeep":"384:EZSANHLDaxKalO7PT/Wy4QfHhwrxrjgIhK47ZyQQvXTcdw5F3oWf0Af/nqxtU8X:HYDaxKUO7LZ4QvhwVEMKUZpe5FYxAfPQ","tlshash":"c6b2c6e63392bda4c24f9276f33a58ecc53f9241c30fc4f8d265bdd47da8644a992684","size":23421,"data":"","first_seen":"2025-09-04T00:49:32.717031Z","last_seen":"2025-12-29T13:58:58.089613Z","times_seen":434,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-22T13:17:08.917606Z","times_seen":730438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"9c81c3beaf90f98ca844465a7002e3f9","sha1":"6ddbbdc0cd6b49c92e369b53a70c0ce79e64e086","sha256":"36b56b4bb4fa9bad85b500d256518422d24b33749d33d98e70faae4026d27cd8","sha512":"a8a005f93401fd5cf3728852fff090519833c71539000aa3e63732878b6daf16ad01ae2a4eb5a1e1dae7afde4af219abbfdac27710c2d972d8a5640c56f2f71c","ssdeep":"","tlshash":"24217b195ee698211033703a1b5bf3443435c01b719dde013b5cc394af2896ba972ad5","size":1203,"data":"","first_seen":"2025-08-09T20:01:20.302285Z","last_seen":"2025-12-29T13:58:58.092967Z","times_seen":726,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"5281f83487c386b7836c0a61310eee71","sha1":"b69aa5eb7750fa2d18540f7a8f28dab10d4b2631","sha256":"5c4f27503b020517fa4d8a831ce6ea7c9b425cbda5603e8e6ce9119aa406cea4","sha512":"4d7ca7094121bc51fd7e24de7f2b9218624f1c7c2b5949e25ad2be53f4b1babc0ac6265a9e20acd2d51fec4e844baebdd7d1aa300a7f52f3b360bf36a8979ca2","ssdeep":"","tlshash":"5c8004047d5d50540000503014740c0d5c133c57403f0314340dcc013fd5c401447441","size":36,"data":"","first_seen":"2025-03-03T20:54:16.013922Z","last_seen":"2026-06-23T09:11:58.933356Z","times_seen":2969,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"49bea4e1330b9d3f17c1c143ce23cb3e","sha1":"3a8874032b5979ba1fadfe141c0ebf28baa32fc7","sha256":"07f2a8f457d336c5a0cb2267f53a4be2676d30140da225305675f4b3957eb68c","sha512":"9cf0ea9cec23fb496db40aae14fe1df1a305d4a847e23a724645052c742a5995250f9d7f3f0584d3226aa17c6af04201f72cf7fca01bf4c788df2ab4cf488ad0","ssdeep":"","tlshash":"b580040cdc5544570000501014500cc57c170417453f435f750c04451fd34700007c40","size":36,"data":"","first_seen":"2023-03-08T15:23:49Z","last_seen":"2026-06-23T09:11:58.930085Z","times_seen":3036,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/chunk-common.1756903329400.8e9f70b3.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"1b35e779a9012cf73988d1d4b0d9e5f2","sha1":"c139c75aed4b303657e5a48a1fb036d7fcec6533","sha256":"9231e7c73c53eeebd2a055dc9c7402342f21053dbbbdd257be62eaf29c98fafa","sha512":"53ab4c8aaf4fb2bd81c55c7356348b96d509ee4f2a91869043061c8b6ffac404ce76a6ca57caddd47e94dfa5e821a3e6a85c969cc94675fe8625cf44d689c05d","ssdeep":"1536:6ZVB2bNNcdWUc2UTC6oryXHuLmbErF/G7D1dMI5MHLui7TAN/voVG5glVbGD3tFZ:6ZVBM/TC6yjFecHLui7T4/voVG5agD3t","tlshash":"73f3e8c5b3a0f07e9a1ed53779331499b12f758274c87c60f1a1ada6bf19708a436ca8","size":159516,"data":"","first_seen":"2025-09-04T00:49:32.82259Z","last_seen":"2025-12-29T13:58:58.058135Z","times_seen":438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-22T13:17:08.917606Z","times_seen":730438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-22T13:16:31.170257Z","times_seen":235572,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"0ce02dcf11f1634908b4afc4e1bcc632","sha1":"f8911bd806c6ddd3daab7f3eba10081d7af38f74","sha256":"46c7be5f428c72dac25551dbcf74f494989a3cf773ff04f9e115e15ad7dc2893","sha512":"c4f56e0a143f096a106956d55a60f07405a2418d8eec9917a027d0ede74e7119884002051c598445519ff87ad5526d035c221bbcfc65ce817539e6162f157ac3","ssdeep":"","tlshash":"1901735d483748107b2225bd537f5045f1a2516f9e87cc103c1e5b00eff48a72591bd9","size":750,"data":"","first_seen":"2025-08-16T16:35:14.594808Z","last_seen":"2026-06-23T09:11:58.933867Z","times_seen":2561,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/45540.1756903329400.c33043f4.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"000be9e193b9b0e7a8e7e2fc6a908605","sha1":"1f04ee0d0816dcb4a310f1bf9053f36c15561922","sha256":"0968ff07195a9aad5c3f080a919c803c162ccb3bb176330b762c1e4e884e75d0","sha512":"d05ca2e4dbd262beab20be9f7872c1faf4d88129b59234fb2009c9ecc7114341558d7813d701cc5aa54dfa4ec028ab007eeff864ac6bed87a4ed8d42499954cf","ssdeep":"6144:rYD4wFsYiSGfKnCKPP6Xm9sm3MCln1OSgpozfEe5a:rYD4wFsYiSAKNH3TY5","tlshash":"2b24e894f294f1be075fc1f1d23b501af35b5e6120cc9ca0d296e6942e20b49da77eac","size":229352,"data":"","first_seen":"2025-09-04T00:49:32.837166Z","last_seen":"2025-12-29T13:58:58.015173Z","times_seen":439,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-22T13:16:31.170257Z","times_seen":235572,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-22T13:16:31.170257Z","times_seen":235572,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-22T13:16:31.170257Z","times_seen":235572,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/45734.1756903329400.46beea1c.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e5f34b5441b6b582d6d469c537f6f97a","sha1":"defd5aad4e0d066131c97173b21b7b3442cdb951","sha256":"44db08eec9e6d649f62d7d208bce223e33424ebc58c21098181a90ae5a1c6437","sha512":"4096ae8bc07709597c8411157950bea75aba46cee36964fe1e280a31a2c2c9d4a8d5821c3e8a4cca552919511930bc9f834e2054580c452acc17c1011d1e6168","ssdeep":"6144:F/EFTU8Ra90Jjytg7DiQPkcsz1h84faSDWidmVHrqZL:9y/jytgPJP484fa5VHryL","tlshash":"2a441c84b291f0b4879b42f7922b4055a17f48a130ccacb4e2a5ed90be7555c927fbfc","size":277026,"data":"","first_seen":"2025-09-04T00:49:32.926111Z","last_seen":"2025-12-29T13:58:58.062377Z","times_seen":438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-22T13:16:31.170257Z","times_seen":235572,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-22T13:16:31.170257Z","times_seen":235572,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"bc8a294899b949ca9677d96ab1c49745","sha1":"983c5ec164a83ee42e930da5b41946e6b0884dc6","sha256":"1f235d2a99775c3e5208abb2a05db1d9b6da61997a61ca5f7acb6ecb63caab29","sha512":"544b86acb0f595a5b12b887d5270444b63e23af877db68c8bce9ee5c66b37de75648eb9ea0757f899dba25f6376013beb278c9c8f801674f8886ae4368264e6f","ssdeep":"","tlshash":"4551b16d856684711db3346d2b5fb34835b340a36149de113d4d8f802f6895e82a6bea","size":2590,"data":"","first_seen":"2025-08-16T16:35:14.597318Z","last_seen":"2026-04-26T06:01:10.157524Z","times_seen":1785,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-22T13:17:08.917606Z","times_seen":730438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-22T13:17:08.917606Z","times_seen":730438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-22T13:16:31.170257Z","times_seen":235572,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-22T13:17:08.917606Z","times_seen":730438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/chunk-init.1756903329400.f53cb96a.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"daffbf99400a4f119f452d48a10ea62a","sha1":"0ae2d45d2befd0f11ae9373195c409f491a511d9","sha256":"1dcfbbb596d333e200aa1b0e4e282c296f29bfafdee19ff4014fad30a394ae45","sha512":"8e39ce35d7f18deb579cf03330a935e18308541617b1a265e4d7f88480b4d29608598e6d2be86328106fa64c4d707e608f333319bd1e7627df53a0170de079fa","ssdeep":"3072:etwqhOIKENB85doKa/x5wc0dB5/J+UUknCqdnr4QMA/C:HENm5ox2Br+2nCjXz","tlshash":"ea441b98b3d171b846cb53e5622b1035f6ba1ca33098e4f0d219ea547f3168dd52eeec","size":273064,"data":"","first_seen":"2025-09-04T00:49:32.986263Z","last_seen":"2025-12-29T13:58:58.044472Z","times_seen":443,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/13575.1756903329400.cda1d494.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"60a85822cef01147878bbad7876a1fe8","sha1":"94563a78fcb76c76cce769d2fc4021baf782c844","sha256":"5b0a33a268e1507f5e758833c854e3cda700d19c35357e4a2098263a80da8892","sha512":"c23f2184349d611d1c54c379a0aa29d9564ea4b76b44c049647f0caf9e5b9dfd809c87eb9fa94c58377df9a9540580d0920802784fe9f485380985f36eaa4a5b","ssdeep":"3072:z7jHoKRKphCnDgJoec+IDWIzls+7Xr0X7:sKRBgUPDWCW7","tlshash":"42141a84764170b8c396a165322f601ae22f789650dd9c24f3789ba47f7470df26fabc","size":194924,"data":"","first_seen":"2025-09-04T00:49:32.754298Z","last_seen":"2025-12-29T13:58:57.972807Z","times_seen":438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/31098.1756903329400.4108b3dd.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"215815c091a19829f9fd6e5f28039f0a","sha1":"8ff2707b0ab4498bfd2bb7f99674b5a245ecceee","sha256":"06371440853645a0532df5edbbfd5c9e9661bec969aabc25b3353297c6f6574a","sha512":"34933b0388cddca0826af79fdd0f82c31c1264e87f004cd921360b19dc83a0ff188ac52a4de89427cc1c09f2785179fdf4d0ff7526d4a74a55f7971fa2738e9c","ssdeep":"1536:Ow+0YvC9jlTKAUSseG1SY46DCdlBBo3AgXOG9AsqCfCXsvCfCXsLCfCXsyCfCXsf:O/KK5sY4brG7O3SnLJNpL","tlshash":"1574b6f4c248c6fdea04ce0a7e7d6f2d50723783f2ec96c446aaf8865e91857245c4da","size":352758,"data":"","first_seen":"2025-09-04T00:49:32.813984Z","last_seen":"2025-12-29T13:58:58.029423Z","times_seen":409,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"3d053d2da6a5968d7b648d3f7360092a","sha1":"32ae5713edeb00288a3f8f3c02462a5d0ca9dbb3","sha256":"8896d194e4c39e87f52924073dd2d56b4aaab46fc9f7c56a57534545eef1d7f3","sha512":"01f9b63cd24ab6e0e097637341b78cda657192f98e37a39f0f75548f8fe0180418a86594df76858aee7d514282ac4dfb8263e1729ff325035897b841d09206a3","ssdeep":"","tlshash":"82f0a00e0ee548131963707a4c0f9201203b2513414eea08bffe9bb24f92a688a679cc","size":550,"data":"","first_seen":"2025-03-03T20:54:16.018132Z","last_seen":"2026-06-23T09:11:58.931662Z","times_seen":3033,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-22T13:17:08.917606Z","times_seen":730438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/64369.1756903329400.27cb8135.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"ce99014ab42559bc99f808a69bf596c2","sha1":"adf52a59aba8080dae7b97585e346f5aa782141f","sha256":"39076e64a0e5facd6f6f3d4db7f7fa71039c87d4a6250298dd4bd3059bfd9863","sha512":"ede23f1e36658737f40782ab61a166f1a2a6f61957524beefc283035c39337325c487d6236975bd97cf44aa91b31ed6985a3416ef561edd5b977ff02fb6b1b54","ssdeep":"3072:cHW7tB4Vgj5tNlxyU5YegxYffj7TEOiG1Zl+DJVkzEcx1nKR:cHW7tBwgttXxyUtffjAG1T+DJVkzEcxE","tlshash":"6cf31bd4f2c070f6475f45f2a22b1075b26f4d92318c98b0e15ba6597f21a48c7abeec","size":158174,"data":"","first_seen":"2025-09-04T00:49:32.946075Z","last_seen":"2025-12-29T13:58:58.086406Z","times_seen":434,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/21954.1756903329400.57c97863.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e2c9f0777c63b333fc66af020ed0ef8e","sha1":"72714b7bdf899cc87c7399253e37aaa2a2f4487e","sha256":"0a2a1939d88947975b56974be20cb84a9c00f3c94cae6e057836b39aaf6b8c41","sha512":"fc02eb76f16f16c8a7346f72e7ac7ef4a68bca53cc7a5bb9f1e00b43f1bb002ca7847e2804be7d6bfe0713c3466210038acc4d5794bea5bec8f0190135f3e7e0","ssdeep":"768:DBPsaSfmzKrMdvf0eMQ/96loumY1PI1yBK9LudEz+yUy51y9y0yk6Dio+ILqpTeY:DP81R6Ipyk6o","tlshash":"0a132088fac2b06dd3eb7330857f505ae66a1dc0668c5438e260d6917e7198dc1fb9f8","size":41968,"data":"","first_seen":"2025-09-04T00:49:32.704767Z","last_seen":"2025-12-29T13:58:58.045079Z","times_seen":433,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-22T13:17:08.917606Z","times_seen":730438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"2558541837b83dea0f1c8ac757de88d1","sha1":"73dc5d3a5d36b0d2f64662712b98ed67d38fa7eb","sha256":"c39e91ac138a222cb7b8c2cdd75880822c57543218803e85847fbc402cd58aef","sha512":"6bc2837169d8c2a6fc06110969305fa31b87bbc31cc683d0e95ab2eec28606e623d1e07114f031e73419231c41bee11bd93dc8673f5b548a711aa28921fd9177","ssdeep":"192:KQFwqx5Cvtib5XOQRzlaECoXZTAoV51nsPhwzvBa/id3+36a/E/97g6I52MdobsN:K2VwiYwJvSoVXsp+pa/iZcVk97g6nMu6","tlshash":"1c322a69a6b71bba24673036277f301889b080630319fd957c0ff61e4fe54256297be3","size":11820,"data":"","first_seen":"2025-07-24T23:59:52.586926Z","last_seen":"2025-12-29T13:58:58.105973Z","times_seen":599,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-22T13:17:08.917606Z","times_seen":730438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-22T13:16:31.170257Z","times_seen":235572,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-22T13:17:08.917606Z","times_seen":730438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"37cda9c8bd90ed9eff421ef541ce8c9b","sha1":"10e30e7f37c9d3f9047b454674e5bbd39325c17f","sha256":"141be120131ffc192dd677c685472431beaa361d4dd03539f79d814cf1434cbd","sha512":"02044fab2c82a7e34f9c9cd65fec0c8f4dda3b52170d846bb908d40cbc34d719d33b1586be421dbdaf4085c442760a8f1f0db93a5e0a9d3ae7d38d5b8072d106","ssdeep":"","tlshash":"fa11cc5a59e28132aa5b302735bd43887728a023d144cf423dcca955bfa8da5cabf6c4","size":923,"data":"","first_seen":"2025-07-08T00:41:53.041569Z","last_seen":"2025-12-29T13:58:58.107019Z","times_seen":628,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/config/initGeetest4.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"4b773fe272ef2f3dc7c7e443cd8a0e98","sha1":"8f81f38f03c362533ba34d119215bf83b7574ed1","sha256":"9bb8b869af3ceacb9261dc2cb9165d2716b150bc35ba9da63dd23674fe0773b0","sha512":"e0539af0bc1ad92c1799b6f5c0c759a68537b8063730bd0577aec9f7cf620d34cd166bd5a15c25d89cad49d80f51938b6072c4aa27d07f010e6aaa83ce6e3c5d","ssdeep":"192:hN3ar8HuCDoNu5dq+ExNiqc4K25MB5VsaiQxta4SScQVy8QRHIqaawzjTki59r8Q:fJe61XHlii5aI2PG4lyUIVKQTwwPlB","tlshash":"2562200d68f750a35553b43c8b9f6014b5388a93041cde41be9ce394af9843d9bbabdc","size":14854,"data":"","first_seen":"2023-12-16T04:09:07Z","last_seen":"2026-07-06T04:48:18.66713Z","times_seen":2858,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-22T13:17:08.917606Z","times_seen":730438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-22T13:17:08.917606Z","times_seen":730438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/chunk-svg.1756903329400.5bf5ebac.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"7f3450cde65c4d0964dcc6d243a1656e","sha1":"ad5b362b491b71dff95398219d8e190c80650865","sha256":"924472178572d451953cbf73efcf577a697b3102176fc17d9ab8c379b6b37bee","sha512":"e8f2350a17821376b71a040626a3d5c58cf5744b22d512fbef45b3246558b0f7001ca4d48d32e34831ec7750e40008f7aef529b4e618c6770bb5e72e4c028cd2","ssdeep":"3072:38nz2uaLZSZvx6Q/sIPrekK+m36Ua94sRZI7gbpU:38nz2uasNxpXPrekK+m36UHsE4pU","tlshash":"7aa4fcb4c190f4edf704ce196e7c9e1c50321688e0a9e9e52da9fe0d9e85d6b241cdec","size":461002,"data":"","first_seen":"2025-09-04T00:49:32.781171Z","last_seen":"2025-12-29T13:58:58.073596Z","times_seen":441,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-22T13:17:08.917606Z","times_seen":730438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/home","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-22T13:40:58.60874Z","times_seen":89802,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"x78d.xyz/ecb/8f8306425fb46e096ba9db3ab31b67b681fbb31575ff397b0117","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:14.805Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /ecb/8f8306425fb46e096ba9db3ab31b67b681fbb31575ff397b0117 HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://x78d.xyz\r\nXign: FpbXsEin+i+tSiYDyV1OQt44vH1I0hWX7KWUe8GotqPGc9yIJUC5toEt+xR+JD5gBJG9JpVluFHrXIoMCgdFycCk/AAEE08S4AXAKwioc/rBYeb2JAUVJ37JGSxb4bfN9MLcZ61+UIEesLVuXUg/YULGo3lrIirlUDiPiAFVaXs=\r\ntimestamp: 1761962714778\r\nsign: 31929563a1m1c5lg\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: Kc3Md8YTTSx5jDErM6fkSDaKwC66eyT6\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:15 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Sat, 01 Nov 2025 02:15:15 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962715=rr8RSxjhoP257i6Bcaw8RAyhBBSN9LM0Zm++tGYblKe4lINKan0tJxjQ+awisU8PAffPWL2lcq89/R+JBdA2+2HktmKNjDSnqKoe2VIyZmQ3Jj1FpRTp4eaNKE7YN/wPW35Fl7rDBMfqAKJhefHKWxPz13RlmOx2Fr6dM18340tRhTsZua9KEtmXkrf8aDdq\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 81B87D1E-EFF2-4867-84F1-AE3F774C05B1\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1937,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"a1976c44f0b602a851806d4fa0ca871e","sha1":"019aa7a13af206e7f5790e869b9468211b9fea61","sha256":"fc49281fcc5b17bcd27875b71081981dddaca43bc823c68db2a3031a72b956e6","sha512":"c9bbee6932f9ff7ae2406ad135610d5503c8e29a21244a7fd22ce896c5c954d9d3851014521e1733ccb7f0ba0a334d9048c8743baf0e146921e08452d6378ddc","ssdeep":"","tlshash":"94513a421564a788f4defaea041b28e18f32a10ab7662e15dd14c307cf7de001a5e16c","first_seen":"2025-10-31T13:59:12.524961Z","last_seen":"2025-11-01T02:05:52.012753Z","times_seen":2,"resource_available":false,"data":null}},"time_used":530,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":530,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/index-a3dad144.1756903329400.268893b8.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:09.705Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /js/index-a3dad144.1756903329400.268893b8.js HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:12 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-551ed\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962712=ukc3SjQKOVCf0GeyNlfM8KhwH8E6TDY/d6XgzE0dvO3s4nIAbau0ZPueCrbE8M6J+yO2AjGB3iLgHIcFDMl9OVJvbAVIr6SV1F/QZgYjD1pP/WuwbUyy+f7A9v0LajfjD/xCdc7v6xvOMZ/fepe1tp1rp32lvbav+8Te6OpgV8/IHYWdH9/c4dF1v9qD8ZHW\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: A99BF289-F604-4DD8-9917-4D74B6600B2A\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":348653,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64496), with no line terminators","md5":"e70d98f5d06556fb2df3ec9ecd519e37","sha1":"f15f33973e2498e949a62791b8fa6c7ff03c7a98","sha256":"7c6448354a71dab7081c1a9083e1ef15f7c59ff568fb924930620b4758169df2","sha512":"d225d0cca1709f789e457dd14df16ceda4bf4118d6c8f9db25bb9cbd5f30151e6b23d497ba51761a0eba97686323b0393dcfe43652e832dbaecc97b69bccf802","ssdeep":"6144:G4InKyBbhFOuyKO0VPoJBR58n3inyHpZolRlY1z9f7ZwTl0A+:izc90VPoJBR58n3inyHpH1z9ftM+","tlshash":"d7743b94f76cf1bd874e55be793290a4902c1b41b0c89d58d29e2944ff6b385eeb08bc","first_seen":"2025-09-04T00:49:32.964012Z","last_seen":"2025-12-29T13:58:57.98751Z","times_seen":435,"resource_available":true,"data":null}},"time_used":2842,"timings":{"blocked":1926,"dns":0,"connect":0,"send":0,"wait":557,"receive":359,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/api/sport/match/player/match","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.607Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /api/sport/match/player/match HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nx-request-source: https://x78d.xyz\r\nXign: BcrKlDz2/OPE7WXAaZ0594cmWgQJEo0zErBcqmx2lWrFn/i8rR0JfIszexq1RGqDcTGrksD2TZG188ywYm3npPA+TT2I7CKcN7p3LiXBdQow7dZoagU/IgOrw2KkekziZkxQVFdEomQ4Dh1/0xIClY4MKO9ka2cwa9RQT5Bijl0=\r\ntimestamp: 1761962715988\r\nsign: l3a7m111h4k3k7hm\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: Kc3Md8YTTSx5jDErM6fkSDaKwC66eyT6\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:16 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962716=iQZav/OuEMgHx3A+Cgvm74+GIW90PILhstcwg2e9np8wh65/JtzJfcVNs0hYy6F1MXFrg0PN+RhRCRvZhb4TAOTk81ZqLAYJZBgpoe2BeYdMPjW57UhHMqtWkHx+WpnjTSKsHj2SPkpRpdkPCF/y47HldzpG9CXOfMTux5wuAsaV4o4Hcwn93D+dVrWExdCY\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 605FEED8-5EC5-471C-90AA-94BA57321A39\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"ad1b5cbc37e087c212a41eca07a863ae","sha1":"f990fb40077ca4c90bbde8ffb87c73e1c06fd931","sha256":"0fca88eefe8bb5f59242b88e2b8b179148a088b4cde3499e1c56fef8c84c309a","sha512":"fe056eef22791a958cc37f63c1cc4b3f35bd990c34d1d321f34504b7b99769b571fe46cf18ede31f7ca0e564baf63aaca9d4f3601395bd7a3ce424e50a2aaf87","ssdeep":"","tlshash":"56a002473a282ea49bc31066b50e7a5500a421749a55f469cc8e623dc755453b546531","first_seen":"2024-05-26T00:49:06Z","last_seen":"2026-07-22T12:19:11.175945Z","times_seen":2489,"resource_available":false,"data":null}},"time_used":473,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":473,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/ecb/8f8306425cb6740e78b2802ff5047afa96a8ae096bee393c421cac4924db741c4a080b3f3ed2f2822673f3118bd3bae081df46a59bfce8","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:14.813Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /ecb/8f8306425cb6740e78b2802ff5047afa96a8ae096bee393c421cac4924db741c4a080b3f3ed2f2822673f3118bd3bae081df46a59bfce8 HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://x78d.xyz\r\nXign: sMuC0qFGQoO7XxYvS/l46DOXVZmrbWlkPbIWuIORgkRRrReq90aI4xgVa3kVshGqa83+Dxfl4yVzPejL0zjS0MQ2R8aQIfV3a/jRDNFtmlovv1T+DCqtwvj9buVGB6clMBkS0H1z8UDMeDqZisxmt7uHWJX1wcNo7v76Qd8zT3o=\r\ntimestamp: 1761962714779\r\nsign: 404o741v1h58436g\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: Kc3Md8YTTSx5jDErM6fkSDaKwC66eyT6\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:15 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Sat, 01 Nov 2025 02:08:15 GMT\r\nCache-Control: public, max-age=180, s-maxage=180, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962715=rr8RSxjhoP257i6Bcaw8RAyhBBSN9LM0Zm++tGYblKe4lINKan0tJxjQ+awisU8PAffPWL2lcq89/R+JBdA2+2HktmKNjDSnqKoe2VIyZmQ3Jj1FpRTp4eaNKE7YN/wPW35Fl7rDBMfqAKJhefHKWxPz13RlmOx2Fr6dM18340tRhTsZua9KEtmXkrf8aDdq\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: C15F1874-DB17-48BA-8D3F-AB5DD43ABC98\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":60,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"aa1fe36cc499baa3fbdc7ab9bda7432f","sha1":"201b0fc1c4c699f3538c8e3992ec08ecd2f3acb3","sha256":"d509d9e26b3c3a371856286d14bcdd4f17125a10d8ee40e119fdecaf964fb478","sha512":"2dff3b34740cc9d3690f596673675516493472f5ad4bbd3536b5b1b18922543771be73e01051874bc7039aef9461cedb841f0cbe4945118bdea5773a4b3f7a55","ssdeep":"","tlshash":"03b012a2d5a309ed9644713104305c414be022ccc9bcf858c7bc4d2b45650210494105","first_seen":"2025-08-09T20:01:46.169117Z","last_seen":"2026-07-21T11:55:13.289199Z","times_seen":1560,"resource_available":false,"data":null}},"time_used":978,"timings":{"blocked":517,"dns":0,"connect":0,"send":0,"wait":461,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/266038318d966fae1492d8fb45c4e840d89f4?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.716Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/266038318d966fae1492d8fb45c4e840d89f4?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 19331\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 518396\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"266038318d966fae1492d8fb45c4e840d89f4\"; filename*=utf-8''266038318d966fae1492d8fb45c4e840d89f4\r\ncontent-md5: T6mmOCPBNkoEDxidTqXpRw==\r\ncontent-transfer-encoding: binary\r\netag: \"FvT0D05vlrQ5LVaw76npIghUQt1e\"\r\nlast-modified: Wed, 06 Jul 2022 12:56:39 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-2;QNM3\r\nx-m-reqid: 1d11XRHgC\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: h9MAAADaawi7t1gY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19331,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit/color RGBA, non-interlaced","md5":"4fa9a63823c1364a040f189d4ea5e947","sha1":"f4f40f4e6f96b4392d56b0efa9e922085442dd5e","sha256":"8c7c8238506d931234a80f2ded160de12780a4a7cbd3963d23c40b0022deeec9","sha512":"e0f61fea08e0948ab815471f5db71c9496461af4f249ed56069d61492f705989aaefeee08c6bd977b57ac12caabcd46243f9ffc44d9386c742566157db84301c","ssdeep":"384:JOXOgbNTH6HE+IZUzYmMQ54//hY2t+jYPUbZFrK9Sx:JOegBH6PIjL//VOwUlFrK9Sx","tlshash":"cf92cf125a93f304e1a0e3150d89d1a281933955ea61bb73ec8f503cbe88e3c65b4d96","first_seen":"2025-09-12T03:03:41.329596Z","last_seen":"2026-04-12T14:07:56.994126Z","times_seen":170,"resource_available":false,"data":null}},"time_used":6740,"timings":{"blocked":1628,"dns":0,"connect":0,"send":0,"wait":1970,"receive":3142,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/ecb/8f8306425ab46d0221b2c56ef50f72e487d5bb0255ee7333091abb7c08c465094a574c3c12d0e1812241fe43c0d5f0ea88d857f698a4fd081b","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:14.802Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /ecb/8f8306425ab46d0221b2c56ef50f72e487d5bb0255ee7333091abb7c08c465094a574c3c12d0e1812241fe43c0d5f0ea88d857f698a4fd081b HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://x78d.xyz\r\nXign: BDOvAlCs+zmrGTeAJ5xJrRi1L1WcJXQjX9qFKO3ijIk8rhLNgYM2FNMPImKJXWOHKnFr55t0k77VJ/Dh1/WyLxZH2DDQTtWDJVXCJ95fkhutRJMzMDhpfRulsXIJXReGcMEVcqEKcQzz7QtNcbE7iZZ9fY7ei1q/KMCijqMLJd0=\r\ntimestamp: 1761962714777\r\nsign: n1r2s19l33764124\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: Kc3Md8YTTSx5jDErM6fkSDaKwC66eyT6\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:15 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Sat, 01 Nov 2025 02:10:15 GMT\r\nCache-Control: public, max-age=300, s-maxage=300, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962715=rr8RSxjhoP257i6Bcaw8RAyhBBSN9LM0Zm++tGYblKe4lINKan0tJxjQ+awisU8PAffPWL2lcq89/R+JBdA2+2HktmKNjDSnqKoe2VIyZmQ3Jj1FpRTp4eaNKE7YN/wPW35Fl7rDBMfqAKJhefHKWxPz13RlmOx2Fr6dM18340tRhTsZua9KEtmXkrf8aDdq\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 93BADF58-BEBF-4FF1-9341-ADA99D2233AE\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36406,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"fd4d2e99c0033db24ebb7d481c083593","sha1":"35d2935f536919613b1b497ce28ee54cf56ff58f","sha256":"fdefec0aa6e801012a798f28afdb8760dfacd1302d6585accf274c63e55228f4","sha512":"17625effdfc018ac6ea0dd29a62a57d376aeaac6ead4d2afa7ab9f31d0f5701aa76965586c2fb72b70078e876c4f6eb5958294c905888af6d114fb917d677fbc","ssdeep":"1536:OO/ldUXklRBpEM+DFUekQh+BswgN4hlRVcey:zldUX6RH9cCRQhUs4lRfy","tlshash":"0133d1129281f7f0e37a70f5a9073bc0e1204a44b3dfe992d935d9112c9b27667ee8e1","first_seen":"2025-10-31T13:59:12.516584Z","last_seen":"2025-11-01T02:05:52.01932Z","times_seen":2,"resource_available":false,"data":null}},"time_used":860,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":854,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/10758158d36be8bff49dba6022547a55c419e?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.671Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/10758158d36be8bff49dba6022547a55c419e?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 68536\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1979553\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"10758158d36be8bff49dba6022547a55c419e\"; filename*=utf-8''10758158d36be8bff49dba6022547a55c419e\r\ncontent-md5: 9hUBEc/MuIpC2GL8JTkpzw==\r\ncontent-transfer-encoding: binary\r\netag: \"FgOEXexZSz15uHdkSvvKhvpdVhkd\"\r\nlast-modified: Wed, 06 Jul 2022 13:04:29 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-27;QNM3\r\nx-m-reqid: ut5b7AKxV\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: BK4AAAAinfHXsmwY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":68536,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1200 x 870, 8-bit/color RGBA, non-interlaced","md5":"f6150111cfccb88a42d862fc253929cf","sha1":"03845dec594b3d79b877644afbca86fa5d56191d","sha256":"2390efafdc98bfff47e474935644434300eb89cdc9195c770b32357c656e34b5","sha512":"41aa399b9c79cebb15d560851a6596c20b2bc75f24632862482780c58bdfa12abe81f0af8b21f352d45c27e9ce3b9c110cfb4e9003ddac234fe2f26f6f42d17e","ssdeep":"1536:A4IPwM5guhWCo8o7D0QVzKU1Bd1TvF/MZfiVNV5jN7NLxoWEb/9:AR4Mlfa7wQ0o/vF/MZqVNV5pVxo9z9","tlshash":"f163f152e53ec8e3a9265a32755016379430dca3597cf002d5f27d8decbe9f12c2a89c","first_seen":"2025-05-23T02:06:42.692576Z","last_seen":"2026-07-21T21:40:41.685461Z","times_seen":168,"resource_available":false,"data":null}},"time_used":9319,"timings":{"blocked":1671,"dns":0,"connect":0,"send":0,"wait":1969,"receive":5679,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/css/52388.1756903329400.023ec95e.css","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.753Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /css/52388.1756903329400.023ec95e.css HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:14 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-10ce\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962714=X3amY441wvsjAI1xw2JJgjckwuib0itIgNKTTS4NwHGbaYMcSRe9Bsnv0C3cyCDUIDx9T8QKGfZZfGCtT7uRYZgsMcieRNZeslPqWb/4Qlg/gtt9evqjFMo2W1swogb+bhGIGk/Uy0+30C3DWkmBEvT48k/4zm2gOAlx12joojS2ndPSWw97gihjAzM8RQQv\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: C27063DD-B98D-4C49-9B57-E63C1B77CA1F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4302,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4302), with no line terminators","md5":"4efa3b550af4fa3ebee130f514631a7c","sha1":"52f29a161a644ebd6eb64fdc07b98e62115eec6e","sha256":"9b87a918545ad75490c79272f4c435c319793820eef518ca60893ba92fbbc8cf","sha512":"096e5f166461728d63ce720dec1310e40390420bfd76d5d13406ad6f2720a55ef6131fcc40f021c6029eec962a1315614a0c7cae55717e6d3466bbabd48dfa43","ssdeep":"96:k8WL6Lfl5F3fPFqNu9h0ShU1ulYUsH270RHeO5k0IWlLBUWl1dLIrEjWm//:k0Lfl5F3fPFqNu96ShU1ullsH270RHe4","tlshash":"2c91124bf89ca23f58bab7ac59c7a55da45644059b270aade31c35e0438b4e0c133eec","first_seen":"2025-08-05T06:40:24.237782Z","last_seen":"2026-04-26T06:01:09.995598Z","times_seen":1255,"resource_available":false,"data":null}},"time_used":468,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":468,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/64369.1756903329400.27cb8135.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:09.704Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /js/64369.1756903329400.27cb8135.js HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:11 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-269de\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962711=G+xZvJTVy3tz9h+I9aQHv8vXbXmcjZEAyki4ZZ+qsKOIzlhmhy0JmwXiDHWWst8HNXLkp2G0HqpYxBE+5w3GNZE0DdM8Ng6J2SKlqN9Hpx5dW0hz60eNbku6JSeOzKhH6Y7Nutxe1Mhh9bObFptHWtt6U70oXjn/9RNiOB8aHEo7tE9C01FnEmIuxLlUNQY/\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: D61E743A-7EF0-4663-BC05-8C32E4B4AF4F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":158174,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"ce99014ab42559bc99f808a69bf596c2","sha1":"adf52a59aba8080dae7b97585e346f5aa782141f","sha256":"39076e64a0e5facd6f6f3d4db7f7fa71039c87d4a6250298dd4bd3059bfd9863","sha512":"ede23f1e36658737f40782ab61a166f1a2a6f61957524beefc283035c39337325c487d6236975bd97cf44aa91b31ed6985a3416ef561edd5b977ff02fb6b1b54","ssdeep":"3072:cHW7tB4Vgj5tNlxyU5YegxYffj7TEOiG1Zl+DJVkzEcx1nKR:cHW7tBwgttXxyUtffjAG1T+DJVkzEcxE","tlshash":"6cf31bd4f2c070f6475f45f2a22b1075b26f4d92318c98b0e15ba6597f21a48c7abeec","first_seen":"2025-09-04T00:49:32.946075Z","last_seen":"2025-12-29T13:58:58.086406Z","times_seen":434,"resource_available":true,"data":null}},"time_used":2322,"timings":{"blocked":1748,"dns":0,"connect":0,"send":0,"wait":538,"receive":36,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/no_data.02e9590c.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.864Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /img/no_data.02e9590c.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T13:24:20.356579Z","times_seen":17450888,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/LIVE.88ccbf98.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.617Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/LIVE.88ccbf98.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:18 GMT\r\nContent-Type: image/png\r\nContent-Length: 61665\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-f0e1\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962718=i95mbm0Nui8DbqCHTgwZJnkhUh+9wS4XzdkIHK2J5m8J4BUFTB6L0NipCfqJvRtuegXOmmjvCt+78XE8A1wZMRm7TNPI+EFgShZwbHJ9WQv0Ervy/10oYldE1zF2ablDEG7fwH7oCiu+KncsA7g1IOg6lb7qC/Y7w7oClv6sSK1kNK4QsD6OECDoim4Qplx6\r\nAge: 246265\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: FCD00975-134F-4618-B03A-07117DF1602C\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61665,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"372d01a2bda7ccdca1e7966af39c2327","sha1":"d438c1947b711d032c5621a6b4b08bbbca2c338d","sha256":"4eac7be4c06fa607ef5e95789e3ead43806bfeff97872ed6567e3810f2f661bc","sha512":"9f04160df8696cf984cd77604dddaea73969479e4f1c5050e53351df7f11e85d8ecccb14ecb87dcd58bea0ba04d9ba5ea3f99c69a179ba88ad38d5416b7a94d3","ssdeep":"1536:jTjrlfQBxhFWiXt2lnJE9mARbSK0k2C8ve1HfarCtt:jH1QjwWUC9mA10jC8WZfaQt","tlshash":"dd53124a2ecc3a1f7bf21e5e06f286814d36a186d0f9ba5bc6e70ef1218521de0e4535","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T12:19:11.24906Z","times_seen":2239,"resource_available":false,"data":null}},"time_used":2154,"timings":{"blocked":1803,"dns":0,"connect":0,"send":0,"wait":348,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/css/chunk-common.1756903329400.fcaa3bb6.css","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:09.686Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /css/chunk-common.1756903329400.fcaa3bb6.css HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:10 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-340e\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962710=bLr7Bxe+9N7cGi456Xux0ngpT+448BEJRNKUlI2uRZNYQ+auPzMEcLISwKNIz5rtce6ISFwIiaT4hNFZKe3FykBIlgDwvQCo21rn2B1IEAWx+fwNww6W4PbnvqF/wTQWD66lsUFvdb08zzTVVrQ+Gv7oUDBwNk6kKp2F8xYzf8LWvz53VTbTGCr0yJ3UvLFY\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 519FE165-5B89-4190-95E1-56D7BDDB79A2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13326,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (13326), with no line terminators","md5":"826c687e5a03ee71f95d5348db199e55","sha1":"46d95f05e1da96866b57353cd147ecfe9f20f2dc","sha256":"daf2bc8bfaa2d7608bfcd21eb0a6aeda1d3452dc26f2b8577a7c69e599bb8d3e","sha512":"47a2d7bf1b9905ec12876df1008c5b7cd9da2ef5d6f72026fea2ef705e6b63bf2f88941c5b57b112aa663a612327e48e1e85da444a119e7187b615b4089da7df","ssdeep":"192:4dQK/X4cBY4mZGX1lsUTLA7gY3bz/i//LN4hHSQZA2VxM2XwKjv0:M8oTG3bz/i//LihHBrxP0","tlshash":"7852b831d635b53ce57be226f9d09adc6024d417e2730baeea653b3ac5ca4d215332c8","first_seen":"2025-08-29T11:05:53.265444Z","last_seen":"2026-04-27T23:33:28.249766Z","times_seen":1343,"resource_available":false,"data":null}},"time_used":1955,"timings":{"blocked":743,"dns":2,"connect":404,"send":0,"wait":445,"receive":0,"ssl":357},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_c0a34e2a-97fa-40dc-8123-594806696886.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.386Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_c0a34e2a-97fa-40dc-8123-594806696886.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 20219\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pUP7yM%2BSJ0gefSpM9DErhXIdoi8s8rS%2F%2FSBZLmGoBtMirRn7Is9RAGgePGCl4cf0TrAHNuty3Km%2BZWAYfYd82AN0FVZzyCZcWKf3Rr9ofYT43rfkn7%2BcbR8Y%2BXve\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"7fc7275341b7ffb7fc3c2e44aa37d83b\"\r\nLast-Modified: Mon, 08 Sep 2025 20:50:55 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246266\r\ncf-cache-status: HIT\r\nCF-RAY: 99605774ec822ddd-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962728=AIoyPJP+APz7wYK2AaBXUd/rNRX8JZKH8Sn29GOjN/C76txwq97fo11K6Dp6ANTQZaELDhitkoczh/wCj1yBDc9fRM49jluqosURZInvyepPB3lB+ikZRwqJro4qDuT3woNhuyIYzr5t8IWMxzIUHQRScGuBWicniC8j1w7SIkkhTBk7A/U+DRuyW/MO09f+\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 2771D89B-4A61-47CC-B040-5EBDB4224CC6\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20219,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit colormap, non-interlaced","md5":"7fc7275341b7ffb7fc3c2e44aa37d83b","sha1":"065bc30356a5837360c7194171d69da1feeada48","sha256":"58f2ef2554dc2845f5ea9b292b7fbf331543f49b3dcfcfee4353b924d1965663","sha512":"95f1b4c0e5e6060628321d0c6694d443893b1b8aaaf94e3ef05ea703e30003de317586329fcfaaf743d311ff27c2c58baddb7a8242e0de5514a0cf5303980815","ssdeep":"384:cbjBpF/NpKkd89ztdkMcDd2/GiyURwOnogFc5cBmwcbe2osrF:cbjBpFNpbePvcDdYv7ogFCcBm/e2o+","tlshash":"7592df661053129bfccb853eb52e99f0f9f484abd0bc871da6034c561b8e85c1668a9f","first_seen":"2025-08-29T11:05:53.28171Z","last_seen":"2025-12-28T02:09:46.214845Z","times_seen":307,"resource_available":false,"data":null}},"time_used":4845,"timings":{"blocked":4509,"dns":0,"connect":0,"send":0,"wait":335,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/help.4e3cf897.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.993Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/help.4e3cf897.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://x78d.xyz/css/index-399e2569.1756903329400.f2d3fd45.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 10322\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-2852\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962716=iQZav/OuEMgHx3A+Cgvm74+GIW90PILhstcwg2e9np8wh65/JtzJfcVNs0hYy6F1MXFrg0PN+RhRCRvZhb4TAOTk81ZqLAYJZBgpoe2BeYdMPjW57UhHMqtWkHx+WpnjTSKsHj2SPkpRpdkPCF/y47HldzpG9CXOfMTux5wuAsaV4o4Hcwn93D+dVrWExdCY\r\nAge: 249790\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 58A4ED4B-3EE2-42D2-9107-EA8AF9C03FB7\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10322,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"6dd52a6a4d07f2786b1926fac1b4b06a","sha1":"9c9908204401fbe65d33cf7df8881639d6aea37d","sha256":"e02471f47b506ab510d0e0dc4224cffc03c34f950b649ce347ccd71af0bcf0ab","sha512":"fdd52f532e5c2e2c182db20e2053eee0ca8c26cec51ff75e1bc341b01911461ac72fa75887fa3114188ba32aa6341c0974d81d071fc42b605e72f73dfb87ab9c","ssdeep":"192:x0C+pMwjX2XZ456BAJu+1KzdjCfDrRq6wUPlJyh2h4PAmWP5yQSkHxfYX32H5TRm:EjGXZau+1MjCrrRLlqGOnWcQSkRQX3IG","tlshash":"3822c054370836084f737a4362ac4e837a06040ffdf9b7919a6372659a5b94e44cfb66","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-07-22T12:19:11.127288Z","times_seen":2409,"resource_available":false,"data":null}},"time_used":2224,"timings":{"blocked":1895,"dns":0,"connect":0,"send":0,"wait":322,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/api/sport/match/list?sportId=1\u0026client=web","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:26.083Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nx-request-source: https://x78d.xyz\r\nXign: l/pW2ovAI6xThaNPPJyFJ+aVrrTLh6NyRC4jxGy3Zqca4e+F/LzKXHKJvaOEF+4P4FlSHcfxKVdTBsVvTrcHZLB/Ed5iyf6ykOHGi+7eXnlnado03fcnyb7AcZLgh6uYKlMdMg6d1WY9jN9ICW/sOLbRxPwwgb04dLoC6Sz/tkg=\r\ntimestamp: 1761962726076\r\nsign: ki2q682s7c405v4i\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: Kc3Md8YTTSx5jDErM6fkSDaKwC66eyT6\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:26 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962726=JzzEHLt9Hb5OKDgPEZRvfMAR0A/77JrXyMkda9GV0LsHvzOmoL6JsFP5kwgt0UFPW+XcC2aB9Gj9fvC6m/AeKOmAdxwAIVrn9zI0SdEk+PuwVYXkQ00iCcHMT1bZTq/XKL7CqmkSImsiXzBwlX0Vsi2F0vM7a+R/XvVzrt7iUROax41zD+ILS6/KoAW+vQ6B\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: D2F4241B-F7C5-4579-8185-FD9D3DE8F617\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":63440,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"a2f77f674a247c4a3b38a58553097e36","sha1":"88d14b05d7262fb054c6017cccb4ca9325aef5dc","sha256":"953f00c21ea3d4e72b131e38657bac8cc1e9b3cf27c5c01a7a1fea6832633d7a","sha512":"b3c87c3a797a82ff756ec9efbc2901cfcb639ee60b47fe461e30ce287ef7fc3416a4f960c62fab745b727c39018ab43fd6d96d3570fa9407ba7f55308bc8c92b","ssdeep":"1536:ejNpNpH6D6+6I6j60606N6FaPNPcPmPkGRoJaJLJRJCqJLlrVAUnOzyBcXsbQrT2:2pNpH6D6+6I6j60606N6FaPNPcPmPt+8","tlshash":"1b532356c2dc28d92b5d22d9290e3a4cd83d6d9b0e9ff9d5ed4adf1c20e83fb9105860","first_seen":"2025-11-01T02:05:52.029728Z","last_seen":"2025-11-01T02:05:52.029728Z","times_seen":1,"resource_available":false,"data":null}},"time_used":485,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":485,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/a7e49dbc-140a-4c02-81cf-e55cd0108e5d.jpg","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.636Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/a7e49dbc-140a-4c02-81cf-e55cd0108e5d.jpg HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:21 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wJ7RWHHEaxYiWQbk4q7mBQhNf5HVB%2Bgr7QAKYLXwRU07fMbrhvUiBmCkaG4MwSgGVwJUTlZO4FmDniKj2Lxz%2Fl%2Bfz%2FK6HPLufQrODwFE%2Fd%2BlGWOsaUfFLMN%2FrXTP\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"f42e0fcaaf4b3dd132c5b52a7fa29773\"\r\nLast-Modified: Mon, 25 Aug 2025 10:01:09 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1125\r\ncf-cache-status: HIT\r\nCF-RAY: 9977d3a3bc7904fd-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962721=/+td4e41pCFCl6toSE4aYE8kYFu8tOfkWegAisvHhpGULw1avd3Hj703YtslcEaS4VysM6HtYP3emE6XwPIk467TuTwUPjrEq0iXOuA263kxyvo//39fMGLID9BKw22X5CSvN3sMl/wRVI1K8T+NLWtYQFaWyfuAAPlhpE4mUwbFyzSMvf97mBIQzSLFtX1w\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 63E74A47-3E82-47C2-92D2-CFC87664266A\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":221858,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 540x650, components 3","md5":"f42e0fcaaf4b3dd132c5b52a7fa29773","sha1":"23412150020e5af9888e58038f823dba9073027d","sha256":"1f0221df43cc57f4baa91484c6d4d1eb8374623bb21dafd74c526f95942153f5","sha512":"716a4b79708b5efc807da4f3f4554531c044db894cab68e14b5854fdf342d363fa588fa4fbb045b3b729b06e7f8df9a1619183277f6f90228c2419ab7f48c9a8","ssdeep":"6144:DtRn09SU2N018YMl2/LwukXqlZU06QX3H0x:D09SXN01XN+ql+0pUx","tlshash":"8a24129423536cd1fcaedae079d87a0b3a5626fc90fff44386144a81635ebbc618171e","first_seen":"2025-08-29T11:05:53.340749Z","last_seen":"2026-03-18T12:35:39.054225Z","times_seen":1134,"resource_available":false,"data":null}},"time_used":6127,"timings":{"blocked":4915,"dns":0,"connect":0,"send":0,"wait":527,"receive":685,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_50b16c20-cbfb-4c4c-ba8a-249055c85af3.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.314Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_50b16c20-cbfb-4c4c-ba8a-249055c85af3.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:25 GMT\r\nContent-Type: image/png\r\nContent-Length: 133257\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QsK%2F%2BKmzExodtQEhzviwTmLNehUN9JAJOOTvcxkib4TJ5EIoX9PEv6Ld%2Bf4pb%2Fos8rvprp%2BYxyd9iv79KftKn0lDXQzIpDIr4%2Fe%2Bbs7RoyWOofNOUcLiafgFpOot\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"e932d01be4f46b30fb7820d0a6ecaa8e\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:27 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246263\r\ncf-cache-status: HIT\r\nCF-RAY: 99605770bd8d855f-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962725=yIoYJXnoX32vTrxda1zOc8miVG32U7nJJc12gDZ+In6cgnf8S38tKUUUMfLseQr/q8eimpOabVTJjmX6tFPOJmPT1E15RMXJLCAOTkmUEPpCMU6llWgDlqx+fr9zASS472DYjzlMiWRiDMxvJl4PxLo/nm3fsJVZbP5/iPuwIDPxIrhHcKVoSg2HyE5+IDkE\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 7E79F4D3-FDBB-4934-AF40-003A71302505\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":133257,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"e932d01be4f46b30fb7820d0a6ecaa8e","sha1":"8ed805238342c4428630a620898688c541d49d8c","sha256":"237a03a4d6554209676acd0d140a2194419ce3672b849cfaa99df1bd8a31fcac","sha512":"fe1dbf59bfd451cf5c9080af7c932b8d8cde5eb25cb58568d7cdaf3c1a4015d1e858201775291bd74872d7e0444746def52d068c58fdeeabffcf8d21acd2a493","ssdeep":"3072:IDJzDKb/eNOyrjQyTU0mZn12vOjQiSWT+UPNeaHp1nvDeEUiu0GGXf2quOn9:wPKbE5rkyTUDTVQdWT+UP/H3n6EneqP9","tlshash":"09d3123a7053df65d92ff2a8e11ef8caa5722729cbab1945c80dc98615220789c83d73","first_seen":"2025-08-29T11:05:53.12363Z","last_seen":"2025-12-28T02:09:46.269424Z","times_seen":297,"resource_available":false,"data":null}},"time_used":2674,"timings":{"blocked":2042,"dns":0,"connect":0,"send":0,"wait":306,"receive":326,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/kc523-1/noData/cms_noimg.png?1756903280095","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.528Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /kc523-1/noData/cms_noimg.png?1756903280095 HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 9882\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-269a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962715=rr8RSxjhoP257i6Bcaw8RAyhBBSN9LM0Zm++tGYblKe4lINKan0tJxjQ+awisU8PAffPWL2lcq89/R+JBdA2+2HktmKNjDSnqKoe2VIyZmQ3Jj1FpRTp4eaNKE7YN/wPW35Fl7rDBMfqAKJhefHKWxPz13RlmOx2Fr6dM18340tRhTsZua9KEtmXkrf8aDdq\r\nAge: 249775\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 79B6B3DE-49C7-4447-BCFE-DE82C22E452C\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9882,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 700, 8-bit/color RGBA, non-interlaced","md5":"85e60fd8767b18839ffb552a5d543f8a","sha1":"341cfd68a5b39cb246af6ade1e3171c857d2df5a","sha256":"4b7ad68306ffac25830d1016ba86154890deef8bd77a03257b767b37de1c8338","sha512":"785f028aab80d3f96794431f84025483f490d7d642022404a7b14ccb4785aa52fe4a21048d44acda3bd160eedeaccfb4959a677986dfe47ef038d80724f2acb2","ssdeep":"96:74iGykVWI7TGvGJUgTFSebsBzYofEC16+TqBK7R7LWKaR8a8D7uZNgAMXFL73:74iyHunEFSebsvP1nTP7IF2uAAMX5","tlshash":"141259118573d43cd82ce57926df6fb93b709f996890476e8328e7342f2a2f78d60848","first_seen":"2023-05-01T09:33:58Z","last_seen":"2026-07-22T12:19:11.206269Z","times_seen":3040,"resource_available":false,"data":null}},"time_used":320,"timings":{"blocked":3,"dns":0,"connect":0,"send":0,"wait":316,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/assets/logo/favicon.ico","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.432Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /assets/logo/favicon.ico HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:13 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 58278\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nETag: \"68b00b6f-e3a6\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1761962713=I6K2XWhDVA0awyfD/5xFQzalvwM45oMG7bTkJxNueBZCYyD6N0TwCQwXhfcblgZK0e+1qHgBzUP/VfG80DBDvI+wPvDt6BsZi/QJSvwomwSgNwFdR9smI1hOBvr5s69iLkzG+c/AStWnqdtCh9L+Hw/Kj/X0HziC5Mz2XrlIuLxrjd4Nn0MDGVqRQTsSm0iZ\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: D0C2C229-C27D-4F1B-8126-DFD5366387B4\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58278,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"7fb9203f2701deec1371d2fd0ddd079a","sha1":"a7d4ea5f1c3d103aaa3c078bf540b56404aec0e1","sha256":"2a342dd0f9977afb12227889cf13ff008d4cf1e9a4ca07fb4131d14af05978d0","sha512":"964cf7794a7b72bb9515927efe748563b6d46fe122b35baa4c7f57fafb09ea759e5e759a3000d385872218cdd08383a58a2b66feb9a712e6f3e9a06cc87e43b5","ssdeep":"1536:e7V6OVB39Hdm34GeF4KERayBlZ3WgaOlblY4+:e7V6OV7034GeFERd3WgaOlbGN","tlshash":"af43f10a258e86c73047c3921b2dc09b70d12c776b8daef9e6bc4a5816d54731bbd1ae","first_seen":"2025-08-29T11:05:53.165834Z","last_seen":"2026-03-18T12:35:38.966648Z","times_seen":1201,"resource_available":false,"data":null}},"time_used":701,"timings":{"blocked":173,"dns":0,"connect":0,"send":0,"wait":494,"receive":34,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/21062bc9cd638d1f84ad9a7e6b594e9c58c9f?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.870Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/21062bc9cd638d1f84ad9a7e6b594e9c58c9f?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 24746\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 165381\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"21062bc9cd638d1f84ad9a7e6b594e9c58c9f\"; filename*=utf-8''21062bc9cd638d1f84ad9a7e6b594e9c58c9f\r\ncontent-md5: 4OD7D55ygQVWlDcI6b+d0w==\r\ncontent-transfer-encoding: binary\r\netag: \"FrdPNkW0-4V02AE7pdbfQcVLQm0l\"\r\nlast-modified: Wed, 06 Jul 2022 13:02:24 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-28;QNM3\r\nx-m-reqid: a4wMQomK1\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: RnsAAADtDiEImXIY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24746,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"e0e0fb0f9e72810556943708e9bf9dd3","sha1":"b74f3645b4fb8574d8013ba5d6df41c54b426d25","sha256":"3bcaf3a6065beb35d5b34f22e43cda91d41628b0e1bab83bd2202cab5ac33c0c","sha512":"c0567b764dbc230f52423fda49e09f62615933114b826c639206c1f25aca36dc28e6654486c2021aabc957f932a488be6d9bf2dd853bd2d8a2084084e5517798","ssdeep":"384:HdHpyjsEPTiZhR+y3LnjLL3mUFid9pQonCLdwvFgS7fiHNBfwCkECSm4qkWTs:byj4ZvXFidgoCLPSqjwCxX5qkWTs","tlshash":"dab2f19e616e085b8887950e952623d23c13cbfb47bb0d4f739c1657813617f8c9898a","first_seen":"2025-01-29T13:39:14.654006Z","last_seen":"2026-07-17T19:01:29.321982Z","times_seen":151,"resource_available":false,"data":null}},"time_used":8277,"timings":{"blocked":1475,"dns":0,"connect":0,"send":0,"wait":1970,"receive":4832,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/vs.21f89f73.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.599Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/vs.21f89f73.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://x78d.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:22 GMT\r\nContent-Type: image/png\r\nContent-Length: 1306\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-51a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962722=kfzsfUw0f5QeOwOzB35C9zRbYYC1bo8MHVSYwpXnaUdNveFhhyssWExbW1NooqAwzajG/U7ziuOvfrzjYMMa2SisH+2Igfe3O0s6Am9BNqCdMMjXMSl3u2Is41Ung4zs3Sy4c1w10lLo61G2MsigkAzu1UlaHpJH/D8FVmX0q1MUV24Fyp4v8DuRvMAP3FGV\r\nAge: 246270\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 124E678B-6609-4607-AC16-1CD68715A3E4\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1306,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 70 x 28, 8-bit colormap, non-interlaced","md5":"41cff06a80e61ee3fcd32f7c29a6493e","sha1":"bb70bb0a3a0fde7a132788777aee629392c756e9","sha256":"3240fcea2e4168dc863b8aea602750e6a1fe11a557c18ac6a381781ef487746b","sha512":"fce7ff9f62b51c4f8994f0a8ec4a56f21570d0cd163471d99b357eb0a9a735c800b389c4a8a611ba441b208cea7eb483140042f5d11ef110b591c1c1898bbb8d","ssdeep":"","tlshash":"e921eaffe15b2c75ccb59bb3bc6c12656809582970866b137125e7588c539217f0c461","first_seen":"2025-08-29T11:05:53.184813Z","last_seen":"2026-07-22T12:19:11.16405Z","times_seen":2237,"resource_available":false,"data":null}},"time_used":5667,"timings":{"blocked":811,"dns":0,"connect":0,"send":0,"wait":4856,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202505/_raw_size656x844_f676ec47-4b6f-4d37-b476-fd69f2381a1a.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.340Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202505/_raw_size656x844_f676ec47-4b6f-4d37-b476-fd69f2381a1a.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 268659\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dnx338ohaREE9YoNbScTs7k3P2WAwZXv10N4IhPghOxQrPmsqsnk09hm4yeMeUanVt3WiP9kfY9AQLlg5%2BvIqtz09Lvdm0DC9TfzIpj5n1RKwcTXYygqvF9iyPmR\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"f59451347b49ac6da9ca8dbbd242a85a\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:38 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246250\r\ncf-cache-status: HIT\r\nCF-RAY: 996057c8bad40970-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962726=JzzEHLt9Hb5OKDgPEZRvfMAR0A/77JrXyMkda9GV0LsHvzOmoL6JsFP5kwgt0UFPW+XcC2aB9Gj9fvC6m/AeKOmAdxwAIVrn9zI0SdEk+PuwVYXkQ00iCcHMT1bZTq/XKL7CqmkSImsiXzBwlX0Vsi2F0vM7a+R/XvVzrt7iUROax41zD+ILS6/KoAW+vQ6B\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: CDCF2C42-7D6D-4A16-AD6C-36A5703B0A46\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":268659,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 656 x 844, 8-bit/color RGBA, non-interlaced","md5":"f59451347b49ac6da9ca8dbbd242a85a","sha1":"1f739642381465a5c70a39f62be8dd9c8301a5ee","sha256":"04baef1ce689cbbeb934452a4fc47d78fc8c76abfad8794d9dd46210b607dea3","sha512":"22a9b48743e148281698602b6698551b4e00f8682fb8284977b622c00d00881d68f9677171d88cf72d67cf4a58865c0da893a4c72f0b38dfcc2841fb990a7000","ssdeep":"6144:sdhh8kdFouFNkfPmAz4/jGkhyyIgc34SMW:KD8sSuFNk2Az4bGkh3c34vW","tlshash":"fc4423a923587745d7c322bcd0d86d32b94a74c63ae28fdd109613f602f9d89aa43f47","first_seen":"2025-08-29T11:05:53.115888Z","last_seen":"2025-12-29T08:12:31.313621Z","times_seen":286,"resource_available":false,"data":null}},"time_used":3904,"timings":{"blocked":3226,"dns":0,"connect":0,"send":0,"wait":333,"receive":345,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/theme.config.a0ea1565.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:09.695Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /theme.config.a0ea1565.js HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:10 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-19ee5\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962710=bLr7Bxe+9N7cGi456Xux0ngpT+448BEJRNKUlI2uRZNYQ+auPzMEcLISwKNIz5rtce6ISFwIiaT4hNFZKe3FykBIlgDwvQCo21rn2B1IEAWx+fwNww6W4PbnvqF/wTQWD66lsUFvdb08zzTVVrQ+Gv7oUDBwNk6kKp2F8xYzf8LWvz53VTbTGCr0yJ3UvLFY\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 54B87F0E-A10B-4F42-B5BA-76732A8DA0EC\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":106213,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (38260)","md5":"81c0ad2c8936f5f90cc4ba2b2e53366e","sha1":"8abbe251b908b7d81c73d8537d9d144d3ded3ff7","sha256":"61e7b259016e16c5f842da901c3b2f8202b73db878acb4366eccc217a4dc0b58","sha512":"f295e613097c68b8cb8d0a2530d07c3e883ffc75fdf6d0cd35c23040f1bb182401671c0f70781b64c97db7a37fe9d6d8163de658aef95ce9327ae0068afec7f8","ssdeep":"1536:D2JREob3mtlIRM4Sb2mc42mnzyJog9Cc0hM:qStlGu1pnz45HX","tlshash":"a1a3bb7ee20c963a6177a9bfb46ce111c12e9c0cab1d5fdef13e10a25710669c831de9","first_seen":"2025-09-04T00:49:32.985127Z","last_seen":"2025-12-29T13:58:58.024831Z","times_seen":440,"resource_available":true,"data":null}},"time_used":2172,"timings":{"blocked":752,"dns":1,"connect":417,"send":0,"wait":635,"receive":1,"ssl":362},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/45734.1756903329400.46beea1c.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:09.703Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /js/45734.1756903329400.46beea1c.js HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:11 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-43a22\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962711=G+xZvJTVy3tz9h+I9aQHv8vXbXmcjZEAyki4ZZ+qsKOIzlhmhy0JmwXiDHWWst8HNXLkp2G0HqpYxBE+5w3GNZE0DdM8Ng6J2SKlqN9Hpx5dW0hz60eNbku6JSeOzKhH6Y7Nutxe1Mhh9bObFptHWtt6U70oXjn/9RNiOB8aHEo7tE9C01FnEmIuxLlUNQY/\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: F9092D38-FC67-4BAF-9851-0E7C74B50444\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":277026,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"e5f34b5441b6b582d6d469c537f6f97a","sha1":"defd5aad4e0d066131c97173b21b7b3442cdb951","sha256":"44db08eec9e6d649f62d7d208bce223e33424ebc58c21098181a90ae5a1c6437","sha512":"4096ae8bc07709597c8411157950bea75aba46cee36964fe1e280a31a2c2c9d4a8d5821c3e8a4cca552919511930bc9f834e2054580c452acc17c1011d1e6168","ssdeep":"6144:F/EFTU8Ra90Jjytg7DiQPkcsz1h84faSDWidmVHrqZL:9y/jytgPJP484fa5VHryL","tlshash":"2a441c84b291f0b4879b42f7922b4055a17f48a130ccacb4e2a5ed90be7555c927fbfc","first_seen":"2025-09-04T00:49:32.926111Z","last_seen":"2025-12-29T13:58:58.062377Z","times_seen":438,"resource_available":true,"data":null}},"time_used":2582,"timings":{"blocked":1704,"dns":0,"connect":0,"send":0,"wait":542,"receive":336,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/api/tenant/domain/list","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:14.820Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /api/tenant/domain/list HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nx-request-source: https://x78d.xyz\r\nXign: nBVE7+N/b54H4eC6zPYKzuJtNigNMXZVBpdWHmHwG8nxWLBpCIbztOMpaDbEKYxrfzkJ/qvkmkJZbW8U2aBYtoBiL2WpjdlT+Q8fCNtxGtRlAgxAuKTyH5XFG/UqUc6R3DgSvf+E2127rJT4P57bAkZOwKqfhWIVjF7TTj3ZvW4=\r\ntimestamp: 1761962714802\r\nsign: 36q3ir424i1f7h2g\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: Kc3Md8YTTSx5jDErM6fkSDaKwC66eyT6\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:15 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Sat, 01 Nov 2025 02:15:15 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nVary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nX-Content-Type-Options: nosniff\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962715=rr8RSxjhoP257i6Bcaw8RAyhBBSN9LM0Zm++tGYblKe4lINKan0tJxjQ+awisU8PAffPWL2lcq89/R+JBdA2+2HktmKNjDSnqKoe2VIyZmQ3Jj1FpRTp4eaNKE7YN/wPW35Fl7rDBMfqAKJhefHKWxPz13RlmOx2Fr6dM18340tRhTsZua9KEtmXkrf8aDdq\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 397707B0-61FE-48FA-B86E-3CA3611D2377\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1108,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"5d9e96bd132a2c24281ae50f2b09efe4","sha1":"503ea18100d0f1573baa195933355a1372e93841","sha256":"7f205b18b5deaae96622989dbc8ad73999a9616e96ef26d909f19525deadb328","sha512":"ab5a589dc81944d2fe05d656777e9e490d42a2fd68c7e577387cfdd47c9b0c5276ca2f91a3868407c373e500d00bb5360a5ae035c7c0cb1addf47f20755a268b","ssdeep":"","tlshash":"fb11c6101c6f12c8d6e8d29263503345388d8b76056db91b69d6b74fae0583a32120a4","first_seen":"2025-08-29T11:05:53.144028Z","last_seen":"2026-07-22T12:19:11.194347Z","times_seen":2454,"resource_available":false,"data":null}},"time_used":985,"timings":{"blocked":523,"dns":0,"connect":0,"send":0,"wait":461,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/15569ddaf12d2793a4d4199edd98c9545240d?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.975Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/15569ddaf12d2793a4d4199edd98c9545240d?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 90387\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"15569ddaf12d2793a4d4199edd98c9545240d\"; filename*=utf-8''15569ddaf12d2793a4d4199edd98c9545240d\r\ncontent-md5: 2y9cgTFRGGJ8aNz12qOhXQ==\r\ncontent-transfer-encoding: binary\r\netag: \"Fo7PwoBWyhfdZuwlYjN3BVH4mguQ\"\r\nlast-modified: Wed, 06 Jul 2022 13:05:49 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-22;QNM:cz27;SRCPROXY:cz17;SRC_***:67;SRCPROXY:67;QNM3:98;QNM3:166\r\nx-m-reqid: Wh3HMV8Hz\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: fEMAAABTfb82bHMY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":90387,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 351, 8-bit/color RGBA, non-interlaced","md5":"db2f5c81315118627c68dcf5daa3a15d","sha1":"8ecfc28056ca17dd66ec256233770551f89a0b90","sha256":"b371f501ac6b0561406dd594e1d27bd35427c71d5e90f5ff436e5bf20e39a3c2","sha512":"543e98c3e227f9adbff89f1575f00888fc80bf10ba0518ac354da04c68222f7e1eec8ec027bb4d2e986c82eb7141210dee4d0bc61e442decb68c2d3fd7b7f50c","ssdeep":"1536:OOKcivX40GNZV2KjEdzzgJzlCdNP3yq7IqAEhyo41fY1i8xK9Rbfy9WjanBxK:/Kcivo0GN2KQdz0oPPCiAN71fY1i8I9d","tlshash":"4b931243a8dcedcc126f7b7ed40ffb98992549e0109eb76de815537cc2b6a2a5c216c0","first_seen":"2025-10-16T18:47:34.173057Z","last_seen":"2026-05-15T07:18:13.770489Z","times_seen":169,"resource_available":false,"data":null}},"time_used":10750,"timings":{"blocked":1369,"dns":0,"connect":0,"send":0,"wait":1971,"receive":7410,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_465faf5d-2f6d-44ba-896b-8d6bffead8bd.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.345Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_465faf5d-2f6d-44ba-896b-8d6bffead8bd.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 69399\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zQbQXMssKxji3SAH7t5LPGVw2Un6mj24bi%2FnrVL5lvAxmZQnqkPbmJ2SNMqE9EcyZTXhW0rsBKxOjXryV7Zqjs6dN5EcR3TA8LD34MBgxTYMWVCC8eAb1R9sb%2FjZ\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"ba923e968e806ec3cc5e0ca4f15b6754\"\r\nLast-Modified: Mon, 08 Sep 2025 20:50:58 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246271\r\ncf-cache-status: HIT\r\nCF-RAY: 996057450ae1332a-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962726=JzzEHLt9Hb5OKDgPEZRvfMAR0A/77JrXyMkda9GV0LsHvzOmoL6JsFP5kwgt0UFPW+XcC2aB9Gj9fvC6m/AeKOmAdxwAIVrn9zI0SdEk+PuwVYXkQ00iCcHMT1bZTq/XKL7CqmkSImsiXzBwlX0Vsi2F0vM7a+R/XvVzrt7iUROax41zD+ILS6/KoAW+vQ6B\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 6B0D8884-84D3-44C0-AC8B-DE95382E7F58\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":69399,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"ba923e968e806ec3cc5e0ca4f15b6754","sha1":"6781e3cbf0cad47c0b41a379dd13754885427315","sha256":"191dda4470e82101bad4bd8363aee40e44c864056a114f213b56992d0ce6b744","sha512":"03d50e9e07273a54a7e264b8d66ff08c569f0eaab85fb9a87f90ff6b85cc421107dff11e8f5faf59051f9df26d22c8abe380aec5ea0960756dc392faafee9d8e","ssdeep":"1536:XUBrKrVeCYIB7URpEFD7UjVAP5mq68QB8siQSwFoySA5mjCTDz:w6VLQo0xXl/JwwFoyrEePz","tlshash":"79630255364b0a6eedcf6115da6378213889b3a9ecd8a5f429bc0d4206c2dc297f7326","first_seen":"2025-08-29T11:05:53.275096Z","last_seen":"2025-12-29T08:12:31.374845Z","times_seen":292,"resource_available":false,"data":null}},"time_used":3748,"timings":{"blocked":3401,"dns":0,"connect":0,"send":0,"wait":344,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/12210b9f7de7394ae4bb398f2b59d9272e348?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.874Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/12210b9f7de7394ae4bb398f2b59d9272e348?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 20930\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 814697\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"12210b9f7de7394ae4bb398f2b59d9272e348\"; filename*=utf-8''12210b9f7de7394ae4bb398f2b59d9272e348\r\ncontent-md5: GRW2vq/G4Yvjui4XH6HV+Q==\r\ncontent-transfer-encoding: binary\r\netag: \"FrIvx8BTengQrZWGlmvBBdpQwW2j\"\r\nlast-modified: Wed, 06 Jul 2022 13:02:29 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-1;QNM:fn229;QNM3:35;QNM3:41\r\nx-m-reqid: CSyv1zHWz\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss, Hit\r\nx-reqid: fF0AAAA44JB7SnAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20930,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"1915b6beafc6e18be3ba2e171fa1d5f9","sha1":"b22fc7c0537a7810ad9586966bc105da50c16da3","sha256":"05bd6425b657ad0327b886c680918756e47981141220cdd082eaff31adb32881","sha512":"b86130366a1a1b800b410ec90994a2827cd5a98564137e6bf6040fc86545dd203998770295c3bde6c5ef66733b072f18470cbb472c5d312074cc236bb1e4b0a0","ssdeep":"384:g2Cysq6ZvgvI7IMsSXNR42b2LZUcuqSI7INnA6Pwv2oK:pMh7bZdR4q2ac/SIMNnA6PW2T","tlshash":"ae92e1694114f0d00abe87bbb90e2340763adc5c1bfe4e532ad06db5161ca5b54e1fec","first_seen":"2025-02-04T17:13:01.023819Z","last_seen":"2026-07-21T21:40:41.682345Z","times_seen":334,"resource_available":false,"data":null}},"time_used":8548,"timings":{"blocked":1470,"dns":0,"connect":0,"send":0,"wait":1971,"receive":5107,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_fc0e1468-bc71-4d42-9849-b6735b50978a.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.277Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_fc0e1468-bc71-4d42-9849-b6735b50978a.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:23 GMT\r\nContent-Type: image/png\r\nContent-Length: 115787\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XhBrkiqnGbL5HELHKOKJl1ArV%2FnZ5DllNKZKdv7xXTAkhnUEp1Wnq1ZgcpytXypLkN3fyOQ7vWT99PYvS%2Bzz3iYrCxuIAvnXV%2BA4oeo40gP8BMA9jpFCCALPAqTX\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"abd281a4af5a65d4299fe253a6e4ff61\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:10 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246246\r\ncf-cache-status: HIT\r\nCF-RAY: 996057d10f6825d4-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962723=q5gfVVRnp2eesXQfmCmKo6Suz0pQ27tifnGaf//NQOvM4Nui1udF0IlhUHcCvjPSHgHgIXtNP9CUbArEJzh5NJ7K3cuONguK3iT+Cd58oT8DH8JBG1/dwkqh59iWnpF98gVHX5n2gTZ6kCNUP1U5JZDC2KhMOh/Xh9jUYVJDd1re1TwJiLyqq2JwmHbEEMIp\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 3E55A9F8-5B40-4972-BCEC-8FA0EA60B0AA\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":115787,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"abd281a4af5a65d4299fe253a6e4ff61","sha1":"fe83384c6f30f0d8088265253b05e664caa94b06","sha256":"e24c3350cac84789d5b9b5de7aabfe3203feb5f681d7cb27fbd637743754df57","sha512":"1ca10fd3aa8a6d8e4a2c1a47d701b1c59b7aa433aece4f6652ea0d24ba96c3d4a52078be3f26181283703f4e4f18e63fc9768d292fba09d96b9e8ca3ec5ebfb2","ssdeep":"3072:AaljLBKFeIcCPcF7fAV+e05d565c8T8mcArg5f:AsnBK7PcRAV+e07SRT8O4","tlshash":"abb312b5d477e069d8289f498b430092f5bea1a234ea0c726cc552f3165bdbe1ccca5f","first_seen":"2025-08-29T11:05:53.198537Z","last_seen":"2025-12-29T08:12:31.363529Z","times_seen":297,"resource_available":false,"data":null}},"time_used":1259,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":323,"receive":936,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_2cf32c0e-cd2d-4274-8e00-d67d14e5086e.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.337Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_2cf32c0e-cd2d-4274-8e00-d67d14e5086e.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 74420\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pTGGSd39%2F1MqEJMLRVarScTM0SroEDpyufapMIIEB%2FPUg2Yx73Qf%2BVlr1JRrfSwDtXP3nD%2FwHUwYR2LxCzJxxCMw2sWkXHO%2B%2FHT2cSGfu7ic2zMLEHatjUdDfUIl\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"483193845ef29fea49d165317ef2a6a8\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:11 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246267\r\ncf-cache-status: HIT\r\nCF-RAY: 9960575ccf4f079e-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962726=JzzEHLt9Hb5OKDgPEZRvfMAR0A/77JrXyMkda9GV0LsHvzOmoL6JsFP5kwgt0UFPW+XcC2aB9Gj9fvC6m/AeKOmAdxwAIVrn9zI0SdEk+PuwVYXkQ00iCcHMT1bZTq/XKL7CqmkSImsiXzBwlX0Vsi2F0vM7a+R/XvVzrt7iUROax41zD+ILS6/KoAW+vQ6B\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 6C6E2182-AB9B-4B18-A239-A698DD0EB740\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":74420,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"483193845ef29fea49d165317ef2a6a8","sha1":"382aac96ac623bba78227df264daa66115b46e79","sha256":"d6095539bf6cd1bba243fb281b4dd9acf6c4ef964c08f34a9975ecd505499b5f","sha512":"df72aa1d9dc0dd7d6bd87da0d8c72a43ed9dfc444f66db87015a7fb88fc0562ab41a58ca8ba7fd3022c2aa2b52bd61a06b6ec7761978ebf3bd1403bab35565d8","ssdeep":"1536:IyTkZ3JcWGau5IModpGPs+ucKQpFc6+bbyemwMUghiwcoKB0yygRE:EZ3JcWwSpCLFCbyemf1opG","tlshash":"d773f14220534128e78f7076eafabf8ed68270f5f8a527b5cc098ab515c4e1334de769","first_seen":"2025-08-29T11:05:53.093551Z","last_seen":"2025-12-29T08:12:31.398122Z","times_seen":292,"resource_available":false,"data":null}},"time_used":2985,"timings":{"blocked":2651,"dns":0,"connect":0,"send":0,"wait":331,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/left.34013cd8.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.987Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/left.34013cd8.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://x78d.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 237\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nETag: \"68b83893-ed\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962714=X3amY441wvsjAI1xw2JJgjckwuib0itIgNKTTS4NwHGbaYMcSRe9Bsnv0C3cyCDUIDx9T8QKGfZZfGCtT7uRYZgsMcieRNZeslPqWb/4Qlg/gtt9evqjFMo2W1swogb+bhGIGk/Uy0+30C3DWkmBEvT48k/4zm2gOAlx12joojS2ndPSWw97gihjAzM8RQQv\r\nAge: 249782\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: F9D834FD-6EE6-4A56-97C6-9335D5F92126\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":237,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 14 x 44, 8-bit colormap, non-interlaced","md5":"5ecca260da6fc5e2843405c20ac69817","sha1":"3918cfad7493b6860ded9e259ba90bc6a853f1b1","sha256":"078a4aac39c49a33cbabf23cda7579fa7b76e875e6b6d24d16cfcbf9f8b250df","sha512":"b76a870a79a87a450e5d30a218d75093b57415c563e64a8ffd6839a31b36379dbc08398698b9c1368ecda671d65045d5cfebe3363b98d746d89dcaad15bcd8ce","ssdeep":"","tlshash":"6dd0a99be2076faed1c70bb3732e0ca18a8124e892944b088042c622ca663a1dd82042","first_seen":"2025-08-29T11:05:53.221032Z","last_seen":"2026-07-22T12:19:11.132207Z","times_seen":2431,"resource_available":false,"data":null}},"time_used":1053,"timings":{"blocked":741,"dns":0,"connect":0,"send":0,"wait":312,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/sports.60212fd6.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.986Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/sports.60212fd6.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 116532\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-1c734\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962714=X3amY441wvsjAI1xw2JJgjckwuib0itIgNKTTS4NwHGbaYMcSRe9Bsnv0C3cyCDUIDx9T8QKGfZZfGCtT7uRYZgsMcieRNZeslPqWb/4Qlg/gtt9evqjFMo2W1swogb+bhGIGk/Uy0+30C3DWkmBEvT48k/4zm2gOAlx12joojS2ndPSWw97gihjAzM8RQQv\r\nAge: 249785\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: E02112CB-E9EE-49DD-A1C5-42295A1D9F51\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":116532,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 666 x 541, 8-bit colormap, non-interlaced","md5":"fc82aa907334f929011fc2a6ec906f55","sha1":"f76bd75b9d1235807c70c7d763a1865d7c3f8d4e","sha256":"2ae1d61176960d7ddfddcb30a69d22b9da893687370d8cd26f4917d129a1bf3b","sha512":"12ef7a828d7d4228596b0db0ad77b200e8ffcfe2457d12821a4e9778b62668ebeef075c2bc79076e36291e3015afbfe276a2ca230ead018b38e2d3fd803dd31f","ssdeep":"3072:/ZEgiWqpGRwEyiwX0wgOZzbKoSxNiSvrUeO4h:/ZLf/R2iVwgAKoSPiSvVOy","tlshash":"76b3021c79775a2083c6bcb40b583aeae09b3dc19d169808d68b7791993df43c970bed","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T12:19:11.200759Z","times_seen":2516,"resource_available":false,"data":null}},"time_used":1358,"timings":{"blocked":737,"dns":0,"connect":0,"send":0,"wait":312,"receive":309,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/ecb/8f8306425eba6e0167bcdb25a31b67ec8f","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:14.787Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /ecb/8f8306425eba6e0167bcdb25a31b67ec8f HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://x78d.xyz\r\nXign: ZATrr+dC3gHL/lyzpfIBwc3G4HTLwrt1G2QSyRoYPP8EOV5QDqdLFrZL/eXUIvMvovgCKdRLivbSwjC+QPWLmKR2ATarFcqqIiYJp9+ZlR5TnyJ8foBe9ywHzTahUFdG3CAgrAq0j5KllnKG00C29HN1P4CV9yTzMpAJ/sfyE8E=\r\ntimestamp: 1761962714777\r\nsign: 41r20a3b212u203s\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: Kc3Md8YTTSx5jDErM6fkSDaKwC66eyT6\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:15 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Sat, 01 Nov 2025 02:08:15 GMT\r\nCache-Control: public, max-age=180, s-maxage=180, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962715=rr8RSxjhoP257i6Bcaw8RAyhBBSN9LM0Zm++tGYblKe4lINKan0tJxjQ+awisU8PAffPWL2lcq89/R+JBdA2+2HktmKNjDSnqKoe2VIyZmQ3Jj1FpRTp4eaNKE7YN/wPW35Fl7rDBMfqAKJhefHKWxPz13RlmOx2Fr6dM18340tRhTsZua9KEtmXkrf8aDdq\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: AA388324-D3B0-41B9-8429-5FD7A1EE7CAD\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3609,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"125d2292df3312ef1ecdf94c2ca21701","sha1":"89e0e5dc6fb2e1599292d3df8f6eab036ae0539b","sha256":"da6abb938bc977dd2e572731c7d87c8c0abaf5f803b6c8799b2754cdb5b26765","sha512":"4623bfc8a15340f3a2a226b2cd7502109b655ef0ec88200110aa9a3286f61c9b6adad10d37b409e03dcfe1b5d2ffe9b1dffef80f971f2f9642552fb07e1024e6","ssdeep":"96:eOGS7hTEAd9FXFQlxFV9bfTBk6qGQwXD+K+xnM2CEaN4BzB4NQi4QPrHo7pVzGI:VP7Sk3KlTVBfOGQ46fJho4BUQHUjoXp","tlshash":"c5b13dc5016cb738e7b418eeb9184be8a04553dccbfaebc6d06345d0a45a482dbae507","first_seen":"2025-10-31T13:59:12.496876Z","last_seen":"2025-11-01T02:05:52.04741Z","times_seen":2,"resource_available":false,"data":null}},"time_used":545,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":544,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_0b2c7f25-c17b-4d07-adb1-68f1823633a2.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.305Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_0b2c7f25-c17b-4d07-adb1-68f1823633a2.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:24 GMT\r\nContent-Type: image/png\r\nContent-Length: 17930\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Oj4etnM%2F%2BVoGslB8uZoa85lpGbz7gLMNVSjNuwT9yeek4en5wuRn7Oos1KI%2FVn6vmj9mJFT3rz5Men9QdtErn34S1k0wPero%2B8vW1ZODgJBH1rBEZut3j%2FpcH4V8\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"20f2a955c113cb54ff31889b4b042acd\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:08 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246256\r\ncf-cache-status: HIT\r\nCF-RAY: 996057967b6be2dd-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962724=YU9bYjGsHZpkDyPVDEE8aKEKqtv7ehFHCPTl2W+oayCppguVc/1dBerKf8UGlbUuR7n013yXKpkjWhkuSfd9gpHZRPQsz3txXbqWmWcU4HsWI0ywsC7pOPwDOlFPr76gy/f9LnBDEv8/np/CDmhGfHkJlp9hYiRm24bt/t+9OnXnAsEJggqtt5pkl62DCU8C\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: A0AEED63-A3FC-405D-B627-92AD9BB8983A\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17930,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit colormap, non-interlaced","md5":"20f2a955c113cb54ff31889b4b042acd","sha1":"08d9f6359743b39286cd78531671d615884b616b","sha256":"660aadafb61000d1d9b2e9e90096092fadb32dc8ef671b25ad5014bd47dc5ae6","sha512":"e6f587ce2b92baf6ffbc0de68413ac2d3af7f3c01ac9039a23a21b5beb2835194260ae1440db3bd75a5419db91df6a265adbf536abfdff92665bb476b66ea3ed","ssdeep":"384:jtp0ai9STNjk9ZZZL3Gt+m4OZZ6r6ZuImcZtiknaMu9Ov0:UaqSBjk9Z3G+m4OZor6rmcZJZu9Ov0","tlshash":"2682d00a499faa97dd8bf53bf949660208c1804a282dbda394e456d3d678dd4ca3313d","first_seen":"2025-08-29T11:05:53.266681Z","last_seen":"2025-12-29T13:58:58.061767Z","times_seen":295,"resource_available":false,"data":null}},"time_used":1615,"timings":{"blocked":1288,"dns":0,"connect":0,"send":0,"wait":326,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/appdown.6e7c9177.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.996Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/appdown.6e7c9177.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://x78d.xyz/css/index-399e2569.1756903329400.f2d3fd45.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 10111\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-277f\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962716=iQZav/OuEMgHx3A+Cgvm74+GIW90PILhstcwg2e9np8wh65/JtzJfcVNs0hYy6F1MXFrg0PN+RhRCRvZhb4TAOTk81ZqLAYJZBgpoe2BeYdMPjW57UhHMqtWkHx+WpnjTSKsHj2SPkpRpdkPCF/y47HldzpG9CXOfMTux5wuAsaV4o4Hcwn93D+dVrWExdCY\r\nAge: 249789\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: F33C74D5-4999-40D5-91D2-EBC3A8914FB2\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10111,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"716d097b193628397635cfac41b561fa","sha1":"545d1876219bed15fe850a499a08322de6a26866","sha256":"50276d87fae9c1e30a32c32b4e90dcc2e227cabb4e3bb1d60ecb22fb50c5f2ff","sha512":"47ea5928e921bec4ce4d9c807ee921f6115a6dd27af6fa7325e6d988058d22cf36c03693ebc56665203809cfd6d008cd410380e688e90b36d7eeec18ce6aa92f","ssdeep":"192:cALsiDRih/bWKl4Hq2BHZE6+3paMeCsuTvB6hi6tswYmd:lBEv2Hq2BHS1ZaMJtB+tsud","tlshash":"4622d047a584327b826ec79c8fe98c112470ad1ce6f04d5ac44e711128e8df3503baf2","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-07-22T12:19:11.177278Z","times_seen":2380,"resource_available":false,"data":null}},"time_used":2258,"timings":{"blocked":1937,"dns":0,"connect":0,"send":0,"wait":320,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/15217773d4772f52b4250be718e1c3de95d1e?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.791Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/15217773d4772f52b4250be718e1c3de95d1e?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 34502\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 0\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"15217773d4772f52b4250be718e1c3de95d1e\"; filename*=utf-8''15217773d4772f52b4250be718e1c3de95d1e\r\ncontent-md5: xF/OsyqLzCH3cS+41hUctQ==\r\ncontent-transfer-encoding: binary\r\netag: \"Fj-9ZwuDFasU5X-oMlFNiNlsZOsW\"\r\nlast-modified: Wed, 06 Jul 2022 13:03:15 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-10;QNM:fn200;SRCPROXY:fn271;SRC_***:13/304;SRCPROXY:14/304;QNM3:15/304;QNM3:25\r\nx-m-reqid: r9R0dHvTj\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Validate,Hit\r\nx-reqid: y-AAAACd9j7EhWQY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":34502,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit/color RGBA, non-interlaced","md5":"c45fceb32a8bcc21f7712fb8d6151cb5","sha1":"3fbd670b8315ab14e57fa832514d88d96c64eb16","sha256":"0c839807cf467c13414c8ce3b4623a37888dab0a937f1578ed971b0db871f169","sha512":"c551a6f615a8416f3e8f487e23fc3112d45ffacb42fbb18eaa68c9cb7708c26fa62054560438590b33f6785ad7e15eb139cefc37fd63a56f9a3837060c66bee3","ssdeep":"768:sxE/rN/n87lAYd16xuV7WeCAQ9QLWUrU03iIraCx:sG/rd896HHT9QdwCx","tlshash":"45f2e1123ffda03b341ee25f174d998ccc6b2554e57e1bfb2144e046b2a0e642a5e9f4","first_seen":"2025-01-29T13:39:14.654878Z","last_seen":"2026-07-19T02:02:15.175285Z","times_seen":224,"resource_available":false,"data":null}},"time_used":7281,"timings":{"blocked":1553,"dns":0,"connect":0,"send":0,"wait":1970,"receive":3758,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/weihu.49a14962.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.615Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/weihu.49a14962.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://x78d.xyz/css/index-399e2569.1756903329400.f2d3fd45.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:23 GMT\r\nContent-Type: image/png\r\nContent-Length: 2126\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-84e\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962723=q5gfVVRnp2eesXQfmCmKo6Suz0pQ27tifnGaf//NQOvM4Nui1udF0IlhUHcCvjPSHgHgIXtNP9CUbArEJzh5NJ7K3cuONguK3iT+Cd58oT8DH8JBG1/dwkqh59iWnpF98gVHX5n2gTZ6kCNUP1U5JZDC2KhMOh/Xh9jUYVJDd1re1TwJiLyqq2JwmHbEEMIp\r\nAge: 235160\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 2D866132-6A38-46F4-85EB-CF4965C2C7AF\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2126,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 165 x 137, 8-bit colormap, non-interlaced","md5":"f45e601eacd1a51add606050d2d843da","sha1":"b1a0568cad7dbd35bf562468a33a6609f2dfa11e","sha256":"4fbc5c06299c9916a03562acb78b4dcc5eb94d833516b17b1f0542ab0fb3de95","sha512":"516c3bdaa6616051458bcebfc6173abf020fa37c38e675e96715e55894ff4ebc72983024da196a7612bab4f4eb1df9742e05ce213d44c6a6a30fcf7c0749f4b6","ssdeep":"","tlshash":"7e411c037c240d349bee7d7208d55173d9e1580c69b9b760396fa4b87c2130fa955023","first_seen":"2025-09-01T05:05:19.834317Z","last_seen":"2026-07-20T04:42:17.217151Z","times_seen":516,"resource_available":false,"data":null}},"time_used":6642,"timings":{"blocked":6306,"dns":0,"connect":0,"send":0,"wait":335,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/64906.1756903329400.e9e9ec75.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.721Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /js/64906.1756903329400.e9e9ec75.js HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:14 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-35295\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962714=X3amY441wvsjAI1xw2JJgjckwuib0itIgNKTTS4NwHGbaYMcSRe9Bsnv0C3cyCDUIDx9T8QKGfZZfGCtT7uRYZgsMcieRNZeslPqWb/4Qlg/gtt9evqjFMo2W1swogb+bhGIGk/Uy0+30C3DWkmBEvT48k/4zm2gOAlx12joojS2ndPSWw97gihjAzM8RQQv\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 9A6F813F-4323-4398-9234-18EAD0859B3B\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":217749,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64884), with no line terminators","md5":"18789db02e1943b9b6e2a4bc1db4cc9e","sha1":"ab3db8b123be3580e4d5198c5ca7b99e0cd00d4a","sha256":"381bb6518856ad825c2e3fa1ec233fefa0ef52a11dd2a2dbca840381687dedb3","sha512":"6895a97c1c487d492779c4d0166bcdf0599a8634c8af8c051b573d84f001b730738eb8194f5edb5ca5eebff733289c293cd9889ea0b373330a3d9860cea872ca","ssdeep":"6144:9MhEyLkbLniyyeBHlBfb08rzZAncbtiTisXuLCoSltnIwb/mmtMDj0Rts:9MhEyLk3niyy0HlBfb08rFAncbtiTisY","tlshash":"3b241b94b690b17883bf85ff7224a164e24e1f9860cc9de4d26e2b407f12706b8775ed","first_seen":"2025-09-04T00:49:32.707517Z","last_seen":"2025-12-29T13:58:58.048456Z","times_seen":418,"resource_available":true,"data":null}},"time_used":551,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":519,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/52388.1756903329400.521cb32f.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.757Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /js/52388.1756903329400.521cb32f.js HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:14 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-6b1a\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962714=X3amY441wvsjAI1xw2JJgjckwuib0itIgNKTTS4NwHGbaYMcSRe9Bsnv0C3cyCDUIDx9T8QKGfZZfGCtT7uRYZgsMcieRNZeslPqWb/4Qlg/gtt9evqjFMo2W1swogb+bhGIGk/Uy0+30C3DWkmBEvT48k/4zm2gOAlx12joojS2ndPSWw97gihjAzM8RQQv\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 3AF581FF-A102-44E8-8D8C-03C6098E9DE5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27418,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (27172), with no line terminators","md5":"cdd31eb0b7ccfc1eafcead314123dfda","sha1":"2bd4708c1e30cebc08cdada8ef890baec6ef8622","sha256":"669b207d5cf11b0e229699f6e54104836b252c5398e20c4bb564b89b2525f0a2","sha512":"9c48059df23c4a9632eed22a28d883786e40c593fe3ffddb9144fbca21a45322121e36580084fc642e9058f086d3657d819f5d2b9528a91633aeb2085cd5ff06","ssdeep":"768:f9Vl3u/ffsp3aNWchZ4IIATAJ016fkmD19mprq2xd7QjDv1gyT8CpYCVc5WsNiU:8308O1cq2TlW0","tlshash":"84c20a80d6b4f5fd636ec9ab8a3a8464602637c5b0c8ace095ec6e8c3d4475774788fc","first_seen":"2025-08-29T11:05:53.257205Z","last_seen":"2025-12-29T13:58:57.988641Z","times_seen":422,"resource_available":true,"data":null}},"time_used":443,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":443,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/kc523-1/sponsor/sponsor_web_1.png?1756903280095","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.809Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_web_1.png?1756903280095 HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 42326\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-a556\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962714=X3amY441wvsjAI1xw2JJgjckwuib0itIgNKTTS4NwHGbaYMcSRe9Bsnv0C3cyCDUIDx9T8QKGfZZfGCtT7uRYZgsMcieRNZeslPqWb/4Qlg/gtt9evqjFMo2W1swogb+bhGIGk/Uy0+30C3DWkmBEvT48k/4zm2gOAlx12joojS2ndPSWw97gihjAzM8RQQv\r\nAge: 249791\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: F7B6CDE3-65CF-49FB-9835-AEC9B6CA2CA0\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42326,"size_decoded":0,"mime_type":"image/png","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 428x169, components 3","md5":"e0ecbe5a9349aaa328ffd6f9515f9007","sha1":"79ebc30d345c812a3e3a122f152829d161b00a52","sha256":"452d27839b3f3f35d11c9a26f06d6cc9db56dc8c61261ee43e0512f69abf71f4","sha512":"fd322bf3ca925ce2eb45317adae1dee0f1c2e4f30035738052a97ccc054ffb576a92a46758559c8d13cff6be549caca5541d14c5692cbec2758ab2b3c7f3324a","ssdeep":"768:2o9mjFjepo5h5jLasrCO57PIrvmMOSf4t7q5bo6Wruv9CSMsfRLMD7XZ0:2ogpymTxRrwmDSM7mbo6WrutR60","tlshash":"8713f2ebe1075d80bb946c9b3925eec61da50f047bc78d68c5e055f921290bb0fa33a7","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T12:19:11.229966Z","times_seen":2250,"resource_available":false,"data":null}},"time_used":920,"timings":{"blocked":607,"dns":0,"connect":0,"send":0,"wait":311,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/kc523-1/sponsor/sponsor_web_3.png?1756903280095","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.813Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_web_3.png?1756903280095 HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 40879\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-9faf\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962714=X3amY441wvsjAI1xw2JJgjckwuib0itIgNKTTS4NwHGbaYMcSRe9Bsnv0C3cyCDUIDx9T8QKGfZZfGCtT7uRYZgsMcieRNZeslPqWb/4Qlg/gtt9evqjFMo2W1swogb+bhGIGk/Uy0+30C3DWkmBEvT48k/4zm2gOAlx12joojS2ndPSWw97gihjAzM8RQQv\r\nAge: 249788\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 9B6F2258-57FC-4AB1-B69D-618402063691\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40879,"size_decoded":0,"mime_type":"image/png","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 428x169, components 3","md5":"c26161f438986f6e2d677c34d653285e","sha1":"faf6c47a013a9944bb8cac197688908422992039","sha256":"58d11e173550b3420b35c4e4be3eeb76b59ac790d9fb59b535ffe55d3b470fa9","sha512":"97649de556447ef6aa6cdd7d0bec46837cfb328335daa3b862cbaa5e23ca5a8f2af296703c9e961cbad02bb797ebf1f99ced2d1d245fbbb3a428e39d26428c76","ssdeep":"768:ub+4OMIuYE3McXMuDR64Q7sRFKJdsCA1Hunj5tyKxGGTVtkDGlT2oTO:uS4OMXYODNDR6XsRFisCAk39t6oi","tlshash":"db03f108254f2d4466ec90bbc7a1e0f7ee1d103dddb7e30c35a685163e46ca559fa0e6","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T12:19:11.133015Z","times_seen":2225,"resource_available":false,"data":null}},"time_used":1218,"timings":{"blocked":901,"dns":0,"connect":0,"send":0,"wait":316,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/kc523-1/sponsor/sponsor.json?1756903280095","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.948Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor.json?1756903280095 HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:14 GMT\r\nContent-Type: application/json\r\nContent-Length: 646\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nETag: \"68b00b6f-286\"\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1761962714=X3amY441wvsjAI1xw2JJgjckwuib0itIgNKTTS4NwHGbaYMcSRe9Bsnv0C3cyCDUIDx9T8QKGfZZfGCtT7uRYZgsMcieRNZeslPqWb/4Qlg/gtt9evqjFMo2W1swogb+bhGIGk/Uy0+30C3DWkmBEvT48k/4zm2gOAlx12joojS2ndPSWw97gihjAzM8RQQv\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 3681A05A-726F-4550-8DD0-11314065380A\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":646,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"10d2161de8cf99c474812f4c43645a26","sha1":"71884ef7281cdcb5084088f16d4550ce8790e634","sha256":"bb02fd7438bb49dd4decb6f76a71f11e93355332fd9f965d6f9f13bb8175aeca","sha512":"bf0fd1232309fcc5582d5c42644e1c7b4b8d235b1066e988ff55e0dd94a956f89742401f00c2d904359041c8e0c2bac8e9316252fab60db5eb0a3b4c935172f0","ssdeep":"","tlshash":"d8f0f44ad8b25b93211fb57c58cd050470294a8f0eccaac4baac987c4f598ddd1e839e","first_seen":"2023-06-16T04:51:50Z","last_seen":"2026-07-22T12:19:11.117047Z","times_seen":2636,"resource_available":false,"data":null}},"time_used":460,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":460,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/f0f83841-a720-4f18-8acd-c726f4c1e685.jpg","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.631Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/f0f83841-a720-4f18-8acd-c726f4c1e685.jpg HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:23 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ibefibxMSzUFq54DMoA%2FX%2FFujWedu%2BxM8WB4%2FBHaEClITNfLAIPU%2Froiq8U6Ud4xrHq9PtRX6Vsd2266NhKDqTjLajbBnjzMqp6qrEjC7GgW%2BwoT1BdDy4jjJg%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"9a51e62132d61aed9329d3365be2ebe0\"\r\nLast-Modified: Mon, 25 Aug 2025 10:17:44 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 4525\r\ncf-cache-status: HIT\r\nCF-RAY: 9977d3ad8e9a8c2c-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962723=q5gfVVRnp2eesXQfmCmKo6Suz0pQ27tifnGaf//NQOvM4Nui1udF0IlhUHcCvjPSHgHgIXtNP9CUbArEJzh5NJ7K3cuONguK3iT+Cd58oT8DH8JBG1/dwkqh59iWnpF98gVHX5n2gTZ6kCNUP1U5JZDC2KhMOh/Xh9jUYVJDd1re1TwJiLyqq2JwmHbEEMIp\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 85FEE0A8-CE81-458E-A224-B1954C23A004\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":363024,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 1884x434, components 3","md5":"9a51e62132d61aed9329d3365be2ebe0","sha1":"ba931e82f0a0d6918ce044f0f615558efe8be66c","sha256":"71597c4dfe22a7312b692b0cd0a2f44582566617510a23883a44e84045882362","sha512":"9d94dc049160f5dae8daa5ac6038b90087c0093987feac83bee54a97063ee0b46a60f8ee5172d1726662db7c938489fb08f99a98df4020ab2756be9f83751339","ssdeep":"6144:QQgiqnqSjhCWWT0HqPrWJehmhH6rFITZWJEkA0DmfsskR7s+kQXpNhd3:QYiqSFMT/jWJehyaJLEFssE7O+3","tlshash":"e37423928e8f8c8257bf9f7114027c4e9048dbc6b9d107e05238de998efe508d6ac68d","first_seen":"2025-08-29T11:05:53.128791Z","last_seen":"2025-12-29T13:58:58.049671Z","times_seen":343,"resource_available":false,"data":null}},"time_used":7830,"timings":{"blocked":6487,"dns":0,"connect":0,"send":0,"wait":532,"receive":811,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/1454508d28a545bbd4616a2a2653c7c8c0f29?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.705Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/1454508d28a545bbd4616a2a2653c7c8c0f29?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 15879\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"1454508d28a545bbd4616a2a2653c7c8c0f29\"; filename*=utf-8''1454508d28a545bbd4616a2a2653c7c8c0f29\r\ncontent-md5: Jg8ZBYBjpotUbBzhlWn1SA==\r\ncontent-transfer-encoding: binary\r\netag: \"FrebNVHsoTyqdRuEHp3Y3ehbEQd5\"\r\nlast-modified: Wed, 06 Jul 2022 13:05:47 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-25;QNM3\r\nx-m-reqid: eOFmCpXOV\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: ZaUAAAAGX4KMvHMY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15879,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"260f19058063a68b546c1ce19569f548","sha1":"b79b3551eca13caa751b841e9dd8dde85b110779","sha256":"0c79db842bd26399927e2ec0d19d4b8bc72d5cb6b1503b1ae20a1626a5af76e7","sha512":"5ed5da11489565e24ca32f66f026d98669739907e080b027507284fbe9afcc647cc68987b90bf5fae54edcb7b3579fbc7f0836a7c39b9bffdffe6717137928c6","ssdeep":"384:bSnkS/yZkhVmqWQCdA2+bUfZDIWlc65kZzZyC1FtFZGzM:UyZkhVTCdA/wxsWik4ZyEFtKzM","tlshash":"f362e187dae1a2c79000b29b2f0f0e5f72fd73a1356c7298d630215246ef57299e7b42","first_seen":"2024-08-19T15:20:18.70949Z","last_seen":"2026-07-20T00:17:14.861906Z","times_seen":85,"resource_available":false,"data":null}},"time_used":5910,"timings":{"blocked":1638,"dns":0,"connect":0,"send":0,"wait":1969,"receive":2303,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/24033a17c7ccffc674d1daf5a4e04a2aea49a?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.829Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/24033a17c7ccffc674d1daf5a4e04a2aea49a?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 96366\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 0\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"24033a17c7ccffc674d1daf5a4e04a2aea49a\"; filename*=utf-8''24033a17c7ccffc674d1daf5a4e04a2aea49a\r\ncontent-md5: ZfAfBx+xdpa7oPszxCsN8A==\r\ncontent-transfer-encoding: binary\r\netag: \"FhVcfDyZTSlyLAgbs_sBRDEo0yFj\"\r\nlast-modified: Wed, 06 Jul 2022 13:02:29 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-20;QNM:yzh163;SRCPROXY:yzh151;SRC_***:35/304;SRCPROXY:35/304;QNM3:36/304;QNM3:58\r\nx-m-reqid: un0q2tLQ6\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Validate,Hit\r\nx-reqid: nK0AAAA5yLOebXMY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":96366,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGB, non-interlaced","md5":"65f01f071fb17696bba0fb33c42b0df0","sha1":"155c7c3c994d29722c081bb3fb01443128d32163","sha256":"186163b2912f6d27a82da86c6fcb0f655ece3edeb69951bc37dfdc0ca001f174","sha512":"0cd643fa6e35a3eff7b4d5910794a5befe6229908a9bd300d63b5fd72fd85d5b2038cffbba384ac0a17d46739ad090f7108b96860e1de945d61651815f463985","ssdeep":"1536:aHxB3sVD4I64KMtYRYKeLlPAP1gedpOK9wjRK86NvGWJy0qaP+rEa8Zeb90kDwRv:CxBqH67Mt0KnUf4R0GWI0qaWo5eJp0Rv","tlshash":"c49312ae911decf9ffaf1c076be262485cb7e7a290cd0cc79da44541091cf29ea71062","first_seen":"2025-03-25T00:13:21.772003Z","last_seen":"2026-03-28T09:09:20.946898Z","times_seen":65,"resource_available":false,"data":null}},"time_used":10560,"timings":{"blocked":1515,"dns":0,"connect":0,"send":0,"wait":1970,"receive":7075,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/14734595c0ea0807e43bebb473d05c3297eab?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.696Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/14734595c0ea0807e43bebb473d05c3297eab?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 116285\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"14734595c0ea0807e43bebb473d05c3297eab\"; filename*=utf-8''14734595c0ea0807e43bebb473d05c3297eab\r\ncontent-md5: dpvkiGrprTGDVn8hDBDndQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FtNgahBmMb8TFTh_RSjSzC3KAXll\"\r\nlast-modified: Wed, 06 Jul 2022 13:07:17 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-3;QNM:fn197;SRCPROXY:fn270;SRC_***:12;SRCPROXY:12;QNM3:14;QNM3:58\r\nx-m-reqid: oCr4fcEwa\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: C9gAAAD29H2MvHMY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":116285,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGB, non-interlaced","md5":"769be4886ae9ad3183567f210c10e775","sha1":"d3606a106631bf1315387f4528d2cc2dca017965","sha256":"6de7c6cf3e6f1d7174ebecd1dcc5c94430202989f1b5ee041229d54949796806","sha512":"09e4b45e4859f831ef4ff9d68d498476383732d2630806f3040d45585758328fc5317a7e5f584a82f4c43069a0cb414ff1381b8a22f485d1d45fa07072eae069","ssdeep":"3072:K70IUUuMicWmJgFQr37fjfciEFp8H627uLuYjcDtNK:K70IBjhDriF+HF2uK2tA","tlshash":"2db32306ef8be6f9a620f6c821d072b76196c35c63533a48feb031c61258bd755c985f","first_seen":"2025-11-01T01:51:02.95355Z","last_seen":"2025-12-07T04:35:28.713473Z","times_seen":7,"resource_available":false,"data":null}},"time_used":9587,"timings":{"blocked":1647,"dns":0,"connect":0,"send":0,"wait":1969,"receive":5971,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/1112341e623c60a65444e8af683aaff9fffd1?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.686Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/1112341e623c60a65444e8af683aaff9fffd1?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 20595\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"1112341e623c60a65444e8af683aaff9fffd1\"; filename*=utf-8''1112341e623c60a65444e8af683aaff9fffd1\r\ncontent-md5: JOVGbKEntRCx04o00jGUNQ==\r\ncontent-transfer-encoding: binary\r\netag: \"Fj2S_zHoEgwjeM2NdM9QPtH-Pq9g\"\r\nlast-modified: Wed, 06 Jul 2022 12:49:15 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-3;QNM:fn267;SRCPROXY:fn270;SRC_***:12;SRCPROXY:12;QNM3:13;QNM3:43\r\nx-m-reqid: TtY40BGfC\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: r0oAAADBCIeMvHMY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20595,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"24e5466ca127b510b1d38a34d2319435","sha1":"3d92ff31e8120c2378cd8d74cf503ed1fe3eaf60","sha256":"f099c943209968ac0e2449c2b66353d48b378a76428000780fafff4c4e414c4f","sha512":"d7980302aeadc87f164c534053ead56b8512356cbeb2b588258c4faf7355a3a285a82cc74ddf99b6e41fc8dbcaad5a64934523dfc9b43ec92783d78a88bddfe7","ssdeep":"384:TcYJJdE+1gZYUyaTfsFwc3/zbc0knWUiF0Q8aGFGTBONp2VmOh8ljUsw:okh1gWUtpk/vhUiF0QuFGTBfmX2J","tlshash":"5392e1710bbd00649f35e9ec72aa057a77180fd3271524b1743fa07a973c4a8276f25c","first_seen":"2025-06-07T02:24:34.047401Z","last_seen":"2025-11-23T03:05:29.869895Z","times_seen":8,"resource_available":false,"data":null}},"time_used":5647,"timings":{"blocked":1657,"dns":0,"connect":0,"send":0,"wait":1969,"receive":2021,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/3ce652c0-55c8-48f5-a72d-a300accd6573.jpg","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.632Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/3ce652c0-55c8-48f5-a72d-a300accd6573.jpg HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:23 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eWmlG7cqUnwEF5TH39o2mIkGxDPUZNeVhMArMbBgg6kB2s8VnCxi%2FFHM25JcNXyvYoPct7RW71CF%2FKPT5%2FWW3r6rYQuqmNV%2Bj0UHhtVDxjlyGQnNvHanz4vFk95k\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"87d1015ff2e14a1f6f7b2b57571ca887\"\r\nLast-Modified: Tue, 26 Aug 2025 07:00:51 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 71327\r\ncf-cache-status: HIT\r\nCF-RAY: 9977d3ae68f084be-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962723=q5gfVVRnp2eesXQfmCmKo6Suz0pQ27tifnGaf//NQOvM4Nui1udF0IlhUHcCvjPSHgHgIXtNP9CUbArEJzh5NJ7K3cuONguK3iT+Cd58oT8DH8JBG1/dwkqh59iWnpF98gVHX5n2gTZ6kCNUP1U5JZDC2KhMOh/Xh9jUYVJDd1re1TwJiLyqq2JwmHbEEMIp\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 0E02B42A-39E5-41DC-86D8-FF98A892CFC2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":73462,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 1280x294, components 3","md5":"87d1015ff2e14a1f6f7b2b57571ca887","sha1":"630c6eb19b1145667fe91baf84895decf0d0d345","sha256":"139b3629229801138f790ec1592df247b8ea52b64260f0303c0a1a0931578de4","sha512":"7ac7fc84e76e24ca7fc132734f1a16b3bfd476bb9234a73673d104b28c1ea1637ad53f68958bcfd59a4f6d7358595d66e9f0e569c084fbd5d98ef37a2c539072","ssdeep":"1536:TNU9iSoOFwtZ7MTOwbD5vjre3CDYP9B7/+wbU5yMNg7Rlbpecj:hU9vm77MTOwP57mCDY1cwQslocj","tlshash":"367302ca87e1f2c32e756ce211751dad416066763fbef6262ceaacb187604d54a04327","first_seen":"2025-08-29T11:05:53.280437Z","last_seen":"2025-12-29T13:58:57.995004Z","times_seen":359,"resource_available":false,"data":null}},"time_used":7170,"timings":{"blocked":6624,"dns":0,"connect":0,"send":0,"wait":513,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/chunk-common.1756903329400.8e9f70b3.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:09.699Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /js/chunk-common.1756903329400.8e9f70b3.js HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:11 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-26f1c\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962711=G+xZvJTVy3tz9h+I9aQHv8vXbXmcjZEAyki4ZZ+qsKOIzlhmhy0JmwXiDHWWst8HNXLkp2G0HqpYxBE+5w3GNZE0DdM8Ng6J2SKlqN9Hpx5dW0hz60eNbku6JSeOzKhH6Y7Nutxe1Mhh9bObFptHWtt6U70oXjn/9RNiOB8aHEo7tE9C01FnEmIuxLlUNQY/\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: E653624D-9785-4B5E-A6F3-6C19B1470D60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":159516,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"1b35e779a9012cf73988d1d4b0d9e5f2","sha1":"c139c75aed4b303657e5a48a1fb036d7fcec6533","sha256":"9231e7c73c53eeebd2a055dc9c7402342f21053dbbbdd257be62eaf29c98fafa","sha512":"53ab4c8aaf4fb2bd81c55c7356348b96d509ee4f2a91869043061c8b6ffac404ce76a6ca57caddd47e94dfa5e821a3e6a85c969cc94675fe8625cf44d689c05d","ssdeep":"1536:6ZVB2bNNcdWUc2UTC6oryXHuLmbErF/G7D1dMI5MHLui7TAN/voVG5glVbGD3tFZ:6ZVBM/TC6yjFecHLui7T4/voVG5agD3t","tlshash":"73f3e8c5b3a0f07e9a1ed53779331499b12f758274c87c60f1a1ada6bf19708a436ca8","first_seen":"2025-09-04T00:49:32.82259Z","last_seen":"2025-12-29T13:58:58.058135Z","times_seen":438,"resource_available":true,"data":null}},"time_used":2041,"timings":{"blocked":1176,"dns":0,"connect":0,"send":0,"wait":513,"receive":352,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/bj2.a8fabbac.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.989Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/bj2.a8fabbac.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://x78d.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 360604\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-5809c\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962715=rr8RSxjhoP257i6Bcaw8RAyhBBSN9LM0Zm++tGYblKe4lINKan0tJxjQ+awisU8PAffPWL2lcq89/R+JBdA2+2HktmKNjDSnqKoe2VIyZmQ3Jj1FpRTp4eaNKE7YN/wPW35Fl7rDBMfqAKJhefHKWxPz13RlmOx2Fr6dM18340tRhTsZua9KEtmXkrf8aDdq\r\nAge: 249783\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 662A5951-4554-4302-8A95-1D6359082B43\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":360604,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 641, 8-bit/color RGBA, non-interlaced","md5":"e0fe8ffeed1841f74df53c3b0c1f2db0","sha1":"77bf6dfe664cdc936776654af151f49368479ec3","sha256":"db4d87e8a403e388c54dd5d114b738c82e1d2dbe65b95630fd5782179f0d7d54","sha512":"825bf73262c2b613b6a8a8397f869db6b2cd4118e554689d228503e7a04c4e674d49c5649e4ac8e2423a7b526c0f6621c259566d0e9bb6ebfa0712a7352968fa","ssdeep":"6144:iAHwIFRCiRIygxWS9v34xfZzuwbIYGzl8BPp0eIiOk3Fg7la6RUIs4pU2:rwy0IgxDEfQwbjw8dpmiOiFgpLHFU2","tlshash":"2874238d711d48cc9c9b45003dd82d9e1c55aa2f7aab20b58264fed24d17ddeec0ea3b","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T12:19:11.252395Z","times_seen":2345,"resource_available":false,"data":null}},"time_used":2761,"timings":{"blocked":1507,"dns":0,"connect":0,"send":0,"wait":307,"receive":947,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/f0600e57-43d6-4af4-8f1c-08ad10ecab8d.jpg","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.633Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/f0600e57-43d6-4af4-8f1c-08ad10ecab8d.jpg HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:23 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2Z5npINm1kv1wsilMKK12PhTmP3YYlUZ4tJcKdVq8ZNj9miHCFuIE7rcPMyQUHBJN7bc249P2TdyRAtR7cT8fB6w4AD1ic5fvVMNqLGJFb6kREXVL8WmRNR95g%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"a66ab14232d9530ba56c6b3cf1a838ce\"\r\nLast-Modified: Mon, 25 Aug 2025 07:06:16 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 18021\r\ncf-cache-status: HIT\r\nCF-RAY: 9977d3ae7ac5dda0-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962723=q5gfVVRnp2eesXQfmCmKo6Suz0pQ27tifnGaf//NQOvM4Nui1udF0IlhUHcCvjPSHgHgIXtNP9CUbArEJzh5NJ7K3cuONguK3iT+Cd58oT8DH8JBG1/dwkqh59iWnpF98gVHX5n2gTZ6kCNUP1U5JZDC2KhMOh/Xh9jUYVJDd1re1TwJiLyqq2JwmHbEEMIp\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 117D625C-F243-4370-966F-542CAC9C7813\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":396057,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 1884x434, components 3","md5":"a66ab14232d9530ba56c6b3cf1a838ce","sha1":"7e1bd193a64756193437d09ab24ad5d6f9c1651a","sha256":"0baad519e4642a8a4454ae51b511aa61c9619a1825d1e5e29265e1009c0dadbf","sha512":"f146ae5c96ebc25388e2a67ead2f02256a7b49452031debe3ceea88efa07a1699302508dc2480641c2283786649dbad3d619a3eda67546e2180b2fe2179fdb54","ssdeep":"6144:RnkD2g7Xp2j6ic0qwwyN3TV9rOxsiitOVWkjtA8xsf5eCnqLhAi5iZS8fVSA:JQ7p2j6rxwwyNniM+WkjtAgErq18k8fV","tlshash":"668423b2c8fac94a736bf975649d99469024fc4f36df5cf9e1249c2f7602a32690813c","first_seen":"2025-08-29T11:05:53.269151Z","last_seen":"2025-12-29T13:58:58.048972Z","times_seen":342,"resource_available":false,"data":null}},"time_used":8722,"timings":{"blocked":6628,"dns":0,"connect":0,"send":0,"wait":523,"receive":1571,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/8953c3b5-a3a1-4b97-a677-4b5efb3fb94a.jpg","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.635Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/8953c3b5-a3a1-4b97-a677-4b5efb3fb94a.jpg HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:24 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z94j44J8bxlwCcy8QfT%2BgBuy6WE6LKKiTe241W7xPHU%2B4Dw9CcnYWsmY4RlbPLquFCQC0NmVu42nXWypaC4Jg0aCWBHp4Wm1KH8EbW%2Fadoicjt8yKYIjGfPUbV%2Fh\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"4ba8eca994e0876f66da342a8f47763e\"\r\nLast-Modified: Mon, 25 Aug 2025 07:00:16 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 2028\r\ncf-cache-status: HIT\r\nCF-RAY: 9977d3b5ca9909e8-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962724=YU9bYjGsHZpkDyPVDEE8aKEKqtv7ehFHCPTl2W+oayCppguVc/1dBerKf8UGlbUuR7n013yXKpkjWhkuSfd9gpHZRPQsz3txXbqWmWcU4HsWI0ywsC7pOPwDOlFPr76gy/f9LnBDEv8/np/CDmhGfHkJlp9hYiRm24bt/t+9OnXnAsEJggqtt5pkl62DCU8C\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 3F241FAE-29D3-483A-AD3E-7B1FEE16DB6D\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":359196,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 1884x434, components 3","md5":"4ba8eca994e0876f66da342a8f47763e","sha1":"5f483535de56c4253674b0a35d3877d0dd200a82","sha256":"0f95823dd45056d46accd12818e592b49ac3f5050accf68610b4371c62320ede","sha512":"6b69475dcf180cb83d799e6fce9c07ecd91df196e3821adbcd7f4eb90c3831799ba864e2c35760f72d2dc5e5e7e3b74726a83efab3f5a1c3234d965e46def7c7","ssdeep":"6144:dqJy3fkqKTt3/vdG/ZHOMjOUZgO1EjSa+6V4IG1ukzX+wPpoSLB/ON:2wstNGJZjhu6EL+sGIqJs","tlshash":"4f7412e67e777d4b86b68fb6f3d02e4811919b02dce115487854f42328eb0ece89ec59","first_seen":"2025-08-29T11:05:53.189307Z","last_seen":"2025-12-29T12:28:25.234625Z","times_seen":340,"resource_available":false,"data":null}},"time_used":9056,"timings":{"blocked":7827,"dns":0,"connect":0,"send":0,"wait":516,"receive":713,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/257347628681912c5435b9d90d754ed2bebf3?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.638Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/257347628681912c5435b9d90d754ed2bebf3?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 24029\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 963180\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"257347628681912c5435b9d90d754ed2bebf3\"; filename*=utf-8''257347628681912c5435b9d90d754ed2bebf3\r\ncontent-md5: sjuuksp5XEkDOPmfr7ILKg==\r\ncontent-transfer-encoding: binary\r\netag: \"Fpa5AmsPErLlrgXZ54INKKwy5Cve\"\r\nlast-modified: Wed, 06 Jul 2022 12:58:35 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-3;QNM3:5\r\nx-m-reqid: VayAagOvR\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: sNcAAADw_anYTnAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24029,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"b23bae92ca795c490338f99fafb20b2a","sha1":"96b9026b0f12b2e5ae05d9e7820d28ac32e42bde","sha256":"f6547cd1639e7cae8eb15dc7e18241fd203ae8b2cac4e01bf2d28d6c47594bfe","sha512":"5454ef095b411528b9531264b1c27ad88ec64314483111dbc4fcc2416f798b39373890a72fcbffdfbf4c1ece1b00fc289550c71f0e88499a9db9bc717606aef1","ssdeep":"384:5cGH2WnxT0kDSCp6VpKdBFo7vD+C5RhvxyqhzNJ2k4IKTIRfZiH9Jc80LbQ:5cGxT0kboz1v1AqhzNJ27TI9Q/QLbQ","tlshash":"beb2f1918ffb5b1939510e41241ef628bfe511be147a023fb09a880f9ea759edbb2054","first_seen":"2025-10-20T21:23:19.240739Z","last_seen":"2026-05-04T20:16:57.901873Z","times_seen":11,"resource_available":false,"data":null}},"time_used":2265,"timings":{"blocked":1703,"dns":0,"connect":0,"send":0,"wait":561,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size704x442_73525908-fb7b-43df-ab6b-ee9a1274a74c.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.384Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size704x442_73525908-fb7b-43df-ab6b-ee9a1274a74c.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:27 GMT\r\nContent-Type: image/png\r\nContent-Length: 223136\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VzfEtqhfNf0n5EpCBf%2BJAXgw2AXrSbgqX9DIZhC2d9MhoNrngFv8sXxlXRckX92iTwJE68Q1EfGFmI2oK0zd5UAPGt3fIzYXF8qHYHCNG%2B%2Bn7MQs6%2BDcMfbDlL00\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"da3b1020a9a2b09010b291184754a369\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:13 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246266\r\ncf-cache-status: HIT\r\nCF-RAY: 996057696db9e2f3-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962727=DaQzn+czGW4s8AUV75xtyTdP/KsCbn3bgvwlYe3BLSQQI7lIo0LGUvmc74g+8WEtWq/m4UyZ5pbJ1/+xshqMO/OpZWANbjoUIjrsb8Duns4JFiqY/MRtJrWrdVWNjKqH9t8CitMvPt65N9PNOiP0pKLoGtnU+n6PpEbM+7UVGp717N9m6IylUEADU1KorbL9\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 054A7733-2DFF-4DE9-A18A-91C29EFEA54C\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":223136,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 704 x 442, 8-bit/color RGBA, non-interlaced","md5":"da3b1020a9a2b09010b291184754a369","sha1":"c2d83f8c56c6e87dece5c934a28ca227ae094d48","sha256":"14b50178eb3b3f008b02476fee254dfaacb43181b760be8d3a1c7e5ff5401dd4","sha512":"3eeae26ae8746f3dd69d1640b0a791149692ef83b86997d98f0152f98376e931637a574bd82110c7765be51f0184bc8e33c9d04659f510d51c47b1bcc7be2059","ssdeep":"3072:c7iZjMzh8mXTYQ/tDoXB0TX8jLwAqw6Gw/mS5xr4OMWf8SG4DcXtHRpf7JeOrrUS:miZjMzh8mX02lo28vwAqVGoxreZHfl","tlshash":"80242397c71e3ebfe8a25c53b962143e66328042ba0dd4f85cdd14b6b12b1f50ca8d5e","first_seen":"2025-08-29T11:05:53.247777Z","last_seen":"2025-12-29T13:58:58.050217Z","times_seen":297,"resource_available":false,"data":null}},"time_used":4760,"timings":{"blocked":4064,"dns":0,"connect":0,"send":0,"wait":350,"receive":346,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/configPage.js?v=9/3/2025,%2020:46:11","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:09.682Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /configPage.js?v=9/3/2025,%2020:46:11 HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:10 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 949\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:19 GMT\r\nETag: \"68b8389b-3b5\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1761962710=bLr7Bxe+9N7cGi456Xux0ngpT+448BEJRNKUlI2uRZNYQ+auPzMEcLISwKNIz5rtce6ISFwIiaT4hNFZKe3FykBIlgDwvQCo21rn2B1IEAWx+fwNww6W4PbnvqF/wTQWD66lsUFvdb08zzTVVrQ+Gv7oUDBwNk6kKp2F8xYzf8LWvz53VTbTGCr0yJ3UvLFY\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 7CF192A5-D08C-4E6A-8844-3CBD80F17B15\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":949,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (917), with no line terminators","md5":"e6aa74bb352ef198ba3e1c9a4b01b014","sha1":"2ea8bd6b5045475a36432f7665a129728e822d9e","sha256":"73828e873c0b6e847b37d78941ca436247471dfc90a12f743964f869f75abd5c","sha512":"2faaf24fdf1e4da637af8e9f82d1778bf061b00752dfca0c8f73432ba236a7b69410a7ad2a73727bc83e6cd631fd6555c3cc0d9d3a5d8a7f81818dd66566011f","ssdeep":"","tlshash":"be117aaf57444dffcf1d7e00a08b0a5ea8bc61d261889d4da8e9cf29e1c99002378978","first_seen":"2025-09-04T00:49:32.949926Z","last_seen":"2026-07-22T12:19:11.25103Z","times_seen":2665,"resource_available":true,"data":null}},"time_used":590,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":590,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/10380fee534d252964cb48550765c97dc5d75?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.990Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/10380fee534d252964cb48550765c97dc5d75?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 14594\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1285522\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"10380fee534d252964cb48550765c97dc5d75\"; filename*=utf-8''10380fee534d252964cb48550765c97dc5d75\r\ncontent-md5: LWYFID6k5wHV0+qHpyUIcA==\r\ncontent-transfer-encoding: binary\r\netag: \"Fp2uE-o8v7oyDrDUq8I6uHwQGJig\"\r\nlast-modified: Wed, 06 Jul 2022 12:55:55 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-10;QNM3:29\r\nx-m-reqid: YNDMTuyZ8\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: _X8AAABJN22O5m4Y\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14594,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"2d6605203ea4e701d5d3ea87a7250870","sha1":"9dae13ea3cbfba320eb0d4abc23ab87c101898a0","sha256":"514c620eaa209af06d52899186bf1804e00878410f6b38d24afbd2969a04bd98","sha512":"17c989d6983a8d49de6d4c37a4b24089984146ad754b5ce4633c94389d054dfac5db27506cdeec283dacace5a1a2d8c0622cf7b94fc6c24061fe7170493e2f7f","ssdeep":"384:skcXYjEdyc2p/464YeeTHXofj39wSZb8xxK5h+Ah:sLk7Td4hYec3eBwSx83Kj","tlshash":"5b62e0f837c4934a70bd3e90dbe1da1dd3b2ca1101915f9db8a800cb9f635a2258d39a","first_seen":"2023-06-08T21:23:36Z","last_seen":"2026-06-06T10:10:24.275589Z","times_seen":178,"resource_available":false,"data":null}},"time_used":11577,"timings":{"blocked":1355,"dns":0,"connect":0,"send":0,"wait":1971,"receive":8251,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202506/_raw_size1164x872_0e80d399-2c93-4f64-89db-61a96d3b05e4.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.299Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202506/_raw_size1164x872_0e80d399-2c93-4f64-89db-61a96d3b05e4.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:23 GMT\r\nContent-Type: image/png\r\nContent-Length: 216312\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tsFcU2CVVW2P5KaPhjr0sNlyjE90M%2FRiYAQGAKnECzznXFSeDrQj1uLuJRns2406YpVldD3vWIdtNUeRvEJ5HoYMMPSa3%2FyPCA5DIVSt6TonuztIz1cIY9aSNf19\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"4a57e212f11798f459137139c2f5bb01\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:21 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246248\r\ncf-cache-status: HIT\r\nCF-RAY: 996057c6bf8f2113-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962723=q5gfVVRnp2eesXQfmCmKo6Suz0pQ27tifnGaf//NQOvM4Nui1udF0IlhUHcCvjPSHgHgIXtNP9CUbArEJzh5NJ7K3cuONguK3iT+Cd58oT8DH8JBG1/dwkqh59iWnpF98gVHX5n2gTZ6kCNUP1U5JZDC2KhMOh/Xh9jUYVJDd1re1TwJiLyqq2JwmHbEEMIp\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: E9AC4EF2-3BBA-4588-9709-AC94F18A8E53\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":216312,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1164 x 872, 8-bit colormap, non-interlaced","md5":"4a57e212f11798f459137139c2f5bb01","sha1":"0ff7a4bf94e0d27bca7e36651637f02900f4cbc9","sha256":"947dcc120d07e5be157b5e2122b563b2291e17bb797e4f253b9b721601296412","sha512":"6a2b161befcae34ceb4835b6435adfe769896ccbc56214410545d6def652290fa13df00d80490dd6111176f53b24bfbad359ef40741239fc201b5a1f0a0fcc3c","ssdeep":"6144:/nUGyYD33U0fwEG5JaO2SXnoTlxXQ7k0kYY:/nPHU0YEGPk+o5xgkZ","tlshash":"f62413abe3f3e57eb17456350ed57b6c92f23e82a3611d152ec361d2275a930c31ac60","first_seen":"2025-08-29T11:05:53.081023Z","last_seen":"2025-12-29T13:58:57.986615Z","times_seen":294,"resource_available":false,"data":null}},"time_used":2266,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":664,"receive":1602,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_bbac9ff6-d09b-48f7-9e60-77639d6ba1ec.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.389Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_bbac9ff6-d09b-48f7-9e60-77639d6ba1ec.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 92069\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=q6iYFbHYjQqD5djO37U1w%2BXUdWazjmGnAlIauz2t6MMQ%2FvvlRA2pn1RCDG4Vwrl4cO9iBuM%2FQZP1bgSOCnjrynykhL91MggmI2voOE%2FaT0iA2xjeRlBWbIcGcdeH\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"feb140fe19a10fd9e5db065a8a038f98\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:28 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246261\r\ncf-cache-status: HIT\r\nCF-RAY: 99605790acd5107d-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962728=AIoyPJP+APz7wYK2AaBXUd/rNRX8JZKH8Sn29GOjN/C76txwq97fo11K6Dp6ANTQZaELDhitkoczh/wCj1yBDc9fRM49jluqosURZInvyepPB3lB+ikZRwqJro4qDuT3woNhuyIYzr5t8IWMxzIUHQRScGuBWicniC8j1w7SIkkhTBk7A/U+DRuyW/MO09f+\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 3DF34A4F-ACCD-4B32-A343-6ECA808A636D\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":92069,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"feb140fe19a10fd9e5db065a8a038f98","sha1":"5d0134793913e11a60a320c144c99ed060e1fd96","sha256":"20a24fe332b621908f702caccd9af7c3bd5f2bb30e3688dbee74cf2e92d42da0","sha512":"52cb6adf379c2cdc5acc60267ec402948eeb494f7181d0cba92c8fe24a245dfb941834f5c3e3c05e97f6b4fa867ab9e2deca29651e25a0a224f8867f8855df6a","ssdeep":"1536:kaaOm3ctZpCgpl/Vhbyyx0ZxUfhUg0Zif6rBF8ikHy+bgM8yd41nt12S1M0tdQr9:kRMnogH/VR9ZR0ZimkHn+hxtd8i4","tlshash":"6e9302bb4743ce6ce52cf0bf0469124571f91744332b6baa70e978a4993f50fad318a9","first_seen":"2025-08-29T11:05:53.160781Z","last_seen":"2025-12-29T13:58:57.996683Z","times_seen":298,"resource_available":false,"data":null}},"time_used":5114,"timings":{"blocked":4756,"dns":0,"connect":0,"send":0,"wait":354,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/2302128d758e1ff3f488493a3fb6d052a6b3e?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.028Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/2302128d758e1ff3f488493a3fb6d052a6b3e?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 13178\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1965502\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"2302128d758e1ff3f488493a3fb6d052a6b3e\"; filename*=utf-8''2302128d758e1ff3f488493a3fb6d052a6b3e\r\ncontent-md5: vtmcy8dfJbHCerkBbI7p/Q==\r\ncontent-transfer-encoding: binary\r\netag: \"Fna-hYupwCg1b3bkWoylRqB-a9sr\"\r\nlast-modified: Wed, 06 Jul 2022 13:02:04 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-9;QNM3:22\r\nx-m-reqid: IXDi7gGWf\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: uM0AAAD-kNnoREgY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13178,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"bed99ccbc75f25b1c27ab9016c8ee9fd","sha1":"76be858ba9c028356f76e45a8ca546a07e6bdb2b","sha256":"60df905fb19e9d75761b325f5ccd73d3cc5181bdcaedcb9e4135743e8b5ede29","sha512":"ea93f418ab375bf0553dbd32184fafdfb6a8373057702844edf987ceaf5cc4a79d374f5efc0985321d9c6282356967a257beaffd9cd6f7332d73f87e8cc3a26f","ssdeep":"384:9AIrshi12rHc8+O3+oHUk+LlIEvckp13TTtAWau:shi12A8+yb0JLlIIVH3TTiy","tlshash":"e442d0d3b289e727e43e222f1b907407155575caefabebc56dc3e7281e83084b508127","first_seen":"2023-07-06T07:05:29Z","last_seen":"2026-07-21T11:05:09.966971Z","times_seen":197,"resource_available":false,"data":null}},"time_used":11784,"timings":{"blocked":1317,"dns":0,"connect":0,"send":0,"wait":1971,"receive":8496,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/1333568538ee36d3e45be9742e779c9b5ff53?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.596Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/1333568538ee36d3e45be9742e779c9b5ff53?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 10740\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 0\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"1333568538ee36d3e45be9742e779c9b5ff53\"; filename*=utf-8''1333568538ee36d3e45be9742e779c9b5ff53\r\ncontent-md5: uHDhZkWg70lKd3BJ2TFJow==\r\ncontent-transfer-encoding: binary\r\netag: \"FiIRZQPKhQBvbXZHKpryQf3-Ekuf\"\r\nlast-modified: Wed, 06 Jul 2022 13:04:14 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-20;QNM:yzh162;SRCPROXY:yzh173;SRC_***:41/304;SRCPROXY:41/304;QNM3:68/304;QNM3:88\r\nx-m-reqid: mu51VSMXK\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Validate,Hit\r\nx-reqid: Ri4AAAC_dOkoa3MY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10740,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"b870e16645a0ef494a777049d93149a3","sha1":"22116503ca85006f6d76472a9af241fdfe124b9f","sha256":"706faf0c9c857766bb2c5857a8027970be90d731a0a0f092491139ff6f1284d3","sha512":"dd4b220ab27a485f591e3bcc84e160fb61051c54606aebfa92174ec738a6295eb5193ec25df7d01e56454347243598486aad3e40bfcfdf67671366f48ebc40a4","ssdeep":"192:DUilqtz4nZCfePklj2hOdaSicW+HgJjGr5Y02ukKYBsoihzjvgHEFFznAyfvAa4:DUiVslj/ESicWLJssukpsngyNf4a4","tlshash":"d522cf81b0456716fae099360b19a7c28efbd1528a03bc9176332d1c4cef16af781b29","first_seen":"2025-01-29T13:39:14.630847Z","last_seen":"2026-05-05T02:06:34.438067Z","times_seen":221,"resource_available":false,"data":null}},"time_used":3776,"timings":{"blocked":1745,"dns":2,"connect":281,"send":0,"wait":281,"receive":1,"ssl":1459},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.esportsdata.cc/202/1/84a95b07a2cae906f8bd598c5399121b.png?win007=sell","fqdn":"img.esportsdata.cc","domain":"esportsdata.cc","tld":"cc"},"ip":{"addr":"104.26.3.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.242Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esportsdata.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 21 Sep 2025 14:31:39 GMT","end":"Sat, 20 Dec 2025 15:31:26 GMT"},"fingerprint":{"sha1":"17:3D:A0:9F:DE:47:81:66:EA:33:3D:E8:54:E5:E5:AC:9E:D3:7C:A0","sha256":"22:D9:7A:16:0F:64:68:7D:00:46:B8:BF:15:6C:E8:BE:57:96:C2:BA:12:A5:4B:90:48:16:F4:58:C4:DA:9D:36"}}},"request":{"raw":"GET /202/1/84a95b07a2cae906f8bd598c5399121b.png?win007=sell HTTP/1.1\r\nHost: img.esportsdata.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 9407\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"c96272658d367584501a5eb1bd56c1f3\"\r\nlast-modified: Sat, 25 Oct 2025 22:03:30 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin, accept-encoding\r\nx-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nx-amz-request-id: 1873917F390FB23B\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nage: 1097\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iXEgPRNFHieBRGrBIDmpaeCbLU9WNnauswpvfVqIRg4epYJO%2FaD1G5zD4A3UMtjdD0TtTRSAauSppGqqMN0%2Fo9wl%2FAl5P0J2cw%2F7C2uohA%3D%3D\"}]}\r\ncf-ray: 9977d387abe0b4f7-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9407,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 164 x 155, 8-bit/color RGBA, non-interlaced","md5":"c96272658d367584501a5eb1bd56c1f3","sha1":"7b640e4e822f67c0c349e1969fd6920f2942bd7b","sha256":"ff42c2e50409d5afd9cd84da79218caf47d27586811024d173116c13ca9ade7f","sha512":"a1f94b9c7786f05f040ce335c40134804931fa5ad3b9bfee4a97d9ee1f0fffb103c50bdb496d57096109f09cb4849940e0089e3ecf8b214f35e32a288f276890","ssdeep":"192:A2ClZinkBZWnvjmttcFF3k4Bnn1vrA2hXrC8ODcxLWc6:+lZieWnvjmfcFy4zD5huQ56","tlshash":"51129ea44bd0c5b9c70d1c6cee283b130df0b7d03dce957a5a4553f951561788aca938","first_seen":"2025-10-31T12:01:35.465179Z","last_seen":"2025-11-01T13:57:58.055468Z","times_seen":21,"resource_available":false,"data":null}},"time_used":1156,"timings":{"blocked":1140,"dns":0,"connect":0,"send":0,"wait":13,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/api/sport/match/list?sportId=1\u0026client=web","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:14.810Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nx-request-source: https://x78d.xyz\r\nXign: LQ/yjHz5Ov8tVmV8XEI3Jz1n5lEA69ybTRkkMKjCM//24NFKle54RGLoqwxUBiPHzRVoVRGZxR31p0XCKCkTE2EmWjM2biflmfKfB5+zTyxVwgS0wcIOEb/epYrVTpfML1C/C31Yp7CeCneV4wnpRD57venBQ291UyA+IR3xel8=\r\ntimestamp: 1761962714773\r\nsign: c295nd2v6250484t\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: Kc3Md8YTTSx5jDErM6fkSDaKwC66eyT6\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:15 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962715=rr8RSxjhoP257i6Bcaw8RAyhBBSN9LM0Zm++tGYblKe4lINKan0tJxjQ+awisU8PAffPWL2lcq89/R+JBdA2+2HktmKNjDSnqKoe2VIyZmQ3Jj1FpRTp4eaNKE7YN/wPW35Fl7rDBMfqAKJhefHKWxPz13RlmOx2Fr6dM18340tRhTsZua9KEtmXkrf8aDdq\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 555B15D4-C8DF-467A-8736-5443A6A5E647\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":63440,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"a2f77f674a247c4a3b38a58553097e36","sha1":"88d14b05d7262fb054c6017cccb4ca9325aef5dc","sha256":"953f00c21ea3d4e72b131e38657bac8cc1e9b3cf27c5c01a7a1fea6832633d7a","sha512":"b3c87c3a797a82ff756ec9efbc2901cfcb639ee60b47fe461e30ce287ef7fc3416a4f960c62fab745b727c39018ab43fd6d96d3570fa9407ba7f55308bc8c92b","ssdeep":"1536:ejNpNpH6D6+6I6j60606N6FaPNPcPmPkGRoJaJLJRJCqJLlrVAUnOzyBcXsbQrT2:2pNpH6D6+6I6j60606N6FaPNPcPmPt+8","tlshash":"1b532356c2dc28d92b5d22d9290e3a4cd83d6d9b0e9ff9d5ed4adf1c20e83fb9105860","first_seen":"2025-11-01T02:05:52.029728Z","last_seen":"2025-11-01T02:05:52.029728Z","times_seen":1,"resource_available":false,"data":null}},"time_used":687,"timings":{"blocked":231,"dns":0,"connect":0,"send":0,"wait":455,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/config/initGeetest4.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:09.684Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /config/initGeetest4.js HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:10 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-3a06\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962710=bLr7Bxe+9N7cGi456Xux0ngpT+448BEJRNKUlI2uRZNYQ+auPzMEcLISwKNIz5rtce6ISFwIiaT4hNFZKe3FykBIlgDwvQCo21rn2B1IEAWx+fwNww6W4PbnvqF/wTQWD66lsUFvdb08zzTVVrQ+Gv7oUDBwNk6kKp2F8xYzf8LWvz53VTbTGCr0yJ3UvLFY\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: F11AD2D1-6631-42F1-998C-53B68B5882F3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14854,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"8c1728fc2d381e145b190ab70c9bb0a1","sha1":"0b96f2760bd9ca0f1d9ffaeed79934edb645cae2","sha256":"6d0aaf3dd58610ef691fb625d47237f756c4821be2dc28950c94e8eaa7761edf","sha512":"df586fb362b77f15f597573310941d008233942242914d9791e6a38e0a642874843b4f98b66d2ffd84be5fe0a986968aaccecbefedcccc7831b559164b3724c2","ssdeep":"192:hN3ar8HuCDoNu5dq+ExNiqc4K25MB5VsaiQxta4SScQVy8QRHIqaawzjTki59r8j:fJe61XHlii5aI2PG4lyUIVKQTwwwlB","tlshash":"a762104d68f750a35553b43c8b9fa014b5388a93041cde41be9ce394af9843d9bbabdc","first_seen":"2025-04-08T11:24:52.26859Z","last_seen":"2026-05-23T23:33:56.909269Z","times_seen":2066,"resource_available":false,"data":null}},"time_used":589,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":589,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/84996e9ec3176ade04abeaca2f4bae2c97093?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.906Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/84996e9ec3176ade04abeaca2f4bae2c97093?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 29378\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1193109\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"84996e9ec3176ade04abeaca2f4bae2c97093\"; filename*=utf-8''84996e9ec3176ade04abeaca2f4bae2c97093\r\ncontent-md5: I1bzPbbaSKSRrNfpMxS5yQ==\r\ncontent-transfer-encoding: binary\r\netag: \"Fvtv11mOxPoR6H15_in6wPuJB9YT\"\r\nlast-modified: Fri, 02 Aug 2024 01:51:02 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-21;QNM3:16\r\nx-m-reqid: uRqr93m4W\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: 5g0AAADpPylVOm8Y\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":29378,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 139 x 174, 8-bit/color RGBA, non-interlaced","md5":"2356f33db6da48a491acd7e93314b9c9","sha1":"fb6fd7598ec4fa11e87d79fe29fac0fb8907d613","sha256":"893ff86050fb0ae797d89b4f285d3dcb58259d12cb98757e569e3230fbecedf3","sha512":"811111f398de849f526754f281e39fb57906ad052c7281dd5aaad670658453f7e3497fe47892f0cddae6a12374d2a44093efb3c09486ec4a9860b640f3997d84","ssdeep":"768:Y183whz2f9X1YdZnTqTaeaH8OCGBVhxRJkmSzLGA7kC49rFkpN:Nghzu9NaRVCMVhxQmSzw9rFAN","tlshash":"f8d2f2cd120198e961babc461ae8114be34cd5f3ee7a38bee9a561730651bcdd304cbd","first_seen":"2025-07-29T02:05:50.822433Z","last_seen":"2026-05-22T17:42:05.169783Z","times_seen":144,"resource_available":false,"data":null}},"time_used":8752,"timings":{"blocked":1439,"dns":0,"connect":0,"send":0,"wait":1971,"receive":5342,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_ad0ed5ff-8fa0-4231-a619-ce0616ad2a8d.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.342Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_ad0ed5ff-8fa0-4231-a619-ce0616ad2a8d.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 437541\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BjszQxYDLrVn3NTBCIXPBFly7yA4ntUiT8eV4dny7ujaTX9hZgEr%2BpdXRuZcEYD0OW0dt9dSpWMF87IAKE73DM%2F7ciquVlUqPgwMoUKUbNhSfXeQqLLBQQmdMQXB\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"022efc3205a0b1288fa238227eb86951\"\r\nLast-Modified: Mon, 08 Sep 2025 20:42:38 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246262\r\ncf-cache-status: HIT\r\nCF-RAY: 996057803fde0397-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962726=JzzEHLt9Hb5OKDgPEZRvfMAR0A/77JrXyMkda9GV0LsHvzOmoL6JsFP5kwgt0UFPW+XcC2aB9Gj9fvC6m/AeKOmAdxwAIVrn9zI0SdEk+PuwVYXkQ00iCcHMT1bZTq/XKL7CqmkSImsiXzBwlX0Vsi2F0vM7a+R/XvVzrt7iUROax41zD+ILS6/KoAW+vQ6B\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: F707187B-120A-408C-9B7A-97040D266752\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":437541,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"022efc3205a0b1288fa238227eb86951","sha1":"199eb2260e9390258f0fe010fe69365aff31a927","sha256":"d19ee176da9545bbc2d1463e31a456643804b2acc0382b4b8a6952924d15b536","sha512":"310ca94418c0c0559c34e7fb749fadd579d86e2e6d3727fb59ccf3446e54d0e2bf881283202bf0d342578af036c0384a119554cf89623afdcc8bb46498969e3e","ssdeep":"12288:4iXmQ8+GAh49y1xGL6uHhEI2qt7VMv06R7nLQItYg:4MVTp4+xGHhhxU0KnLQm","tlshash":"a29423f9140d9b6cb37673d5fc549dab26b0301fa63214be198259c70fcbd99c2ca226","first_seen":"2025-08-29T11:05:53.238055Z","last_seen":"2025-12-29T08:12:31.323425Z","times_seen":282,"resource_available":false,"data":null}},"time_used":4552,"timings":{"blocked":3226,"dns":0,"connect":0,"send":0,"wait":324,"receive":1002,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/31098.1756903329400.4108b3dd.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:14.366Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /js/31098.1756903329400.4108b3dd.js HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:14 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-561f6\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962714=X3amY441wvsjAI1xw2JJgjckwuib0itIgNKTTS4NwHGbaYMcSRe9Bsnv0C3cyCDUIDx9T8QKGfZZfGCtT7uRYZgsMcieRNZeslPqWb/4Qlg/gtt9evqjFMo2W1swogb+bhGIGk/Uy0+30C3DWkmBEvT48k/4zm2gOAlx12joojS2ndPSWw97gihjAzM8RQQv\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 39CF0287-EE29-4C98-8B64-9DAC3C6B8CEE\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":352758,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65338), with no line terminators","md5":"215815c091a19829f9fd6e5f28039f0a","sha1":"8ff2707b0ab4498bfd2bb7f99674b5a245ecceee","sha256":"06371440853645a0532df5edbbfd5c9e9661bec969aabc25b3353297c6f6574a","sha512":"34933b0388cddca0826af79fdd0f82c31c1264e87f004cd921360b19dc83a0ff188ac52a4de89427cc1c09f2785179fdf4d0ff7526d4a74a55f7971fa2738e9c","ssdeep":"1536:Ow+0YvC9jlTKAUSseG1SY46DCdlBBo3AgXOG9AsqCfCXsvCfCXsLCfCXsyCfCXsf:O/KK5sY4brG7O3SnLJNpL","tlshash":"1574b6f4c248c6fdea04ce0a7e7d6f2d50723783f2ec96c446aaf8865e91857245c4da","first_seen":"2025-09-04T00:49:32.813984Z","last_seen":"2025-12-29T13:58:58.029423Z","times_seen":409,"resource_available":true,"data":null}},"time_used":563,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":539,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/away-bg.00d4ba2a.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.600Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/away-bg.00d4ba2a.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://x78d.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:17 GMT\r\nContent-Type: image/png\r\nContent-Length: 3883\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-f2b\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962717=dWszbVNhQKjhAU7tUY87nm6BjIETh4H9u3Uzo9zi8FdaV0tc2Xc0UFR1FuwlLt+19FYqcs6ViKOoT1rJJFhFdh1NxXPGHWvZS/wNrB0JTzd7UyFZa9j1pku3wvIKhb+tNhqbBGw66R36q/bs7MG3T6CivM+u4DLxgHY01MuFUq2qT8lrNKLYTVukLR3FZSTm\r\nAge: 246264\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: C5021494-71E8-4BC7-A31A-90E82F753335\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3883,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 277 x 80, 8-bit colormap, non-interlaced","md5":"ce3e5a71ef5dcf15c030882243e12315","sha1":"d4fdd1329ecac30941a67bd5108bad525c791c12","sha256":"3c2aad01ce2fce6463d6ed3bde348515922dd019d8a670b07b53d66b39c68d3d","sha512":"f6a55d8c079529988760a1c22541c097af159a3653f5ffe89c5c31ee20371f2c879c64797319f4176be77c821294f0f72d83ad77f2a0141203c857c8f987966c","ssdeep":"","tlshash":"6f815cf693e66bd0d5675106a3a14c89624d69d925a325530923f45ec3bb1ac02fe381","first_seen":"2025-08-29T11:05:53.10673Z","last_seen":"2026-07-22T12:19:11.113704Z","times_seen":2222,"resource_available":false,"data":null}},"time_used":1474,"timings":{"blocked":1141,"dns":0,"connect":0,"send":0,"wait":332,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_b82399e1-d771-428f-9811-f7e15cda0f21.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.302Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_b82399e1-d771-428f-9811-f7e15cda0f21.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:24 GMT\r\nContent-Type: image/png\r\nContent-Length: 629518\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FX3oH3IMjANu7kZc4zf2M5Aue%2FVMWHS22zZKllfSaGOztoEuzlkt8u7SikxmeUZ7PgvZPyk8vjzM%2FN21PiCYtMUnnUki9FrXHa7ZLwOBr9r1LQUH%2BnHfwqHWXhFx\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"aa55c486b79391c1941b56cb91877917\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:46 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246255\r\ncf-cache-status: HIT\r\nCF-RAY: 9960579dee758552-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962724=YU9bYjGsHZpkDyPVDEE8aKEKqtv7ehFHCPTl2W+oayCppguVc/1dBerKf8UGlbUuR7n013yXKpkjWhkuSfd9gpHZRPQsz3txXbqWmWcU4HsWI0ywsC7pOPwDOlFPr76gy/f9LnBDEv8/np/CDmhGfHkJlp9hYiRm24bt/t+9OnXnAsEJggqtt5pkl62DCU8C\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 19B24DFD-77C9-4A1F-9799-8DCE53EB387C\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":629518,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"aa55c486b79391c1941b56cb91877917","sha1":"1631920c0376407ec024a2d73ecd232133eacd6e","sha256":"90492990a14abfb00e0f80a0dc410438868da9f50a1fa1375c5b8a0d22fe4579","sha512":"c35b5cbe89015905fa5ebcd3e57ecb40caa4bb411df88e24750604cda84f81e9772af3d0d5a46d06bc94c08b5eb561a951c5ddf2334a6e5e280f88a71d6cf91b","ssdeep":"12288:qJvko6vExt9aRTprkNOfDDUgXbZk9oGKbPCiAV9w/qvNU:q2b69gZC84oBIbwqU","tlshash":"4fd433a4ea76d7e1fb432618031c6b1a13a0537a27d0e291c28fcf7c9a41db65379352","first_seen":"2025-08-29T11:05:53.132796Z","last_seen":"2025-12-29T13:58:58.080419Z","times_seen":278,"resource_available":false,"data":null}},"time_used":3563,"timings":{"blocked":1232,"dns":0,"connect":0,"send":0,"wait":331,"receive":2000,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/css/index-399e2569.1756903329400.f2d3fd45.css","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:09.691Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /css/index-399e2569.1756903329400.f2d3fd45.css HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:10 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-e0fa\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962710=bLr7Bxe+9N7cGi456Xux0ngpT+448BEJRNKUlI2uRZNYQ+auPzMEcLISwKNIz5rtce6ISFwIiaT4hNFZKe3FykBIlgDwvQCo21rn2B1IEAWx+fwNww6W4PbnvqF/wTQWD66lsUFvdb08zzTVVrQ+Gv7oUDBwNk6kKp2F8xYzf8LWvz53VTbTGCr0yJ3UvLFY\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 7DC7D0EA-97D8-4A85-A352-3D62F91A51E2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":57594,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (57594), with no line terminators","md5":"0bef4e7c4e84f6239d22f4203413192b","sha1":"f78cb75a974a7ef4ad6fb57d114c15a9b01e7fa7","sha256":"5b262fc0f9fc795ec63fd0e9afc4330757a5084ada12fd0163e40db339faf636","sha512":"65794dd7ecf908684da4c74a3360c5ddb3f51d12288d394002038de44677de9de92284164a288ca328fdaf3e15ea9aa6f16f750431488c0f3e87d68c6df6eae4","ssdeep":"768:E0ouj7X8vtr9UL5srs7hAqpLe20TCKiNkZICSA2ohGyHukQ9aaV+TJtU+WQZLq:Hop9isrQAqVe6KekWRlkQ9hf+Pe","tlshash":"6d436c2526e435ade27ba715ec91ea49312b8701f127725afb03322bc1c32f5c677b41","first_seen":"2025-08-29T11:05:53.260224Z","last_seen":"2025-12-29T13:58:58.036511Z","times_seen":443,"resource_available":false,"data":null}},"time_used":2346,"timings":{"blocked":754,"dns":1,"connect":406,"send":0,"wait":619,"receive":194,"ssl":363},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/kc523-1/sponsor/sponsor_nav_web_2.png?1756903280095","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.968Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_2.png?1756903280095 HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:22 GMT\r\nContent-Type: image/png\r\nContent-Length: 6434\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-1922\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962722=kfzsfUw0f5QeOwOzB35C9zRbYYC1bo8MHVSYwpXnaUdNveFhhyssWExbW1NooqAwzajG/U7ziuOvfrzjYMMa2SisH+2Igfe3O0s6Am9BNqCdMMjXMSl3u2Is41Ung4zs3Sy4c1w10lLo61G2MsigkAzu1UlaHpJH/D8FVmX0q1MUV24Fyp4v8DuRvMAP3FGV\r\nAge: 249794\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: FEBBC5FF-28D9-436C-A59C-D69C6854F2EB\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6434,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 206 x 332, 8-bit colormap, non-interlaced","md5":"e31cb9f70abcc458288bb53868031352","sha1":"965f7cb9aaf0d166c21b8681b0671d17e019c74e","sha256":"33295ad776e1fde54dace5b0343c9aab9a2d70cfa8848e5cbd09065c340e294f","sha512":"acd328b1f4cb6e1c7267696487f637ea5ae4b724f7ab32516632a3eb2c8b4e374fa472ab77120230258fb49a23f54ba3988b155004b46e69519fe3ef57ee79c9","ssdeep":"192:RYc0QiGWn0WG2WmjNJMjOluoj/xrASMJmoJESULHT:RYc0QiGlHmjOo1j/xPMAG2Lz","tlshash":"c9d18ea6ea2a4a52cf8d0d633efc5b0671508e582f390826809a1d1d57767fa24a13e7","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T12:19:11.157597Z","times_seen":2128,"resource_available":false,"data":null}},"time_used":8626,"timings":{"blocked":8299,"dns":0,"connect":0,"send":0,"wait":326,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/24095bec96e8252d44434b380269b4b9caa55?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.774Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/24095bec96e8252d44434b380269b4b9caa55?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 134020\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1727997\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"24095bec96e8252d44434b380269b4b9caa55\"; filename*=utf-8''24095bec96e8252d44434b380269b4b9caa55\r\ncontent-md5: JuEYvrtIUN8wHtlpRrqQFA==\r\ncontent-transfer-encoding: binary\r\netag: \"Fgt4dTfmgh7x_P2CiuqwqWw3Y02x\"\r\nlast-modified: Wed, 06 Jul 2022 13:03:19 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-5;QNM3:13\r\nx-m-reqid: KZe7B7VnR\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: KbEAAAAVpCEESm0Y\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":134020,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit/color RGBA, non-interlaced","md5":"26e118bebb4850df301ed96946ba9014","sha1":"0b787537e6821ef1fcfd828aeab0a96c37634db1","sha256":"0d2f2b27e886fe970b30dc3ef18682604aeaddaccc129c9a4053e519d12cfb2c","sha512":"068b63f23a12beaa4063e50f75937347e52988a325d1df676166f2180b23c0e775290aa213b68af649a5cf89c934fccca3ded9aedc9f7c12a7f98084cadbd23e","ssdeep":"3072:TeyTrsPFEpGsFOp3LLbD7yG/1mri5cAtWTC9Jywk6k6ASfy:fTwpsFOp3LLLtZh1ASfy","tlshash":"0dd312378486d0a9c1f5e33caf06d9d70434192f229e2a6141fbc8efeaa9d444f74b21","first_seen":"2025-03-28T18:20:50.063499Z","last_seen":"2026-05-03T23:32:03.613245Z","times_seen":106,"resource_available":false,"data":null}},"time_used":11476,"timings":{"blocked":1570,"dns":0,"connect":0,"send":0,"wait":1970,"receive":7936,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_e50c5112-b480-4217-95c2-f187843fa431.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.271Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_e50c5112-b480-4217-95c2-f187843fa431.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:23 GMT\r\nContent-Type: image/png\r\nContent-Length: 394695\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GKSMIQVt4IC4VIh%2BK7isTlilyq6YW%2BcVOwWYxjiCWpuczh7jzeRYcd9I2Cn36DXHRBhUKw6Fb8KkvKFz9vSjLJm41xprjsoKdf1N8GYux9v7KF3xtiLF5gkq%2BKuW\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"ca824a845494796bec5f55ecc8538334\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:36 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246261\r\ncf-cache-status: HIT\r\nCF-RAY: 99605775181b0459-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962723=q5gfVVRnp2eesXQfmCmKo6Suz0pQ27tifnGaf//NQOvM4Nui1udF0IlhUHcCvjPSHgHgIXtNP9CUbArEJzh5NJ7K3cuONguK3iT+Cd58oT8DH8JBG1/dwkqh59iWnpF98gVHX5n2gTZ6kCNUP1U5JZDC2KhMOh/Xh9jUYVJDd1re1TwJiLyqq2JwmHbEEMIp\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 1978CE78-DA1F-479B-9C19-A778D388A65E\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":394695,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"ca824a845494796bec5f55ecc8538334","sha1":"9c2b5d8af27d464f37c9d295963b599bfe2beb6b","sha256":"bebf296e754e5c331ce43009b1274293b6a1a04655c7efc872798ce1c4b424d2","sha512":"6d9d216a82bf7bc4137ddb2147f4395ecc5b2f00a530040a077121d452301246d32f43e53fc60e95a3de7f6b98f2d052a635ff1ac3499c554bfd085676f386fb","ssdeep":"12288:O3HGCN8Dz0DbOdIxqZJuaWvddMynAO+PIy:RoKCbZxqZ0TMyAOu","tlshash":"418423199bc439bb47ceaa53e18143caf8416d57ac7042df982f3c141bc9160f89ebe6","first_seen":"2025-08-29T11:05:53.121779Z","last_seen":"2025-12-27T06:51:48.739517Z","times_seen":278,"resource_available":false,"data":null}},"time_used":1323,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":338,"receive":985,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/chunk-init.1756903329400.f53cb96a.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:09.698Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /js/chunk-init.1756903329400.f53cb96a.js HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:10 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-42aa8\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962710=bLr7Bxe+9N7cGi456Xux0ngpT+448BEJRNKUlI2uRZNYQ+auPzMEcLISwKNIz5rtce6ISFwIiaT4hNFZKe3FykBIlgDwvQCo21rn2B1IEAWx+fwNww6W4PbnvqF/wTQWD66lsUFvdb08zzTVVrQ+Gv7oUDBwNk6kKp2F8xYzf8LWvz53VTbTGCr0yJ3UvLFY\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 7145E42F-9E56-457F-8759-13D97B6D117B\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":273064,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (44101)","md5":"daffbf99400a4f119f452d48a10ea62a","sha1":"0ae2d45d2befd0f11ae9373195c409f491a511d9","sha256":"1dcfbbb596d333e200aa1b0e4e282c296f29bfafdee19ff4014fad30a394ae45","sha512":"8e39ce35d7f18deb579cf03330a935e18308541617b1a265e4d7f88480b4d29608598e6d2be86328106fa64c4d707e608f333319bd1e7627df53a0170de079fa","ssdeep":"3072:etwqhOIKENB85doKa/x5wc0dB5/J+UUknCqdnr4QMA/C:HENm5ox2Br+2nCjXz","tlshash":"ea441b98b3d171b846cb53e5622b1035f6ba1ca33098e4f0d219ea547f3168dd52eeec","first_seen":"2025-09-04T00:49:32.986263Z","last_seen":"2025-12-29T13:58:58.044472Z","times_seen":443,"resource_available":true,"data":null}},"time_used":1710,"timings":{"blocked":551,"dns":0,"connect":0,"send":0,"wait":822,"receive":337,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/45540.1756903329400.c33043f4.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:09.700Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /js/45540.1756903329400.c33043f4.js HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:11 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-37fe8\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962711=G+xZvJTVy3tz9h+I9aQHv8vXbXmcjZEAyki4ZZ+qsKOIzlhmhy0JmwXiDHWWst8HNXLkp2G0HqpYxBE+5w3GNZE0DdM8Ng6J2SKlqN9Hpx5dW0hz60eNbku6JSeOzKhH6Y7Nutxe1Mhh9bObFptHWtt6U70oXjn/9RNiOB8aHEo7tE9C01FnEmIuxLlUNQY/\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 0A8E13F1-91D6-4D88-A9C8-B4B12340E63B\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":229352,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"000be9e193b9b0e7a8e7e2fc6a908605","sha1":"1f04ee0d0816dcb4a310f1bf9053f36c15561922","sha256":"0968ff07195a9aad5c3f080a919c803c162ccb3bb176330b762c1e4e884e75d0","sha512":"d05ca2e4dbd262beab20be9f7872c1faf4d88129b59234fb2009c9ecc7114341558d7813d701cc5aa54dfa4ec028ab007eeff864ac6bed87a4ed8d42499954cf","ssdeep":"6144:rYD4wFsYiSGfKnCKPP6Xm9sm3MCln1OSgpozfEe5a:rYD4wFsYiSAKNH3TY5","tlshash":"2b24e894f294f1be075fc1f1d23b501af35b5e6120cc9ca0d296e6942e20b49da77eac","first_seen":"2025-09-04T00:49:32.837166Z","last_seen":"2025-12-29T13:58:58.015173Z","times_seen":439,"resource_available":true,"data":null}},"time_used":2273,"timings":{"blocked":1383,"dns":0,"connect":0,"send":0,"wait":525,"receive":365,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/bj1.17ef2db8.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.974Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/bj1.17ef2db8.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://x78d.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 58859\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-e5eb\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962714=X3amY441wvsjAI1xw2JJgjckwuib0itIgNKTTS4NwHGbaYMcSRe9Bsnv0C3cyCDUIDx9T8QKGfZZfGCtT7uRYZgsMcieRNZeslPqWb/4Qlg/gtt9evqjFMo2W1swogb+bhGIGk/Uy0+30C3DWkmBEvT48k/4zm2gOAlx12joojS2ndPSWw97gihjAzM8RQQv\r\nAge: 249791\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: F1B46C7E-1CBC-4555-8D0E-0EF17AAF47B0\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58859,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 1299, 1-bit colormap, non-interlaced","md5":"59f1176bd542d042d8ddecbe4ab2cbdf","sha1":"7251e6f8bc0bf8bf3e62e892b34540f8259dcf9d","sha256":"b3bc2f14721d5f84900af66179eb6ad69a9c8d5a89eae36f877cf09fc9872603","sha512":"c4e7f1491686b72482ba26e34fd94496fc71bec2a35ba1d7cf67391e1f47f859465ad9f0c7d286bd35f9a26132fd80012a2cd2f8133cf1c6013db4f4d27a85d7","ssdeep":"1536:jlJ0Z4kwI3cG0YXIPf/OWcFOtk2bnIlfyMcw68vTbD8:gxbsGvYXd8OtTbIsgTbD8","tlshash":"004302d3b5e9f610dd38c157a3d1c9da504483be3e938d0bebbe402629fd56840a6f16","first_seen":"2023-08-17T12:39:32Z","last_seen":"2026-07-22T12:19:11.185252Z","times_seen":2470,"resource_available":false,"data":null}},"time_used":748,"timings":{"blocked":434,"dns":0,"connect":0,"send":0,"wait":312,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.esportsdata.cc/202/1/3aa924259738d4b5dbe41b0b2e5b991e.png?win007=sell","fqdn":"img.esportsdata.cc","domain":"esportsdata.cc","tld":"cc"},"ip":{"addr":"104.26.3.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.550Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esportsdata.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 21 Sep 2025 14:31:39 GMT","end":"Sat, 20 Dec 2025 15:31:26 GMT"},"fingerprint":{"sha1":"17:3D:A0:9F:DE:47:81:66:EA:33:3D:E8:54:E5:E5:AC:9E:D3:7C:A0","sha256":"22:D9:7A:16:0F:64:68:7D:00:46:B8:BF:15:6C:E8:BE:57:96:C2:BA:12:A5:4B:90:48:16:F4:58:C4:DA:9D:36"}}},"request":{"raw":"GET /202/1/3aa924259738d4b5dbe41b0b2e5b991e.png?win007=sell HTTP/1.1\r\nHost: img.esportsdata.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 165868\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"fe863195b0aaee46b3b5837a00389862\"\r\nlast-modified: Sun, 26 Oct 2025 04:02:22 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin, accept-encoding\r\nx-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nx-amz-request-id: 1873B0BF32EB12E3\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nage: 1096\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ywwb1ISHaKkKRDHFyruqYVr%2F8TZKF%2BeenXDgFT1CZ2CeYwQvB6nYl9RFyxd6PD5tiYpZur%2FiJt4CKHqzfxEZK035TZAJySZyOuARF92TPg%3D%3D\"}]}\r\ncf-ray: 9977d387abdfb4f7-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":165868,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 395, 8-bit/color RGBA, non-interlaced","md5":"fe863195b0aaee46b3b5837a00389862","sha1":"b8371b9768f1b4d5c1a7e759dca659d262ce3067","sha256":"7a5447624ebcea024e3ad64aefc1acf6133890f20483db015d5a9439b5ae054e","sha512":"e83ac219363e22b288128ee21c26b9813a332baa7522a015f4988222117a47f92542f720b099591ef3ce05e324001521f7590ed10440df542cff122fd5a05c8f","ssdeep":"3072:q5K1nYqLf5bP4zeUyYft0kgtDE350y+j0u5AbgenPrPTAKk84ZNhR2vzf:qMnYM+oYF0kuo56j/5O/k84ZNSj","tlshash":"aff313e62ba270af3ac84236d52405703bf53ad136c0204e99de4636cbfdea253649d6","first_seen":"2025-01-03T06:47:24.540237Z","last_seen":"2025-11-01T13:57:58.045425Z","times_seen":14,"resource_available":false,"data":null}},"time_used":855,"timings":{"blocked":832,"dns":0,"connect":0,"send":0,"wait":13,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_ca5ef219-cb88-4c5a-b68c-c85984b21465.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.274Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_ca5ef219-cb88-4c5a-b68c-c85984b21465.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:23 GMT\r\nContent-Type: image/png\r\nContent-Length: 516108\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=le2YNggGAkpJOUlwYX%2FtUxs%2Fv2Ergks4F3t9fjdlnCTFALNZp8UlfpApc6rVDd0THEUGtjVKg6xFLKlUwmQXtuZ8rPZgVqybB%2BwmcA4vR4qN4Gn3WynB%2BVrS53jn\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"d4d5aca2713343207ffbc99596a6f753\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:20 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246253\r\ncf-cache-status: HIT\r\nCF-RAY: 996057a38e3308e9-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962723=q5gfVVRnp2eesXQfmCmKo6Suz0pQ27tifnGaf//NQOvM4Nui1udF0IlhUHcCvjPSHgHgIXtNP9CUbArEJzh5NJ7K3cuONguK3iT+Cd58oT8DH8JBG1/dwkqh59iWnpF98gVHX5n2gTZ6kCNUP1U5JZDC2KhMOh/Xh9jUYVJDd1re1TwJiLyqq2JwmHbEEMIp\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 56F16CAF-9FBF-495B-B895-F0E4AD0526B7\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":516108,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"d4d5aca2713343207ffbc99596a6f753","sha1":"931979c1e821d667ae318f26cbe7c7aaf7da6912","sha256":"f6b9d3f3612c0f2a397af6b94b94a38f4a2dcf82721ba9854ad7fccb9e568135","sha512":"57bf6b1df3237f5309de2aa4701d7ed5033dd815ad39d275d714c38e9e583b1264bbe89007422128be8e3987ee97e01d439752b61e61a13fba439e2bb8e6c8f2","ssdeep":"12288:h3QBwTSe071RExxzDaLj3xyfVG4LZ8hWt:tQBwTwexV8jH41j","tlshash":"3cb4239c8495886887b8e519da4f999c33c7dcec3d4cf29312e867950d0ffc80ab99d9","first_seen":"2025-08-29T11:05:53.138924Z","last_seen":"2025-12-29T13:58:58.057106Z","times_seen":287,"resource_available":false,"data":null}},"time_used":3955,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":338,"receive":3617,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/ecb/8f83064249b06e0660afdb30b60772fdcdfbb3036f","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:14.812Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /ecb/8f83064249b06e0660afdb30b60772fdcdfbb3036f HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://x78d.xyz\r\nXign: LitKCoZUSKZbRkzlxrglIhSBnmNIGLJv2ivb+QhP6QakNkiIq8VqZtvNjbOgn8TZLXO6zNPlpGufbQFTm5E6C2AwB8kWPv4Cx9xUZ4f7g8ImalFJAGXZfEEtnc8wJQu/SKkzmeFvmkEtbL6MBXiMSM7nwwnlnpPr5jgzJC7LKn4=\r\ntimestamp: 1761962714779\r\nsign: n14abo7k6g83v7aj\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: Kc3Md8YTTSx5jDErM6fkSDaKwC66eyT6\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:15 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Sat, 01 Nov 2025 02:15:15 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962715=rr8RSxjhoP257i6Bcaw8RAyhBBSN9LM0Zm++tGYblKe4lINKan0tJxjQ+awisU8PAffPWL2lcq89/R+JBdA2+2HktmKNjDSnqKoe2VIyZmQ3Jj1FpRTp4eaNKE7YN/wPW35Fl7rDBMfqAKJhefHKWxPz13RlmOx2Fr6dM18340tRhTsZua9KEtmXkrf8aDdq\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: D919C66B-4349-4A09-BB27-F4CC3C09C284\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3821,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"f669ff2ee7848ae85f0eabdc365bf7a9","sha1":"c2bb1850ea07ffe2cd91f5d237529383c9d846a1","sha256":"873c64e7a5205ee5bae214529ac1989490610cfc74140c807d75241488de5640","sha512":"6c049c6d02e04fd9e1c6e0669beafb914b0fab2aebe1518f05aaddaa505ce049dfcc5b7d9e9164e230292c3e544740ae542a9cc8f572d663e6826beb044c8a1f","ssdeep":"96:eOG3iMFIo71lhyVdz6kVu45540fcMt7ATL4dhUV0mxZDOExJauH1VjE9Tf9spPYb:VL0Zmj+kVuz01ATL4dhUV5ZJx1A97CpQ","tlshash":"bdc16f487494e3ecee6a56f87402281476435b46bec76805dacec3f35dc795191cf8d2","first_seen":"2025-10-31T13:59:12.468435Z","last_seen":"2025-11-01T02:05:52.08561Z","times_seen":2,"resource_available":false,"data":null}},"time_used":981,"timings":{"blocked":503,"dns":0,"connect":0,"send":0,"wait":478,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/kc523-1/logo/logoWhite.png?1756903280095","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.783Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /kc523-1/logo/logoWhite.png?1756903280095 HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:18 GMT\r\nContent-Type: image/png\r\nContent-Length: 6364\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-18dc\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962718=i95mbm0Nui8DbqCHTgwZJnkhUh+9wS4XzdkIHK2J5m8J4BUFTB6L0NipCfqJvRtuegXOmmjvCt+78XE8A1wZMRm7TNPI+EFgShZwbHJ9WQv0Ervy/10oYldE1zF2ablDEG7fwH7oCiu+KncsA7g1IOg6lb7qC/Y7w7oClv6sSK1kNK4QsD6OECDoim4Qplx6\r\nAge: 249790\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: B736C357-D59C-482A-BD2A-E04BF57D923F\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6364,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 318 x 144, 8-bit/color RGBA, non-interlaced","md5":"45c781dc22fa33ee3af4b9611b40208f","sha1":"85005a42a66ac2755af868d974cef7a96b3f7732","sha256":"992d312ebba7a4f7559af9b559b803b6de8be4577a26366c29066d98bb382428","sha512":"63a95d0d966dd41d636bcbedda1763579f8126b7ae5448c3f8f350aba06b05dbe81d9f615833f0bbff34bfe341c6f206a89e145ada9acb28945131c816ca8094","ssdeep":"96:T/iMk0vyTGRwuNomrrhXoC4P9IdsLM1hhpMUWBg+TM42IGWUp9PXtQJ1mTdAcsor:TqMkud+wWC4VNyhhpL/+yzV9QJM+4","tlshash":"d5d19e4301c5b55102d0521645ba005b6dfb6be0bedcc40aa497ef0609313e6fef75d9","first_seen":"2025-08-29T11:05:53.141975Z","last_seen":"2026-03-22T22:11:35.376909Z","times_seen":1124,"resource_available":false,"data":null}},"time_used":5337,"timings":{"blocked":4988,"dns":0,"connect":0,"send":0,"wait":347,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/kc523-1/download/download_nav.png?1756903280095","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:19.491Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /kc523-1/download/download_nav.png?1756903280095 HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:19 GMT\r\nContent-Type: image/png\r\nContent-Length: 180314\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-2c05a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962719=7iwiVO6DxLtk5DdvoSW0/BUTqztzqSIdgkI2jGIcMMLiKBoC967rIKVdl+4PDGTvZTM4RL0DWCySh/+xwhSuy6NGaTi+vb0YGZfJrrGOb31qOILBLkWs9PNJQhPtM0cbtz0MBi0XKDtNd8ZMlq71LTztXPLQHnYH6a06bGuXIuw/LldGEb9sdouyYq3GgEGF\r\nAge: 249777\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 9F914AD8-4DAF-46E5-8649-2621E65DA8E6\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":180314,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 820 x 600, 8-bit colormap, non-interlaced","md5":"87eaffe415a7eb41b7b4b8a868bb3b32","sha1":"575618003efbf8dc8ea781379aeff463cd0cc498","sha256":"4264138e0c015e52e3efa14e34ce9c52490316935b4667756ea631b96eca64dd","sha512":"2b06fbacffed6de2fb1d4a6db2cbd0d9c5c790f9b5a10a6dceac64ff69d300f20628c465a720102da9bd857c80be886ab0a37848929741d2bdef6eddbe0de8bf","ssdeep":"3072:iWlCRQlVF5aSW/mUdJSu3405ovKFzkRKcZjF9Km/mKg/hPFsQBhXRU0K:iWM2I405oCRncZHL/mKWBhXRU0K","tlshash":"0f0412cc23773ffbf8a0865a83fbc1599c3bfd0824e56722ea1662b5186053145a59cb","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T12:19:11.116236Z","times_seen":1947,"resource_available":false,"data":null}},"time_used":1357,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":347,"receive":1010,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/kc523-1/sponsor/sponsor.json?1756903280095","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.942Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor.json?1756903280095 HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:14 GMT\r\nContent-Type: application/json\r\nContent-Length: 646\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nETag: \"68b00b6f-286\"\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1761962714=X3amY441wvsjAI1xw2JJgjckwuib0itIgNKTTS4NwHGbaYMcSRe9Bsnv0C3cyCDUIDx9T8QKGfZZfGCtT7uRYZgsMcieRNZeslPqWb/4Qlg/gtt9evqjFMo2W1swogb+bhGIGk/Uy0+30C3DWkmBEvT48k/4zm2gOAlx12joojS2ndPSWw97gihjAzM8RQQv\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: B19B4880-039D-4E25-A0F3-12C9C1A9DF29\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":646,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"10d2161de8cf99c474812f4c43645a26","sha1":"71884ef7281cdcb5084088f16d4550ce8790e634","sha256":"bb02fd7438bb49dd4decb6f76a71f11e93355332fd9f965d6f9f13bb8175aeca","sha512":"bf0fd1232309fcc5582d5c42644e1c7b4b8d235b1066e988ff55e0dd94a956f89742401f00c2d904359041c8e0c2bac8e9316252fab60db5eb0a3b4c935172f0","ssdeep":"","tlshash":"d8f0f44ad8b25b93211fb57c58cd050470294a8f0eccaac4baac987c4f598ddd1e839e","first_seen":"2023-06-16T04:51:50Z","last_seen":"2026-07-22T12:19:11.117047Z","times_seen":2636,"resource_available":false,"data":null}},"time_used":445,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":445,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/index-399e2569.1756903329400.c784c4ca.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:09.705Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /js/index-399e2569.1756903329400.c784c4ca.js HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:12 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-5b7d\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962712=ukc3SjQKOVCf0GeyNlfM8KhwH8E6TDY/d6XgzE0dvO3s4nIAbau0ZPueCrbE8M6J+yO2AjGB3iLgHIcFDMl9OVJvbAVIr6SV1F/QZgYjD1pP/WuwbUyy+f7A9v0LajfjD/xCdc7v6xvOMZ/fepe1tp1rp32lvbav+8Te6OpgV8/IHYWdH9/c4dF1v9qD8ZHW\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 0DF4E836-C623-45F9-A1BA-7220CD38CD81\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23421,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (23421), with no line terminators","md5":"6117cdb5accd41ccb0125c70452306f1","sha1":"80f85cd8a495c476087fa382198b2a06f5d309ae","sha256":"794e522144c7d6885ba07f4654bbf62f0b06f1b985a897645092cdf029afcfea","sha512":"1737016527bd862c7804e4dd164e109c7f3a087b5c0a751764c22f8b2fa9a10f4fddb8f98234d4da33eaf7a314648d28eed89c0750dabf2006ee105b6f8a2cc8","ssdeep":"384:EZSANHLDaxKalO7PT/Wy4QfHhwrxrjgIhK47ZyQQvXTcdw5F3oWf0Af/nqxtU8X:HYDaxKUO7LZ4QvhwVEMKUZpe5FYxAfPQ","tlshash":"c6b2c6e63392bda4c24f9276f33a58ecc53f9241c30fc4f8d265bdd47da8644a992684","first_seen":"2025-09-04T00:49:32.717031Z","last_seen":"2025-12-29T13:58:58.089613Z","times_seen":434,"resource_available":true,"data":null}},"time_used":2530,"timings":{"blocked":2035,"dns":0,"connect":0,"send":0,"wait":494,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/kc523-1/noData/cms_game_noimg.png?1756903280095","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.629Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /kc523-1/noData/cms_game_noimg.png?1756903280095 HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:23 GMT\r\nContent-Type: image/png\r\nContent-Length: 4977\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-1371\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962723=q5gfVVRnp2eesXQfmCmKo6Suz0pQ27tifnGaf//NQOvM4Nui1udF0IlhUHcCvjPSHgHgIXtNP9CUbArEJzh5NJ7K3cuONguK3iT+Cd58oT8DH8JBG1/dwkqh59iWnpF98gVHX5n2gTZ6kCNUP1U5JZDC2KhMOh/Xh9jUYVJDd1re1TwJiLyqq2JwmHbEEMIp\r\nAge: 249783\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 33B74626-0A89-489A-B6F5-98D4435B2068\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4977,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 750 x 590, 8-bit/color RGBA, non-interlaced","md5":"84170735ffce6fe0e70a3136a36b8ef6","sha1":"5b2dcf1d5d92d786f1e58dc65de3dab1f35d7278","sha256":"581435520cde2b0026b4e7244a85b6eef0be740cb18c43690c420d1ec326d0b4","sha512":"bb0fc1b267c99db65ff3b9414576d3f4c0c9016e5309f2806a9f4d51c8c63383e9279c3a04daa5feda5489eb231a846b60040c71e5fa2798ca141b36ae0241f6","ssdeep":"96:nKdKn+AFdoSfrmrMDpdXd8nbZDH3mC+b2A:KYn+QK+pdXd8nbZ73mC1A","tlshash":"99a14be32b5d4badfe1e9a76a5549760ea632aff482c8c0e6887c955048b2144f640d2","first_seen":"2023-05-01T02:34:20Z","last_seen":"2026-07-21T11:55:13.314439Z","times_seen":2036,"resource_available":false,"data":null}},"time_used":6632,"timings":{"blocked":6299,"dns":0,"connect":0,"send":0,"wait":333,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_13f1f273-ad7d-4854-b9a3-7f3eb8823296.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.310Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_13f1f273-ad7d-4854-b9a3-7f3eb8823296.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:25 GMT\r\nContent-Type: image/png\r\nContent-Length: 147613\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WaDUmRYOImGsFg45McDyJGsD4bbaj55LSHIPzzZWKQPTWu8%2B6Id7Dlr1mKNf%2B9WIw9kty9gvKDR8qGFkIjFiCZFriOZT%2B3XlmhgS4%2BYt36qDS5qVBPO%2F7Au%2Bb4jL\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"1af1a4706ec456f37c4354214bb5397b\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:03 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246251\r\ncf-cache-status: HIT\r\nCF-RAY: 996057ba8f88f4fc-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962725=yIoYJXnoX32vTrxda1zOc8miVG32U7nJJc12gDZ+In6cgnf8S38tKUUUMfLseQr/q8eimpOabVTJjmX6tFPOJmPT1E15RMXJLCAOTkmUEPpCMU6llWgDlqx+fr9zASS472DYjzlMiWRiDMxvJl4PxLo/nm3fsJVZbP5/iPuwIDPxIrhHcKVoSg2HyE5+IDkE\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 756954AE-441B-4B18-9532-6EDD28C8296F\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":147613,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"1af1a4706ec456f37c4354214bb5397b","sha1":"d4598a9b6373a24fa251d1326b973cefe08e7a7d","sha256":"de9a8bcaf7e6624d23a8f8415ea12a9ba8d103f977fabbccb6ae571671dd83d2","sha512":"f0526ef7d091b072d78284fb8011400651f5f7e9472ae9fddbf272a51e5d6d60a8df34fe85134d4a54d91c61a21dec8e862a338096beea33eef944daf93152b9","ssdeep":"3072:wpjsS/+EYEXoMenKagm4TP/DImKbojBuxcpGtBoWrYRMv:LS2tfgm4nI8UxXBrYq","tlshash":"f4e31204f52a98e2cd960db23b354cc149bc5e980a4b39e5e4c3d677644725adaeb2cc","first_seen":"2025-08-29T11:05:53.134299Z","last_seen":"2025-12-29T08:12:31.364681Z","times_seen":298,"resource_available":false,"data":null}},"time_used":2571,"timings":{"blocked":1926,"dns":0,"connect":0,"send":0,"wait":319,"receive":326,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_bdd30f19-a4d8-4eb3-b2d5-d24180d2e353.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.367Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_bdd30f19-a4d8-4eb3-b2d5-d24180d2e353.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:27 GMT\r\nContent-Type: image/png\r\nContent-Length: 26169\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GamHWJP%2FMmmD94O9g78sqTXa3sgziO8754IhuWHZpDNn5q%2BmrjsHRKpRSIzA%2Bupa4iCY3%2FZrd3qLG9XDv3ltW10KFl0UC7fDrjOkQwmGFHI0WA%2FB1XJjycHNytMS\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"8e4798de63b7a1ed460a9dceb8477da0\"\r\nLast-Modified: Thu, 18 Sep 2025 11:00:21 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246259\r\ncf-cache-status: HIT\r\nCF-RAY: 99605798b9f0050c-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962727=DaQzn+czGW4s8AUV75xtyTdP/KsCbn3bgvwlYe3BLSQQI7lIo0LGUvmc74g+8WEtWq/m4UyZ5pbJ1/+xshqMO/OpZWANbjoUIjrsb8Duns4JFiqY/MRtJrWrdVWNjKqH9t8CitMvPt65N9PNOiP0pKLoGtnU+n6PpEbM+7UVGp717N9m6IylUEADU1KorbL9\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 1C6F07FA-7E6D-45F4-8136-DD498E685D50\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26169,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit colormap, non-interlaced","md5":"8e4798de63b7a1ed460a9dceb8477da0","sha1":"63fe754ff17c8577556ed86c83fb71d48741aa86","sha256":"cbbb80241f900ee2edd463b57c36b50acdaf20321e3b134aa03670231f3894dd","sha512":"998c6cad3e6c77429ae6f521b1747c47d9285cf28c06418178afd2fdba96f12e57981580a0acbc7995a618b87d81f90caf4d550da0abd637ac3b8016887d1814","ssdeep":"768:PU86xxR89xObVIibTCjG7U+6tFMAHgNDtn6Jnan4bYPT7:PUfk2VQG4LFMAahOna40PT7","tlshash":"6ec2e12706d74fd99c67667ec399c4e833b013347334e2908777cd26c4d968a88a0eca","first_seen":"2025-08-29T11:05:53.252109Z","last_seen":"2025-12-29T13:58:58.031108Z","times_seen":302,"resource_available":false,"data":null}},"time_used":3960,"timings":{"blocked":3621,"dns":0,"connect":0,"send":0,"wait":338,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_de72e240-4300-48d6-8f6e-b9cb363e7924.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.371Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_de72e240-4300-48d6-8f6e-b9cb363e7924.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:27 GMT\r\nContent-Type: image/png\r\nContent-Length: 117698\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pqfb2o1QnAYQq06wpNsLWz0g%2FlO6yLopQhqOXQE4RatB%2FL66REDGSt3%2FXf2zPJJ%2BuSgvYc17lXp6XCqtUE79g5vdelBcD1JbAr8kPh5dZtcTIsWTF%2Bh2MYyLKLUN\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"875d51b8597a97b96daa5c4c3eaafefd\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:15 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246252\r\ncf-cache-status: HIT\r\nCF-RAY: 996057c60d9c08e1-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962727=DaQzn+czGW4s8AUV75xtyTdP/KsCbn3bgvwlYe3BLSQQI7lIo0LGUvmc74g+8WEtWq/m4UyZ5pbJ1/+xshqMO/OpZWANbjoUIjrsb8Duns4JFiqY/MRtJrWrdVWNjKqH9t8CitMvPt65N9PNOiP0pKLoGtnU+n6PpEbM+7UVGp717N9m6IylUEADU1KorbL9\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: C5F19692-AA00-4A6D-BB1B-55FE731809D4\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":117698,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"875d51b8597a97b96daa5c4c3eaafefd","sha1":"bdbe15944aacbb25d3795a9882751bab0e25aa41","sha256":"5cd3cd5c2a9dd3c20ddbfbcdff886459c3dd0a3bede9ce34e1daf9059e375ea0","sha512":"718dbdb9f5dd7fe65fbcf893c416cf87efecd27eb6e9f8af92efb0cb0f5ed2831fa5a805b510322c7232db68a958b29d6bb9b3dc9ee1f0f811ef5579a71e0289","ssdeep":"3072:VqUdofN7Rg/0SAT7MpXyPJ1ZpIZlUij14AtAR9e:AUstSAT7vPKlUij+DR9e","tlshash":"7eb312f3e46e905be7bf016c22329c100d7905aa9b7e48d6a9d34b221cddeb2dcf4554","first_seen":"2025-08-29T11:05:53.31739Z","last_seen":"2025-12-27T06:51:48.781217Z","times_seen":291,"resource_available":false,"data":null}},"time_used":4538,"timings":{"blocked":3856,"dns":0,"connect":0,"send":0,"wait":339,"receive":343,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/21954.1756903329400.57c97863.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.051Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /js/21954.1756903329400.57c97863.js HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:13 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-a3f0\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962713=I6K2XWhDVA0awyfD/5xFQzalvwM45oMG7bTkJxNueBZCYyD6N0TwCQwXhfcblgZK0e+1qHgBzUP/VfG80DBDvI+wPvDt6BsZi/QJSvwomwSgNwFdR9smI1hOBvr5s69iLkzG+c/AStWnqdtCh9L+Hw/Kj/X0HziC5Mz2XrlIuLxrjd4Nn0MDGVqRQTsSm0iZ\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: A268F38B-DD10-4B18-8F0A-57069CC9B7E0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41968,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (41968), with no line terminators","md5":"e2c9f0777c63b333fc66af020ed0ef8e","sha1":"72714b7bdf899cc87c7399253e37aaa2a2f4487e","sha256":"0a2a1939d88947975b56974be20cb84a9c00f3c94cae6e057836b39aaf6b8c41","sha512":"fc02eb76f16f16c8a7346f72e7ac7ef4a68bca53cc7a5bb9f1e00b43f1bb002ca7847e2804be7d6bfe0713c3466210038acc4d5794bea5bec8f0190135f3e7e0","ssdeep":"768:DBPsaSfmzKrMdvf0eMQ/96loumY1PI1yBK9LudEz+yUy51y9y0yk6Dio+ILqpTeY:DP81R6Ipyk6o","tlshash":"0a132088fac2b06dd3eb7330857f505ae66a1dc0668c5438e260d6917e7198dc1fb9f8","first_seen":"2025-09-04T00:49:32.704767Z","last_seen":"2025-12-29T13:58:58.045079Z","times_seen":433,"resource_available":true,"data":null}},"time_used":476,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":473,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/17600.1756903329400.89772027.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.718Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /js/17600.1756903329400.89772027.js HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:14 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-2526b\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962714=X3amY441wvsjAI1xw2JJgjckwuib0itIgNKTTS4NwHGbaYMcSRe9Bsnv0C3cyCDUIDx9T8QKGfZZfGCtT7uRYZgsMcieRNZeslPqWb/4Qlg/gtt9evqjFMo2W1swogb+bhGIGk/Uy0+30C3DWkmBEvT48k/4zm2gOAlx12joojS2ndPSWw97gihjAzM8RQQv\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 2BEB7496-5F09-413C-AB2F-9915D85F9381\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":152171,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (33789)","md5":"537a1190cc025f0707bbb2a736630283","sha1":"1ac2e221c5e4e26737c6e1b7fddf2d363e4b65c3","sha256":"296f9d35557dc9588e8c6bed7134ca0e3055473306531756660582a6886bfedb","sha512":"3202114c8afb764ea0c4cd32bd78e7ad51295face85601b71b7316535d8fc29ecfb314bc1ace4ff0f54ef46a2016d09e764078ea1d7bd08ae75077ad6eab2341","ssdeep":"1536:+D5AxGst7xILpT0iiRs1vE/yKLJdLI065veGiHjLFIEfma5/xY8SbF9JiNp/QQbU:+DqxNfns1v4yKMpBesDz7+I1ou","tlshash":"d8e32a94b380717887a743b5b21f5196d22a08601098bca4f26eed94bf749ddf63ecdc","first_seen":"2025-09-04T00:49:32.979776Z","last_seen":"2025-12-29T13:58:58.065817Z","times_seen":421,"resource_available":true,"data":null}},"time_used":498,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":497,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_79864bfb-d71a-4513-a524-8823b86ee01d.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.307Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_79864bfb-d71a-4513-a524-8823b86ee01d.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:25 GMT\r\nContent-Type: image/png\r\nContent-Length: 87818\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BNAhVUubaDKmbFXfeSqOuzhcg7T8Irc9jCrbLGRTF%2FcUFU9is9DmWyE6sGK5GSdvr6a5He0NcpL9WOtk0Jf0Be%2BoOsXKKknsnSSJ4W1j7zJiejtZGMwUKds42V0s\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"aa6fecf1d92393ed340d8ecf5eb30180\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:10 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246262\r\ncf-cache-status: HIT\r\nCF-RAY: 996057786955e2f0-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962725=yIoYJXnoX32vTrxda1zOc8miVG32U7nJJc12gDZ+In6cgnf8S38tKUUUMfLseQr/q8eimpOabVTJjmX6tFPOJmPT1E15RMXJLCAOTkmUEPpCMU6llWgDlqx+fr9zASS472DYjzlMiWRiDMxvJl4PxLo/nm3fsJVZbP5/iPuwIDPxIrhHcKVoSg2HyE5+IDkE\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 23D91D02-B0B4-4E1C-AA2B-981D1864CC78\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":87818,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"aa6fecf1d92393ed340d8ecf5eb30180","sha1":"c253c4066e99708b3af4c91c8cb87f5500b9e14a","sha256":"802eb202e21b02b88c529fcfab0745795ed573a9d1a623f06c64730ef1424bec","sha512":"a2bf6e88728516abb6b6bc3c7b8475ffad41d7f8a1a3420bd00a853256faab18f42b8e358feb7194a7d5f4e327753943edd2d784ad489a3f6464ba3dfaaf8a7d","ssdeep":"1536:kBPumsnGpw4JOOR/fiF4kRtopUtzjHjt/UEqVo0xrQiGkw88TpGwB3EVchMbYi+D:k9AmJOyHOqUt/XWoErQi/wywB3miDz1d","tlshash":"bd83121fd6c96f65d8d871fd28e8734298add1835ed12e43a001a7e88f498f0a027ee5","first_seen":"2025-08-29T11:05:53.090923Z","last_seen":"2025-12-29T12:28:25.260601Z","times_seen":296,"resource_available":false,"data":null}},"time_used":1929,"timings":{"blocked":1612,"dns":0,"connect":0,"send":0,"wait":314,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/bj3.a7dbd558.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.991Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/bj3.a7dbd558.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://x78d.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 5835\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-16cb\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962715=rr8RSxjhoP257i6Bcaw8RAyhBBSN9LM0Zm++tGYblKe4lINKan0tJxjQ+awisU8PAffPWL2lcq89/R+JBdA2+2HktmKNjDSnqKoe2VIyZmQ3Jj1FpRTp4eaNKE7YN/wPW35Fl7rDBMfqAKJhefHKWxPz13RlmOx2Fr6dM18340tRhTsZua9KEtmXkrf8aDdq\r\nAge: 249783\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: B4F3FBB5-2D7F-49FB-8D03-6C437363716E\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5835,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1003 x 171, 8-bit/color RGBA, non-interlaced","md5":"b79234bcd23ce7e063481b3605bcdd45","sha1":"eace4c48cc352cfb10fb6fcffed50748f18aa78d","sha256":"2dbca2ee9a515b178cb6a5ce670a5dafa30941ad8c753fa3e94642f8dacca13d","sha512":"40fa685181391f1ca805440f53683045d1fbd5c0f36cf471f53641c6f289481f42fefc4d1f2b2fdfe8a20d7488ef0537f10352492e46af76770b49fe8876def7","ssdeep":"96:brOIaX7VK+RUSrZ3rnZ1L++y+hsVoK4CBVVikox3n0muoE7Nqh7zwGto:K7VK+RBZ3l1i+y+3peikr3oEJqh7MCo","tlshash":"91c18f03f313ed339b875f190abe4dc3498b2f9a4725a7d6285b5aa89654819c062e82","first_seen":"2025-08-29T11:05:53.328141Z","last_seen":"2026-07-22T12:19:11.196465Z","times_seen":2412,"resource_available":false,"data":null}},"time_used":2147,"timings":{"blocked":1828,"dns":0,"connect":0,"send":0,"wait":318,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.esportsdata.cc/202/1/8cf4a549ed5380ffc654a9e6a4f16b19.png?win007=sell","fqdn":"img.esportsdata.cc","domain":"esportsdata.cc","tld":"cc"},"ip":{"addr":"104.26.3.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.239Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esportsdata.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 21 Sep 2025 14:31:39 GMT","end":"Sat, 20 Dec 2025 15:31:26 GMT"},"fingerprint":{"sha1":"17:3D:A0:9F:DE:47:81:66:EA:33:3D:E8:54:E5:E5:AC:9E:D3:7C:A0","sha256":"22:D9:7A:16:0F:64:68:7D:00:46:B8:BF:15:6C:E8:BE:57:96:C2:BA:12:A5:4B:90:48:16:F4:58:C4:DA:9D:36"}}},"request":{"raw":"GET /202/1/8cf4a549ed5380ffc654a9e6a4f16b19.png?win007=sell HTTP/1.1\r\nHost: img.esportsdata.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 139635\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"466c312f7d35793678ed9bbb26941054\"\r\nlast-modified: Sat, 25 Oct 2025 20:33:44 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin, accept-encoding\r\nx-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nx-amz-request-id: 1873917F3666F528\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nage: 1097\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=85by9XnjpLi67jjT5gWSwPwyhGwlS3vPQ%2B0x3tASJiVNCu8HN%2F%2FtjinT6LUUXp0QxtZElzdUrCptcYQ4tzvqg0Rf13kWyUBYQ0LALVMWNA%3D%3D\"}]}\r\ncf-ray: 9977d387abe1b4f7-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":139635,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 315 x 330, 8-bit/color RGBA, non-interlaced","md5":"466c312f7d35793678ed9bbb26941054","sha1":"258cf59e5f31dc36a354ea698bd1469c9f8a071f","sha256":"a29373d7a4388f4e929779657b9b14cb137bd7bc1e857637f4ab2243df999ce3","sha512":"e2d45b477f53abc717773558448dbde797d42208c8f5a579d62781ba312cc4e0b113aa129c225a707c460cd0b775da1d6f3af80b052ae42b4dd8a6e3f7699df1","ssdeep":"3072:kt2ug3AG5w9pCWJTo9OHwO91mYL/n3xlgQCJTDPDz9PKyd:+AV5w9bswV1mYjn3pW/7BX","tlshash":"9bd3125d2b2fb92095fdb47852d28c976991e40f578f03126eb0126386a6bc1f4fd90a","first_seen":"2025-10-31T12:01:35.40316Z","last_seen":"2025-11-01T13:57:58.095737Z","times_seen":21,"resource_available":false,"data":null}},"time_used":1162,"timings":{"blocked":1143,"dns":0,"connect":0,"send":0,"wait":11,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/LOTTERY.4e81790a.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.619Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/LOTTERY.4e81790a.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:22 GMT\r\nContent-Type: image/png\r\nContent-Length: 59689\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-e929\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962722=kfzsfUw0f5QeOwOzB35C9zRbYYC1bo8MHVSYwpXnaUdNveFhhyssWExbW1NooqAwzajG/U7ziuOvfrzjYMMa2SisH+2Igfe3O0s6Am9BNqCdMMjXMSl3u2Is41Ung4zs3Sy4c1w10lLo61G2MsigkAzu1UlaHpJH/D8FVmX0q1MUV24Fyp4v8DuRvMAP3FGV\r\nAge: 246268\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 74E31F3B-AA78-467B-9066-52687C36AD76\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59689,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"f86c9671c7aed55212fe0eb5219a664d","sha1":"6e765dfb0ce3c646d8c808940071554e78e7d409","sha256":"4ba3fff550a17eff9585d6acbc4a96bd515149510f6a8bb7638985fb4b41a181","sha512":"706aa66f138a3459eaf34f5b7a8ffed3dfacecec6adf14a2e83f1149143cfbb059f97aaaac2032587a80c0e30c62e5b46b07b4dc6f3cf5925e6e1db2a8ed45d6","ssdeep":"1536:Cyp1EBaRnsFt9ZXZj0wEYsRvqm1waPbZsY:CLB+sFtzXN0w2ym1fFsY","tlshash":"914302f36beb0bc5b07adbcf4ed354f0067a71496b42dcd44f4120e61ea6199bac420a","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T12:19:11.249709Z","times_seen":2222,"resource_available":false,"data":null}},"time_used":7482,"timings":{"blocked":835,"dns":0,"connect":0,"send":0,"wait":4819,"receive":1828,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/kc523-1/noData/cms_moren.png?1756903280095","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:14.034Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /kc523-1/noData/cms_moren.png?1756903280095 HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:19 GMT\r\nContent-Type: image/png\r\nContent-Length: 19732\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-4d14\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962719=7iwiVO6DxLtk5DdvoSW0/BUTqztzqSIdgkI2jGIcMMLiKBoC967rIKVdl+4PDGTvZTM4RL0DWCySh/+xwhSuy6NGaTi+vb0YGZfJrrGOb31qOILBLkWs9PNJQhPtM0cbtz0MBi0XKDtNd8ZMlq71LTztXPLQHnYH6a06bGuXIuw/LldGEb9sdouyYq3GgEGF\r\nAge: 249790\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 61CDB676-4122-4CD5-BD83-67410C975AF1\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19732,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 215 x 214, 8-bit/color RGBA, non-interlaced","md5":"f3c825751a70d4aad8da2ce57f76acf6","sha1":"732da443668abb03a79a70df2d0ea8d801158655","sha256":"c395f4c1941459ef620f6df95fabd39f9ac98e03f6a389886bf224157557ce41","sha512":"a3b3fa2a216c10d331fea4771b916825d0605b94e21ac242d152d7c5e4b984cf3baad7a3fd071dde3432162037514d756cce1a0f699baf3dc98eaf75483c91b0","ssdeep":"384:64pTwcIHFqFpIlD8SqhwFLW/na2PvyQXSOKvOi58KUezsTT5ZOon:67XlROe8WvOAPHQv","tlshash":"a592d0d8abcb6705bb132b43b941a3558e0dfd6a130b9bb131782805ee16151e8d7e3f","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T12:19:11.211952Z","times_seen":2180,"resource_available":false,"data":null}},"time_used":5449,"timings":{"blocked":5087,"dns":0,"connect":0,"send":0,"wait":361,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/1660497a2a843496941a69ee4cbae8cf57e6b?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.658Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/1660497a2a843496941a69ee4cbae8cf57e6b?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 8629\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 443347\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"1660497a2a843496941a69ee4cbae8cf57e6b\"; filename*=utf-8''1660497a2a843496941a69ee4cbae8cf57e6b\r\ncontent-md5: VR4WlX1KCjGYIXXbVcCoiQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FvyT9P_KucOdv5UO8uJCHi_-eYqn\"\r\nlast-modified: Wed, 06 Jul 2022 13:06:43 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-27;QNM3\r\nx-m-reqid: nw3cfTnEU\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: 8-gAAAAy7pYDKHIY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8629,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"551e16957d4a0a31982175db55c0a889","sha1":"fc93f4ffcab9c39dbf950ef2e2421e2ffe798aa7","sha256":"0496bec9953424d4c994534cb01eccb1797d55b91cea48a4246b3431726aa046","sha512":"2714c6b41849df572bb1fccb7b52c441a3192bd670758f7fe842063d38ea20bfa65d6314cd1b539628f0774c4e1cefb736737a80d7c4b8988e460551cf1e75b5","ssdeep":"192:sNmB2SW45eJ7SZ0vW3vQZW/56Z4mHIyb27e/TIIDODlpdiLb3SW:SC2p45WW34xJIyb22DDulPi33SW","tlshash":"ca02af30bd1a4444135fe45844b49ef158aac57ea3f97a8b4c9a5510f1f263bbcace23","first_seen":"2024-07-29T17:46:01Z","last_seen":"2026-07-21T00:13:23.659795Z","times_seen":66,"resource_available":false,"data":null}},"time_used":5113,"timings":{"blocked":1684,"dns":0,"connect":0,"send":0,"wait":1968,"receive":1461,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/38500186953bdb42c40278cb48396019b538e?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.678Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/38500186953bdb42c40278cb48396019b538e?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 14400\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 2048465\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"38500186953bdb42c40278cb48396019b538e\"; filename*=utf-8''38500186953bdb42c40278cb48396019b538e\r\ncontent-md5: NuGs5trziZ35lpWzEVTe2A==\r\ncontent-transfer-encoding: binary\r\netag: \"Fp5CVMgokAvLuj0mW9NVEcAY6VG7\"\r\nlast-modified: Wed, 06 Jul 2022 12:55:50 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-19;QNM3\r\nx-m-reqid: 7qIMp0zj5\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: DtYAAADXERaJdWwY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14400,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"36e1ace6daf3899df99695b31154ded8","sha1":"9e4254c828900bcbba3d265bd35511c018e951bb","sha256":"9111eca74411c01898026b2e1270cee0496f1785909bfdeba1be0f9453d41b15","sha512":"60f6cc02ee76fefc4f8dff33dc6ec7e5f5472171b7f5da58eb155e470cd1410d9c2e0c49d07a5f1ece9a71285db3b40ee61faf60b2cc0099faea4650f615ee66","ssdeep":"384:D82w+RJGBmDRXPOrgPrYuenw4YOWYKeIilsd9:DVw6KmNfj5OWpeIAY9","tlshash":"5e52e14970b354a709c30112684e0ffccb1dbaa87cc787939c35278422a6f57af89b69","first_seen":"2025-11-01T01:51:02.996648Z","last_seen":"2026-07-17T08:59:00.02373Z","times_seen":22,"resource_available":false,"data":null}},"time_used":5094,"timings":{"blocked":1665,"dns":0,"connect":0,"send":0,"wait":1969,"receive":1460,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/15945bb514602b3c4444aab085beccc681ef4?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.786Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/15945bb514602b3c4444aab085beccc681ef4?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 10107\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 844523\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"15945bb514602b3c4444aab085beccc681ef4\"; filename*=utf-8''15945bb514602b3c4444aab085beccc681ef4\r\ncontent-md5: 3BfB47xSYF7T6fX7l9J4qA==\r\ncontent-transfer-encoding: binary\r\netag: \"FuD9D4TzUv_FGQn_IqA-DFtOx--W\"\r\nlast-modified: Wed, 06 Jul 2022 13:08:25 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-22;QNM3:9\r\nx-m-reqid: Ar6buAB2h\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: _DsAAACvLftaL3AY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10107,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"dc17c1e3bc52605ed3e9f5fb97d278a8","sha1":"e0fd0f84f352ffc51909ff22a03e0c5b4ec7ef96","sha256":"1ca7173d3a9a5cffb3336abe3312ffd8edc77d55ae171c38bf5872ab912658ec","sha512":"a16cf6132bc129004a6207ccbee91a2fa451b8dd0b31707d702d94210941ff6c9fcea587e0be06b18f8cebaffe61918f8652cb979f42e8c6e1c183c9ea1980d5","ssdeep":"192:D/zPN9P2YI7Ob2oFqDEVTyOHyS8aag1cUdjkVyoSc9gvAUAi9Y5KIp:D/DP2YYOjFzL78aa8djvWgsio","tlshash":"4622bf5d5bbae0b48ee78ffc41001ad49adb9bf753182663511b982dad0934d1d24782","first_seen":"2023-11-10T19:11:58Z","last_seen":"2026-07-17T02:09:49.242183Z","times_seen":218,"resource_available":false,"data":null}},"time_used":6955,"timings":{"blocked":1557,"dns":0,"connect":0,"send":0,"wait":1970,"receive":3428,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/api/sport/match/list?sportId=1\u0026client=web","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:20.563Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nx-request-source: https://x78d.xyz\r\nXign: MDRNTj0yzz3iiAfbBu4j3Ea1i3317ZUCbRBq0iFNLqzzbEmowpUN4Corb/PricFjAwaV/L/B1x9ky4glxhwrr++MNcxm7z3tfixyziKPEEs0DSsTbNgv5erOL2jqU3Bj0B5boUeQzKoXhy0Lf5D8+BOJhR7rLd6DEkCihgKy8bo=\r\ntimestamp: 1761962720558\r\nsign: 4t7k5q5c31435o3q\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: Kc3Md8YTTSx5jDErM6fkSDaKwC66eyT6\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:20 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962720=kZNhn3b5shYQRZZGPWhOsJuVif/VYdrlokE1REfE4EIKJ8AXHInTKU5ksZeFevbZ+PtyYgnO97wuYzmiwJABE5Ug4PekHVfFXJ/mvX9cOP7rGgwEEssB8IRCwwuqDfpMZUhAIz3hD368KMTU8PJRu9jhiozTEjuebcyFvEBRVPShXukmBuOwSr2xqp+aTRl5\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 9F263C1E-73B8-474D-A60F-37B1F74C7689\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":63440,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"a2f77f674a247c4a3b38a58553097e36","sha1":"88d14b05d7262fb054c6017cccb4ca9325aef5dc","sha256":"953f00c21ea3d4e72b131e38657bac8cc1e9b3cf27c5c01a7a1fea6832633d7a","sha512":"b3c87c3a797a82ff756ec9efbc2901cfcb639ee60b47fe461e30ce287ef7fc3416a4f960c62fab745b727c39018ab43fd6d96d3570fa9407ba7f55308bc8c92b","ssdeep":"1536:ejNpNpH6D6+6I6j60606N6FaPNPcPmPkGRoJaJLJRJCqJLlrVAUnOzyBcXsbQrT2:2pNpH6D6+6I6j60606N6FaPNPcPmPt+8","tlshash":"1b532356c2dc28d92b5d22d9290e3a4cd83d6d9b0e9ff9d5ed4adf1c20e83fb9105860","first_seen":"2025-11-01T02:05:52.029728Z","last_seen":"2025-11-01T02:05:52.029728Z","times_seen":1,"resource_available":false,"data":null}},"time_used":489,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":488,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x422_936e6f39-c72d-42ec-ab51-2bd5a806c902.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.332Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x422_936e6f39-c72d-42ec-ab51-2bd5a806c902.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 88572\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=I1ntVIVywhMM%2Bbkq7dREDBqIC13YGyfpg8Cmjc22JSpDi61U87p6F0WOHjOVjQy9ZQwSaRssC02pnrKEsJv0Ym%2FnsmA3DnGL5PluBorEVw5I3Teiy8leQtcDn1Kb\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"06a585f41fc826b5347e04ee59ff56b7\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:06 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246248\r\ncf-cache-status: HIT\r\nCF-RAY: 996057d42d179cac-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962726=JzzEHLt9Hb5OKDgPEZRvfMAR0A/77JrXyMkda9GV0LsHvzOmoL6JsFP5kwgt0UFPW+XcC2aB9Gj9fvC6m/AeKOmAdxwAIVrn9zI0SdEk+PuwVYXkQ00iCcHMT1bZTq/XKL7CqmkSImsiXzBwlX0Vsi2F0vM7a+R/XvVzrt7iUROax41zD+ILS6/KoAW+vQ6B\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: F03112C9-C395-4ADE-AE3D-1640D91BE880\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":88572,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 422, 8-bit/color RGBA, non-interlaced","md5":"06a585f41fc826b5347e04ee59ff56b7","sha1":"1357eea1219b34aeda8b3ff0643b01f75264656b","sha256":"0fee4da04a467bded4cef5fd0200fe14d5f81cd79a42d95e2cfcf48591335822","sha512":"b06f99d758a92961e244aa05e7857e352935deef71d7478a6e7732f663822cc33b68139a539355c400bc641bcf3a8f48c147903416d1f941999f1c02f76e69c5","ssdeep":"1536:i8UehXCmLCRQjvGvRyM06zzwtzB3tDxwjdPsvEPDWX0I+WHr3:iOB0Ryudk3tDonDx7mr3","tlshash":"598302ec999d325ef0cb9232409a310a7435e01b1fe4d721a5c5aea581dbca5ff2ce09","first_seen":"2025-08-29T11:05:53.264183Z","last_seen":"2025-12-29T13:58:58.052124Z","times_seen":299,"resource_available":false,"data":null}},"time_used":2880,"timings":{"blocked":2545,"dns":0,"connect":0,"send":0,"wait":330,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/kc523-1/sponsor/sponsor_web_2.png?1756903280095","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.811Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_web_2.png?1756903280095 HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 41033\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-a049\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962714=X3amY441wvsjAI1xw2JJgjckwuib0itIgNKTTS4NwHGbaYMcSRe9Bsnv0C3cyCDUIDx9T8QKGfZZfGCtT7uRYZgsMcieRNZeslPqWb/4Qlg/gtt9evqjFMo2W1swogb+bhGIGk/Uy0+30C3DWkmBEvT48k/4zm2gOAlx12joojS2ndPSWw97gihjAzM8RQQv\r\nAge: 249790\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 0BA113F2-5846-4F26-B9E6-0D017367A41D\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41033,"size_decoded":0,"mime_type":"image/png","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 428x169, components 3","md5":"66036fddf71ff69f45c146ca63883070","sha1":"4b3076a271d5042ef1b6cffc2ff49f421a819f08","sha256":"93c59a52fe04b0050dd4552a135177533afbe2dec54f10c516610b0dee857e0c","sha512":"29c2fc65e144e5d13c011e4897e0bdf771c7b4c249875eca4fa25589625696c71ec015e7e8ef3a5ee45f2a6ae9df3663da0bb736a6fb13c9628f0d0957827c71","ssdeep":"768:6eyNeN9huVfPKv0KhazApErcA6cFKSkS+pbTCx81TxUqIUgYWxDHc9wZGbYGniRl:6eXXh8KcQakywKK++tTCi6xD89HbxiD","tlshash":"b003f15c4c413e7777f19baae00ac84224d11fd4fdd5e3e61a8bc659a843a68bc2540e","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T12:19:11.162592Z","times_seen":2241,"resource_available":false,"data":null}},"time_used":1084,"timings":{"blocked":766,"dns":0,"connect":0,"send":0,"wait":317,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/41238c451baf97d454c209d9bc8e56c0fd508?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.675Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/41238c451baf97d454c209d9bc8e56c0fd508?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 5713\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"41238c451baf97d454c209d9bc8e56c0fd508\"; filename*=utf-8''41238c451baf97d454c209d9bc8e56c0fd508\r\ncontent-md5: 1IvGxtSlXvqJKUNcdESmpA==\r\ncontent-transfer-encoding: binary\r\netag: \"FhUqKN1M09E5Wl0oN_RC-M4Noq40\"\r\nlast-modified: Wed, 06 Jul 2022 12:50:10 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-6;QNM:fn227;SRCPROXY:fn271;SRC_***:2;SRCPROXY:2;QNM3:3;QNM3:13\r\nx-m-reqid: pZq615z0x\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: hvgAAACUZX6avHMY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5713,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"d48bc6c6d4a55efa8929435c7444a6a4","sha1":"152a28dd4cd3d1395a5d2837f442f8ce0da2ae34","sha256":"f99b4d045ba55913e297965f1d85430c73fa53e09d61ad466c21ebc662dc8fa7","sha512":"aac46ea5cee9e95bdcfcdb0263ccb46d46e2f613c39704ddd4311f8e048295d63a37c15bffe87f0d37d307c20c6d0558b373e3ba993c24bc1bd8fbf3c9e47fb3","ssdeep":"96:ZRGcJjjbWZ5QuRDIUYWADBbDt/h25J22xXdoNEtdXWGP/ArQapmG4CkoQ+BUI8mP:jG8jjb65QuRDIUYWAD9t/h25Q2Ue7Gk0","tlshash":"ebc17efd921d55506c1cf484099fb8f99c336528afd72965a60254c51e78b9d5900f06","first_seen":"2025-09-27T01:20:59.139523Z","last_seen":"2025-11-01T02:05:52.1064Z","times_seen":5,"resource_available":false,"data":null}},"time_used":5097,"timings":{"blocked":1668,"dns":0,"connect":0,"send":0,"wait":1969,"receive":1460,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/css/61540.1756903329400.030a612e.css","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:09.689Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /css/61540.1756903329400.030a612e.css HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:10 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-59bbc\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962710=bLr7Bxe+9N7cGi456Xux0ngpT+448BEJRNKUlI2uRZNYQ+auPzMEcLISwKNIz5rtce6ISFwIiaT4hNFZKe3FykBIlgDwvQCo21rn2B1IEAWx+fwNww6W4PbnvqF/wTQWD66lsUFvdb08zzTVVrQ+Gv7oUDBwNk6kKp2F8xYzf8LWvz53VTbTGCr0yJ3UvLFY\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 4CCC417D-5F8B-472A-8D3B-A50069BD0BCE\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":367548,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"ab44c516a5aa84faae3bbf2852ebc655","sha1":"ef60c256d0028ecec909ffd9895ea2e63c1d1f1b","sha256":"456781f16fd25de012286211ad4b06e5ce32d9dfc9fb28a2364d80f76a2994ea","sha512":"4e214b9fc84d1e3b914c9bd025947162323db0251c704c668fafbbf226e604899d9d8d21e2f8b3b401ddb966981ba0edc97cc87c6ddd3eef29aab80010446656","ssdeep":"6144:z4+4r0H8Tu4+4r5cRlGuEQUQ929scKGnpTPIlyJ:z4+4ZTu4+4FKLlyJ","tlshash":"de74fa7caf1030ae15a7cb27b660f5589c36a443f9bfde9af3a53d580789a510623c13","first_seen":"2025-08-16T16:35:14.576567Z","last_seen":"2025-12-29T13:58:58.009689Z","times_seen":607,"resource_available":false,"data":null}},"time_used":2720,"timings":{"blocked":752,"dns":2,"connect":409,"send":0,"wait":626,"receive":562,"ssl":364},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/bj.ada43481.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.992Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/bj.ada43481.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://x78d.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 439504\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-6b4d0\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962715=rr8RSxjhoP257i6Bcaw8RAyhBBSN9LM0Zm++tGYblKe4lINKan0tJxjQ+awisU8PAffPWL2lcq89/R+JBdA2+2HktmKNjDSnqKoe2VIyZmQ3Jj1FpRTp4eaNKE7YN/wPW35Fl7rDBMfqAKJhefHKWxPz13RlmOx2Fr6dM18340tRhTsZua9KEtmXkrf8aDdq\r\nAge: 249792\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 0E1ADFA5-620B-46F0-A8E2-E51FAABDD44B\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":439504,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 927, 8-bit colormap, non-interlaced","md5":"2c55f8fcc8edb773be5014d8deb72c4e","sha1":"e7e55505bf22de833ec6b82a229e70bdba93b58f","sha256":"21c44535cffd825752bf9a535001b4b605147e3434cf2906fc2c8fcdcd992c1a","sha512":"bab93e8eb191df623bd7e238ae8d5cf7feae73e2a768d7b591d4dd8b7aafc199fce7c34066a272fc9137959a78a6bcd9fb388f39d4a0938f5674aaee815a3cf7","ssdeep":"12288:K+TyFzCVXhEu0hvb3kkjOO9FNkh4k6yvwUKA4AuJiT9h+:tTyFGjENkkyOWh87UK/JiT9h+","tlshash":"739423b1df0b89c858a39043dc74f99263e8d0a6bdc40ab80bf14b9176709dbbbf5116","first_seen":"2023-08-17T12:39:32Z","last_seen":"2026-07-22T12:19:11.211234Z","times_seen":2314,"resource_available":false,"data":null}},"time_used":3462,"timings":{"blocked":1841,"dns":0,"connect":0,"send":0,"wait":324,"receive":1297,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/pay.8f35ebe1.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.998Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/pay.8f35ebe1.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:22 GMT\r\nContent-Type: image/png\r\nContent-Length: 5453\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-154d\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962722=kfzsfUw0f5QeOwOzB35C9zRbYYC1bo8MHVSYwpXnaUdNveFhhyssWExbW1NooqAwzajG/U7ziuOvfrzjYMMa2SisH+2Igfe3O0s6Am9BNqCdMMjXMSl3u2Is41Ung4zs3Sy4c1w10lLo61G2MsigkAzu1UlaHpJH/D8FVmX0q1MUV24Fyp4v8DuRvMAP3FGV\r\nAge: 249789\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: A13160E2-A9AD-4804-967F-7C7AAD5EC725\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5453,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 492 x 132, 4-bit colormap, non-interlaced","md5":"05d444b76263f6958a37ac82e45daa67","sha1":"a067d3a654da1ec4c51d8f049aabaa112183e355","sha256":"49166910b376f5487f30174e60fcf13aaaca9620ef1aa58cfb2c94a8c111ea8d","sha512":"7d276d57b068ec4a0125512e0781c501a96bf6c30b30304d247251190c6421a9ed7a03ec208a590d19d9a1183e3837b06d141bddd99abb7b0ee4e2a1ba28b28b","ssdeep":"96:u9g9Yof8+keuD1Kai/MXG5BHMsDiCNPFH/qX4iWXnqvcIzDRHSVyl07TrOKCm0R4:u9g9rJuYai//7FiSXnqvNYGmrOKcPwzp","tlshash":"74b18e749d6efb2a26b315c30d7499c21ea45c9e0d94f1c2244776963c732de3270985","first_seen":"2025-08-29T11:05:53.301829Z","last_seen":"2026-07-22T12:19:11.232833Z","times_seen":2288,"resource_available":false,"data":null}},"time_used":8989,"timings":{"blocked":8646,"dns":0,"connect":0,"send":0,"wait":342,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:14.791Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://x78d.xyz\r\nXign: cUo/ffokVKldPCFvt5GPf9zNn4EoyBtq0b9eXFU3tij1AsPg5bwIkYuWQw58uGmp56HiUJC36+etPzROcURpZyA1o2cYAc2/VyliB3F6OKAaAxcHLLkqr+jzbGQpELlSFEKoPUq0tHG4a/CAOqA/wGm6q90TOG1/uh2ItUYHGIw=\r\ntimestamp: 1761962714777\r\nsign: 5t537e7q3t5l726g\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: Kc3Md8YTTSx5jDErM6fkSDaKwC66eyT6\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:15 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Sat, 01 Nov 2025 02:15:15 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962715=rr8RSxjhoP257i6Bcaw8RAyhBBSN9LM0Zm++tGYblKe4lINKan0tJxjQ+awisU8PAffPWL2lcq89/R+JBdA2+2HktmKNjDSnqKoe2VIyZmQ3Jj1FpRTp4eaNKE7YN/wPW35Fl7rDBMfqAKJhefHKWxPz13RlmOx2Fr6dM18340tRhTsZua9KEtmXkrf8aDdq\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: AE207D8D-DC58-4950-BF1A-3EB63711DEB3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6556,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"fa4803817ac939be26cf8e1954e3e765","sha1":"3894e39c72e1c052158981cfe71e77993c3aae39","sha256":"10cfae880e803996c80de25ec4d7aaa4a67440917f2dabf24824fb0be5c8ea0f","sha512":"c2e76c21c2c6f00b416beb1340d9fa6808f7355da5ca6c7fafbf19b8a59486a80e4d0611c96581e4d4ba2350c407bbc8e9c0c7b811cbb9e8523f9245d878449b","ssdeep":"192:Vra8lKwA7WqyT3BnwneHyZrwUP8ge3yLdMXA4SRJBfdJgrGfMOMg:0Z37WdDBCUyeUP8geCASqOMg","tlshash":"fa12af1ad7625714b03a40eeb50b8b84a119919befe6bba9ca5049e818a010876fc16b","first_seen":"2025-10-31T13:59:12.487539Z","last_seen":"2025-11-01T02:05:52.112294Z","times_seen":2,"resource_available":false,"data":null}},"time_used":528,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":527,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/EGAME.d289cd48.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.619Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/EGAME.d289cd48.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:22 GMT\r\nContent-Type: image/png\r\nContent-Length: 59546\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-e89a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962722=kfzsfUw0f5QeOwOzB35C9zRbYYC1bo8MHVSYwpXnaUdNveFhhyssWExbW1NooqAwzajG/U7ziuOvfrzjYMMa2SisH+2Igfe3O0s6Am9BNqCdMMjXMSl3u2Is41Ung4zs3Sy4c1w10lLo61G2MsigkAzu1UlaHpJH/D8FVmX0q1MUV24Fyp4v8DuRvMAP3FGV\r\nAge: 246267\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: C41C679D-9363-40F9-B207-2ED94ED72022\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59546,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"eb8991eb9e0db175522c914343f0a10a","sha1":"ce2d41b154df64421d46bceaeb9878da455592dd","sha256":"b837b4e9fc693e5c65eb049c56547caefe1cf73ea31ae59f95ae46d052fd36b2","sha512":"7d2a886e3ac412f6ea1b1ba290064373e1d07a0751bdd7f546af3116ad057d1f17bbe4847179cdf87297a967c0290280ec0c51ab9bfdeb1da0b881e366eb19a8","ssdeep":"1536:hvA9R/SReJczzaRBd6s3DhCDnQcvyFVWGDnmhKYNa67:hIPVczevUIhCDnQc21C7Na67","tlshash":"dd430276882a8fcd499304944bf9afe164eaf19097b3cf91f24c5fe0423d184d881b6b","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T12:19:11.193606Z","times_seen":2215,"resource_available":false,"data":null}},"time_used":5689,"timings":{"blocked":787,"dns":0,"connect":0,"send":0,"wait":4859,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/8fe89870-1081-42db-97b7-f8272ac29ae0.jpg","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.630Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/8fe89870-1081-42db-97b7-f8272ac29ae0.jpg HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:23 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QCySS9iWS3zI5nQHTrRDoKOKQZDTrb7mDdi7v2uo4qhjplhvXg7EbZBZl4MEY8wMBFAc3r59P9%2B8AJTbdD33ZAw005mSrEAY8%2BOVt2vpF3eLiq9a%2BmV658PpRw%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"d04176a6c26e72c117b0f85d0eba80c1\"\r\nLast-Modified: Mon, 25 Aug 2025 06:53:37 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 9421\r\ncf-cache-status: HIT\r\nCF-RAY: 9977d3accfaee6ae-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962723=q5gfVVRnp2eesXQfmCmKo6Suz0pQ27tifnGaf//NQOvM4Nui1udF0IlhUHcCvjPSHgHgIXtNP9CUbArEJzh5NJ7K3cuONguK3iT+Cd58oT8DH8JBG1/dwkqh59iWnpF98gVHX5n2gTZ6kCNUP1U5JZDC2KhMOh/Xh9jUYVJDd1re1TwJiLyqq2JwmHbEEMIp\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: C35087C2-63D9-4837-90CA-C58EABE92048\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":344312,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 1884x434, components 3","md5":"d04176a6c26e72c117b0f85d0eba80c1","sha1":"7d91bf688b4db4aa7840e7363e4b6477af75a7be","sha256":"e9229d385904201a79e88ec20831ab928bb126770dbb4cfcb1869d0d086083d0","sha512":"7f2d4db766ad2cd9f7b56750aff6bc621d478e79004b13e6c9dd41672d2215f2a817c43ec2ffe7cf46227d92c8b73fc94319be24edc93433c7ccac535e6295d2","ssdeep":"6144:QLznFRjZ8DkK4VAJw9ZFDPGVuiuRpBK9ZnAEpTLpzuJt1wfb1iaPH2kUM:g3Wo3PYuz3q/zqwzdHdb","tlshash":"6b7422e83513ca884b2f8f7b14c42a4d6a8d2e10dceeb5e9b479bd475ec280c867d494","first_seen":"2025-08-29T11:05:53.255926Z","last_seen":"2025-12-29T12:28:25.270141Z","times_seen":343,"resource_available":false,"data":null}},"time_used":7334,"timings":{"blocked":6357,"dns":0,"connect":0,"send":0,"wait":539,"receive":438,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/service.68be110a.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.994Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/service.68be110a.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://x78d.xyz/css/index-399e2569.1756903329400.f2d3fd45.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 10641\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-2991\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962716=iQZav/OuEMgHx3A+Cgvm74+GIW90PILhstcwg2e9np8wh65/JtzJfcVNs0hYy6F1MXFrg0PN+RhRCRvZhb4TAOTk81ZqLAYJZBgpoe2BeYdMPjW57UhHMqtWkHx+WpnjTSKsHj2SPkpRpdkPCF/y47HldzpG9CXOfMTux5wuAsaV4o4Hcwn93D+dVrWExdCY\r\nAge: 249785\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 06FCA265-563A-45FD-AA3B-7008E2085D36\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10641,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"993784a38ddc1156572bfc3308055ead","sha1":"becff431867226bf323b5a6535fa383992f107eb","sha256":"abca3af980888b08c6cbd57366b3ac94344d66ea048484c4f9867e300ee8703a","sha512":"48790c6340f273a58295fc6607306353ab69d5a818569fe36ef1bffc8fff084b23d37b401e10502b830c67a5efedca56c1c9d778d6198e4069018d055f1869f0","ssdeep":"192:NdsarkpjwOOmfStcnaHtzB3l2eKD9RdfXtRqi3ln+ojjjKMGlnyL5H7nx+:nJQpjgOz9Dd0orKMGlnA5Hbs","tlshash":"8822c0c41e1be1b6d2ffa916b28543a04b3421fda1a24c342d828c04ccad56ac91f9e7","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-07-22T12:19:11.223287Z","times_seen":2395,"resource_available":false,"data":null}},"time_used":2234,"timings":{"blocked":1905,"dns":0,"connect":0,"send":0,"wait":328,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/chunk-svg.1756903329400.5bf5ebac.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:09.697Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /js/chunk-svg.1756903329400.5bf5ebac.js HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:10 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-708ca\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962710=bLr7Bxe+9N7cGi456Xux0ngpT+448BEJRNKUlI2uRZNYQ+auPzMEcLISwKNIz5rtce6ISFwIiaT4hNFZKe3FykBIlgDwvQCo21rn2B1IEAWx+fwNww6W4PbnvqF/wTQWD66lsUFvdb08zzTVVrQ+Gv7oUDBwNk6kKp2F8xYzf8LWvz53VTbTGCr0yJ3UvLFY\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 50663B0B-013E-4334-B783-659AABA54459\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":461002,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65532), with no line terminators","md5":"7f3450cde65c4d0964dcc6d243a1656e","sha1":"ad5b362b491b71dff95398219d8e190c80650865","sha256":"924472178572d451953cbf73efcf577a697b3102176fc17d9ab8c379b6b37bee","sha512":"e8f2350a17821376b71a040626a3d5c58cf5744b22d512fbef45b3246558b0f7001ca4d48d32e34831ec7750e40008f7aef529b4e618c6770bb5e72e4c028cd2","ssdeep":"3072:38nz2uaLZSZvx6Q/sIPrekK+m36Ua94sRZI7gbpU:38nz2uasNxpXPrekK+m36UHsE4pU","tlshash":"7aa4fcb4c190f4edf704ce196e7c9e1c50321688e0a9e9e52da9fe0d9e85d6b241cdec","first_seen":"2025-09-04T00:49:32.781171Z","last_seen":"2025-12-29T13:58:58.073596Z","times_seen":441,"resource_available":true,"data":null}},"time_used":1754,"timings":{"blocked":551,"dns":0,"connect":0,"send":0,"wait":562,"receive":641,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/home.1756903329400.bfa8c420.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.126Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /js/home.1756903329400.bfa8c420.js HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:13 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-2d959\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962713=I6K2XWhDVA0awyfD/5xFQzalvwM45oMG7bTkJxNueBZCYyD6N0TwCQwXhfcblgZK0e+1qHgBzUP/VfG80DBDvI+wPvDt6BsZi/QJSvwomwSgNwFdR9smI1hOBvr5s69iLkzG+c/AStWnqdtCh9L+Hw/Kj/X0HziC5Mz2XrlIuLxrjd4Nn0MDGVqRQTsSm0iZ\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 2673261B-F867-449F-BE6D-8CDE9400C93A\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":186713,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64200), with no line terminators","md5":"caeef6f42deb46a855ccb60a2ed5b445","sha1":"13594059c305a13f3f001270017ab9aaa21443c2","sha256":"ede9bdf96f357afd7f61662fc1654334932bdf9d3e0ad7e9581a792bf2912530","sha512":"0f28cdf6693505cf9c674caa54a226cb16de87aead1b75244f3c6e68ee5d206b133b3e5f081aa9a1db2b285e8ac607f1a1a289401afb0b6404b3e2865d0d9d03","ssdeep":"3072:f1E8oNSIMrtwsAFJBuokQvFUqlGSBJZhxffj7TEOiGRA3:f1E8oNSIMrtwsANKUFHzffjAGa3","tlshash":"c3040880b5f0e275575fd2bbd7371024b22b1686d0ccac60e1f66b187e18799b236db8","first_seen":"2025-09-04T00:49:32.93504Z","last_seen":"2025-12-29T13:58:57.964054Z","times_seen":424,"resource_available":true,"data":null}},"time_used":536,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":503,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/license.ea57c78d.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.996Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/license.ea57c78d.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:22 GMT\r\nContent-Type: image/png\r\nContent-Length: 1976\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-7b8\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962722=kfzsfUw0f5QeOwOzB35C9zRbYYC1bo8MHVSYwpXnaUdNveFhhyssWExbW1NooqAwzajG/U7ziuOvfrzjYMMa2SisH+2Igfe3O0s6Am9BNqCdMMjXMSl3u2Is41Ung4zs3Sy4c1w10lLo61G2MsigkAzu1UlaHpJH/D8FVmX0q1MUV24Fyp4v8DuRvMAP3FGV\r\nAge: 249790\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 883C90CA-1A6B-47E4-9D75-DD9F430A91DF\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1976,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 161 x 52, 4-bit colormap, non-interlaced","md5":"60a2c7c150b01809fbb7b97932684b5b","sha1":"67fc9647c452a17b519c6a51dc8c38daa23755f9","sha256":"c5ce31558a1f979ae78c7779d2f312b196750375541e9c147b73d6e44d47c276","sha512":"2328442fa1c74e47c6eff4adab55920c7e7738e7ae51bd2b222fb696bbcf8201a14805089a33baa80c28a40db47061048d817c384bd72735b2e0c0116ff63c6f","ssdeep":"","tlshash":"b3412a6266729beced1a8c47592c7df1d8338ca1a200e1c150ed761f1bf8e1060e7a94","first_seen":"2025-08-29T11:05:53.23289Z","last_seen":"2026-07-22T12:19:11.201698Z","times_seen":2316,"resource_available":false,"data":null}},"time_used":8923,"timings":{"blocked":8588,"dns":0,"connect":0,"send":0,"wait":335,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/fonts/DINPro.9ee75b04.ttf","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:14.004Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /fonts/DINPro.9ee75b04.ttf HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://x78d.xyz/css/61540.1756903329400.030a612e.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:14 GMT\r\nContent-Type: application/octet-stream\r\nContent-Length: 119892\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nETag: \"68b83893-1d454\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1761962714=X3amY441wvsjAI1xw2JJgjckwuib0itIgNKTTS4NwHGbaYMcSRe9Bsnv0C3cyCDUIDx9T8QKGfZZfGCtT7uRYZgsMcieRNZeslPqWb/4Qlg/gtt9evqjFMo2W1swogb+bhGIGk/Uy0+30C3DWkmBEvT48k/4zm2gOAlx12joojS2ndPSWw97gihjAzM8RQQv\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 957F3A78-5D17-4EEC-B017-32ABF635C85C\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":119892,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 10 tables, 1st \"OS/2\", 30 names, Macintosh, 2005 Albert-Jan Pool published by FSI FontShop International GmbHDIN Pro RegularRegularAlbert-Ja","md5":"028cefac160ed3b006f47106fbc68d1c","sha1":"efcecac09684435facd7397e4f6163a5069802c2","sha256":"fb841a09a82787982ad1774bdeb45e8e06ff4909161a9ce33fd42f8822c5ddc3","sha512":"3a5a284d0c4da6593b857ba785a4ba7d5f2e2b73d22a2ef25435b9558063d2486228d76a3cd5d3a59b5abe4c0da696a75373111b3569a94a9dea1516cf16091f","ssdeep":"3072:YhtN/CZnt1tbtKtHtFNgz1QZt0tbt2ktwtNstAtqNaEctWpy8TLtsIb66AUeo:YhtNGnt1tbtKtHt7t0tbtxtwtNstAtqV","tlshash":"5ac308c153e8fa4ad83996388511c7434226ff2de65d4f36ffd94d8c688e8e9064e6e0","first_seen":"2023-05-08T18:58:40Z","last_seen":"2026-07-22T12:19:11.202624Z","times_seen":5295,"resource_available":false,"data":null}},"time_used":1008,"timings":{"blocked":218,"dns":0,"connect":0,"send":0,"wait":481,"receive":309,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.esportsdata.cc/202/1/cad98fb2e13765f61a336abcdf878085.jpeg?win007=sell","fqdn":"img.esportsdata.cc","domain":"esportsdata.cc","tld":"cc"},"ip":{"addr":"104.26.3.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.551Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esportsdata.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 21 Sep 2025 14:31:39 GMT","end":"Sat, 20 Dec 2025 15:31:26 GMT"},"fingerprint":{"sha1":"17:3D:A0:9F:DE:47:81:66:EA:33:3D:E8:54:E5:E5:AC:9E:D3:7C:A0","sha256":"22:D9:7A:16:0F:64:68:7D:00:46:B8:BF:15:6C:E8:BE:57:96:C2:BA:12:A5:4B:90:48:16:F4:58:C4:DA:9D:36"}}},"request":{"raw":"GET /202/1/cad98fb2e13765f61a336abcdf878085.jpeg?win007=sell HTTP/1.1\r\nHost: img.esportsdata.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 7237\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"d166acf10e92da859b04c7e7ecedc63e\"\r\nlast-modified: Sun, 26 Oct 2025 04:02:20 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin, accept-encoding\r\nx-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nx-amz-request-id: 1873B0BF33005292\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nage: 1096\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SbGIqTCjIJmRedWbPNxmyv%2BVWosAUyOCvttQJpMzvRsM4DwrqroVaiNpNu1m74ldApyMu%2BfXYKQ2vuaO4xkgMLlvm94eHV4heyV6aEHLWg%3D%3D\"}]}\r\ncf-ray: 9977d387abddb4f7-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":7237,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 180x180, components 3","md5":"d166acf10e92da859b04c7e7ecedc63e","sha1":"0218ec049914b47a75cc10a0483eb483a0010d71","sha256":"652fa76997fdc440b648229a1ea69dbd3db05c39a60261939108bcf6fd44ae02","sha512":"136dc2397986b70d9af408e8959438a07879d2968261451dd944aa43deb869658672feff568aefec93f26b88f18daa299f861e439ca1c01908689e3018c8f1b1","ssdeep":"192:IwqSYt+BBH+ifnMthZCfSeyZudmYGIMya8F61/aycFYfaV:ISBfnMQNMy/ny8YfaV","tlshash":"3be1ae129e3a0286dc36e4ba5d5607e1d3ada6900d2c90cfcc4b897f333a210e56d6d4","first_seen":"2023-09-23T06:35:09Z","last_seen":"2026-04-01T15:36:14.919283Z","times_seen":16,"resource_available":false,"data":null}},"time_used":1831,"timings":{"blocked":831,"dns":0,"connect":1,"send":0,"wait":14,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/loading.da46bff6.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:14.032Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/loading.da46bff6.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:19 GMT\r\nContent-Type: image/png\r\nContent-Length: 473164\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-7384c\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962719=7iwiVO6DxLtk5DdvoSW0/BUTqztzqSIdgkI2jGIcMMLiKBoC967rIKVdl+4PDGTvZTM4RL0DWCySh/+xwhSuy6NGaTi+vb0YGZfJrrGOb31qOILBLkWs9PNJQhPtM0cbtz0MBi0XKDtNd8ZMlq71LTztXPLQHnYH6a06bGuXIuw/LldGEb9sdouyYq3GgEGF\r\nAge: 249784\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: F42297C5-99B2-422E-8AD8-148959C7FC4D\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":473164,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"ac7ca483f10bc73cffa89f639f6ffa56","sha1":"03873b9607c635752526968af31773498d259afa","sha256":"a054b81d2850fe2da5b4f97a1c50c05ee59a24c37f1c700e5cc45fe6079598b6","sha512":"caa6b3e243f02c86ccaf71aafd0e716834a7a0cf07305c5c7cc0a1b9d637cc2802caa067b0010c7c3c064e3fe8f7881b26992f57137f98477266653342257760","ssdeep":"6144:NFoYczeWIF3Q/IUPYhuF0KX38I4z/tcKZPehCIjAl/CS+b:rLczeTUPpF083CBdeh7MlvI","tlshash":"79a423929b411988e1096432215fab4d23993b6458ab5fbf78843d88893cf059ff763f","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-07-22T12:19:11.191007Z","times_seen":2141,"resource_available":false,"data":null}},"time_used":7518,"timings":{"blocked":5450,"dns":0,"connect":0,"send":0,"wait":356,"receive":1712,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/zeren.c0aa584f.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.999Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/zeren.c0aa584f.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:22 GMT\r\nContent-Type: image/png\r\nContent-Length: 3322\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-cfa\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962722=kfzsfUw0f5QeOwOzB35C9zRbYYC1bo8MHVSYwpXnaUdNveFhhyssWExbW1NooqAwzajG/U7ziuOvfrzjYMMa2SisH+2Igfe3O0s6Am9BNqCdMMjXMSl3u2Is41Ung4zs3Sy4c1w10lLo61G2MsigkAzu1UlaHpJH/D8FVmX0q1MUV24Fyp4v8DuRvMAP3FGV\r\nAge: 249788\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 9D260F62-083B-4859-88BC-84AF71D4ED86\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3322,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 414 x 130, 4-bit colormap, non-interlaced","md5":"217588cbcd6216a09cac17953ae710b1","sha1":"de250755d284bb75dcee38ee45f2fc839987dcba","sha256":"24c2821b322d0c9087bcb0727dc0307311f6cfbb52af9f8a93308e48705f706e","sha512":"da190054ec0862c9927bb3bd928481459d53d4d778e9b2928c2507f2a34df5791d43adda750fcf184b767c1ba3a3f92e45dc57242a80869e253a9b37639abb4a","ssdeep":"","tlshash":"50616c01eb9130b8129c286701bd3fcda4c64d993d203d798d87b29bd6f970d288b123","first_seen":"2025-08-29T11:05:53.326961Z","last_seen":"2026-07-22T12:19:11.128099Z","times_seen":2278,"resource_available":false,"data":null}},"time_used":9119,"timings":{"blocked":8765,"dns":0,"connect":0,"send":0,"wait":354,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-01T02:05:07.894Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:09 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nCache-Control: public, s-maxage=600, max-age=0\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962709=7kPmzEE97rk52m1VZKnvl/cQ2VhnzzurApizikL2/f7zk/ylJxr38Gk3dl8yV4JqZXHvEb/ySc5jLIKfO4GLKGaYzvGfGTMaIa2JQ2LNImgcrE8NGIyW3mTn21EfI66Sn78k1RdmFxehfkCxF/NIUoq9vi78lZFCfMCN3lzwNWICHpVQKV/Aqe9TOv18ndgA\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 7E094E67-E331-455B-BE8F-482C0250611D\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23624,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5777)","md5":"87588e90bb24e209460bdbf1bcbcc074","sha1":"f3c57be16a0eaf6879f3469c6a2db7720a699832","sha256":"61ed38427305a473065294efb15ef101340cf9d3e19be35a6c6c86083698c328","sha512":"160c240e67f56096c7c519eeb5b11bd9fcac971ffbdaecd231be6aaba4f98a1dbf5f44a22c0edfbe64860e3039a11eba5be0eb13802c82e7033543d7891a8e51","ssdeep":"384:kR7B3v2VwiYwJvSoVXsp+pa/iZcVk97g6nMusplliz:kRdviNYiKop/E6wkpcu2lUz","tlshash":"9eb2292e8df349762523703a2bbfb208797180134309ed803e4de7584fd59aa46e7bd6","first_seen":"2025-09-04T00:49:32.720758Z","last_seen":"2025-12-29T13:58:58.052747Z","times_seen":445,"resource_available":false,"data":null}},"time_used":2321,"timings":{"blocked":788,"dns":2,"connect":375,"send":0,"wait":539,"receive":209,"ssl":406},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"url","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz/","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/12144bf0f6c75fc0b4ebfbeeb323e0a1ebfd8?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.712Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/12144bf0f6c75fc0b4ebfbeeb323e0a1ebfd8?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 212005\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"12144bf0f6c75fc0b4ebfbeeb323e0a1ebfd8\"; filename*=utf-8''12144bf0f6c75fc0b4ebfbeeb323e0a1ebfd8\r\ncontent-md5: 82IM1rI1ZaAWzwma7IE/vQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FjENyVFVeclZYp4GK9rcxvZjZfFN\"\r\nlast-modified: Wed, 06 Jul 2022 13:01:23 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-28;QNM:yzh164;SRCPROXY:yzh151;SRC_***:75;SRCPROXY:75;QNM3:77;QNM3:122\r\nx-m-reqid: CkekDkgWX\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: 62EAAADF9o2MvHMY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":212005,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1000 x 1000, 8-bit/color RGBA, non-interlaced","md5":"f3620cd6b23565a016cf099aec813fbd","sha1":"310dc9515579c959629e062bdadcc6f66365f14d","sha256":"c5cd71a4699a2ffb58caa862e15a82dbf41c3585224598c2ab621ebc2cb57074","sha512":"9019983163b8f0b0b0fa11864f07b191e36a1eea94fe396587eae04f968a9953d3cc4948b062d777c43ad8fd748bb9b36f2a28eaa5eae03db205c675eb4a1534","ssdeep":"3072:dvTNDI3ylhnzGpaKPKm8zAvElbY3LyJGyCOD4fg/VEqXbVcGUvKpg/Ml6O/kJuWt:BxDOWzdq8zAn3OJGrI1mG4KkMl6qDOh","tlshash":"362412dd89ebac2301383c58479c98e771376942e73cb50a599c989784fd3e983b2c5e","first_seen":"2025-09-27T21:37:30.388407Z","last_seen":"2026-07-17T19:01:29.174311Z","times_seen":59,"resource_available":false,"data":null}},"time_used":12384,"timings":{"blocked":1632,"dns":0,"connect":0,"send":0,"wait":1970,"receive":8782,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/114046b6b83a3b87f4230aebf376c2a488c05?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.872Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/114046b6b83a3b87f4230aebf376c2a488c05?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 21763\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 165254\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"114046b6b83a3b87f4230aebf376c2a488c05\"; filename*=utf-8''114046b6b83a3b87f4230aebf376c2a488c05\r\ncontent-md5: WQulGlDFQWv0xZmO+qCBXA==\r\ncontent-transfer-encoding: binary\r\netag: \"FnwVVDs7fqk6PaFuq9xDDuPFe0FZ\"\r\nlast-modified: Wed, 06 Jul 2022 12:53:53 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-25;QNM3\r\nx-m-reqid: QSvAyFj5P\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: _DoAAAAKoMAlmXIY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21763,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"590ba51a50c5416bf4c5998efaa0815c","sha1":"7c15543b3b7ea93a3da16eabdc430ee3c57b4159","sha256":"8b92284125a3f7d228e93351ad42585d71644bcec91b6dc7872d1ae3f7b048a7","sha512":"ed856da353a7cb20a5660c7b833161e1df29a1ca245640cd76a5af0d1639cc22a87aff2be563b8dd1735fbe7bae4add4aad077201ceb26ae2ca6b7480ff56fbb","ssdeep":"384:fiKrZDe8b81qiKRfWt1IiQLowXkQRqH3n//48Q3G3ZFj4K9FO2a1c32U42Yn:RFDxBfWtioUkIqno3G3kgFOZn1","tlshash":"53a2d1a1ce95b4273a51e7227b5522bcf034851856aef606f716bc93e3721f288b01df","first_seen":"2023-07-15T11:13:39Z","last_seen":"2026-07-21T21:40:41.715649Z","times_seen":197,"resource_available":false,"data":null}},"time_used":8324,"timings":{"blocked":1473,"dns":0,"connect":0,"send":0,"wait":1971,"receive":4880,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/CHESS.80cb714e.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.617Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/CHESS.80cb714e.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:22 GMT\r\nContent-Type: image/png\r\nContent-Length: 58759\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-e587\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962722=kfzsfUw0f5QeOwOzB35C9zRbYYC1bo8MHVSYwpXnaUdNveFhhyssWExbW1NooqAwzajG/U7ziuOvfrzjYMMa2SisH+2Igfe3O0s6Am9BNqCdMMjXMSl3u2Is41Ung4zs3Sy4c1w10lLo61G2MsigkAzu1UlaHpJH/D8FVmX0q1MUV24Fyp4v8DuRvMAP3FGV\r\nAge: 246269\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: E3635A2C-A8F1-4C77-9B33-D187125739B3\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58759,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"727b4dc207a4141335b27fa73f76fb10","sha1":"bb63b02e635f5503d76c4fc3532c2c652a06cac8","sha256":"5d840214ae46c94540df7d0a94963cc398b32c7b868edddb6a4f2a2faf113e42","sha512":"c1512f9d9a191ea10e806fe3a8f812f78dec9832568373b7b5362fafe9aef6783947d248deb2fc8d30ba1c61fd3b94f308298e69c1de32686110fa35f7bd4ed4","ssdeep":"1536:gtPCh483gu6aLw9AJeteTzkprgTWEHbP4BzrJ:344U9Xte3kprgKE7gZJ","tlshash":"0543025a13c1159f422f37b8148758a6d8154f9f38f32ea11a9e2afda58cb0af431c3d","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T12:19:11.197119Z","times_seen":2233,"resource_available":false,"data":null}},"time_used":7271,"timings":{"blocked":789,"dns":0,"connect":0,"send":0,"wait":4861,"receive":1621,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_392325e1-efd7-4953-83f1-410dea55a03c.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.318Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_392325e1-efd7-4953-83f1-410dea55a03c.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:25 GMT\r\nContent-Type: image/png\r\nContent-Length: 80779\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BucaZx1QglhKTnsmxP1OnwaUnWZdKM51gMch1CKt%2Bu%2BhytDw6%2BkTS0CKCEpm%2FsRNc7hQ0T9P7y4HqIgHxIdx59yuFP3xEKw6JhoNDOals%2Bzf8rdm0yUhj5jSAw%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"4c5942d2ff7143f561ab601251f4fd8a\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:25 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246249\r\ncf-cache-status: HIT\r\nCF-RAY: 996057ca4abaa0e9-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962725=yIoYJXnoX32vTrxda1zOc8miVG32U7nJJc12gDZ+In6cgnf8S38tKUUUMfLseQr/q8eimpOabVTJjmX6tFPOJmPT1E15RMXJLCAOTkmUEPpCMU6llWgDlqx+fr9zASS472DYjzlMiWRiDMxvJl4PxLo/nm3fsJVZbP5/iPuwIDPxIrhHcKVoSg2HyE5+IDkE\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 20037CC3-C360-4430-B229-CCB2D16DF919\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":80779,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"4c5942d2ff7143f561ab601251f4fd8a","sha1":"33992d6c0f6b7cfd15c10b89cc21d6e61b388b9e","sha256":"930520faaba7720398434d06b0cdc67819d0bfb174db13978ea1df7f95fe2c19","sha512":"a8fd398b0dce4c041f2570df3a1be5d46766e8206a82c53c78ea7bf19fb22bddbf465acc1df277200236b58168149cf7101698f416ab9f763406d09d5e0b343b","ssdeep":"1536:THVzFXmHVHAZWTzvtRHxFyUBlN+f3LkQ33zIVxWDmI3Ay3/ntH8:TDWg4TzXHxPS3L9zIVxWCob/tH8","tlshash":"20831231929bf246f092a3b6fe3a5165181cdd60dfbcf58b8d5e4e281d6b2c1820dc97","first_seen":"2025-08-29T11:05:53.231567Z","last_seen":"2025-12-29T12:28:25.243317Z","times_seen":307,"resource_available":false,"data":null}},"time_used":2558,"timings":{"blocked":2237,"dns":0,"connect":0,"send":0,"wait":318,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/css/home.1756903329400.edf3cc73.css","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.123Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /css/home.1756903329400.edf3cc73.css HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:13 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-13930\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962713=I6K2XWhDVA0awyfD/5xFQzalvwM45oMG7bTkJxNueBZCYyD6N0TwCQwXhfcblgZK0e+1qHgBzUP/VfG80DBDvI+wPvDt6BsZi/QJSvwomwSgNwFdR9smI1hOBvr5s69iLkzG+c/AStWnqdtCh9L+Hw/Kj/X0HziC5Mz2XrlIuLxrjd4Nn0MDGVqRQTsSm0iZ\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: DB892B81-5FC8-46E7-BAD4-9392E0667757\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":80176,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65528), with no line terminators","md5":"2e29065a1a5515643e2fd444bf8a6276","sha1":"fca2b112876cca0762e522356083c0b8649f0520","sha256":"f77a87b9e81ebb2473ae09a9dcbb13e383ca95151a71a6aa85bfa51d6223f6ed","sha512":"0549da8eb6c9e2dbe1f6ec23b197491230176fb5952835cbed1e0650f680db8333bd65e3b4b026804c94d48229b8c6974427978bf83c88cac162db9511ead377","ssdeep":"1536:yzOcRM7jufawS2d3a8WiLKbzGhbKpXdNCg9khb+TJ/:PtuSJwLUK0Eg9khb+N/","tlshash":"25732b7aa610253db437da72b9f05bd8b524c846d7634a3df2537a25cbc72e213323a4","first_seen":"2025-09-04T00:49:32.974291Z","last_seen":"2025-12-29T13:58:58.075129Z","times_seen":426,"resource_available":false,"data":null}},"time_used":485,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":484,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/SPORT.aab253e7.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.616Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/SPORT.aab253e7.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:17 GMT\r\nContent-Type: image/png\r\nContent-Length: 55380\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-d854\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962717=dWszbVNhQKjhAU7tUY87nm6BjIETh4H9u3Uzo9zi8FdaV0tc2Xc0UFR1FuwlLt+19FYqcs6ViKOoT1rJJFhFdh1NxXPGHWvZS/wNrB0JTzd7UyFZa9j1pku3wvIKhb+tNhqbBGw66R36q/bs7MG3T6CivM+u4DLxgHY01MuFUq2qT8lrNKLYTVukLR3FZSTm\r\nAge: 246264\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: BBAFB116-76EC-41BC-A1A0-4F7D87EFA190\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55380,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"3990a0dcf110f100c97ab413079e969e","sha1":"8087b72a149b71f4f5fc43b0f8bc07b89b621583","sha256":"6ddc189e7780b1313933d4903be9fbf6644b6a590e9aba83a6e4e50fdafb170e","sha512":"6b092584d42ec1423ecb94383907f29571e93308944813286d6e74b10f6eccb27536924220780f9a080dc259a095718a33f0757fc0adb04d737c83a6fa1647e5","ssdeep":"768:aEivx5zbZ4L0zze87wWbuKu4YIsZdCPX4ueh17yEs7NsGJSLsBQ1MDAaYHKJTbYC:aEi3eL0za8xbw4UmXI1VfJIRDYqz6W","tlshash":"bc43022944944c242384f1a6ac778dbc6dffa348a5f38f639a842bec7dcd84d95f4811","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T12:19:11.209113Z","times_seen":2256,"resource_available":false,"data":null}},"time_used":1125,"timings":{"blocked":793,"dns":0,"connect":0,"send":0,"wait":330,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/ESPORT.4f4b51d4.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.618Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/ESPORT.4f4b51d4.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:18 GMT\r\nContent-Type: image/png\r\nContent-Length: 65968\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-101b0\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962718=i95mbm0Nui8DbqCHTgwZJnkhUh+9wS4XzdkIHK2J5m8J4BUFTB6L0NipCfqJvRtuegXOmmjvCt+78XE8A1wZMRm7TNPI+EFgShZwbHJ9WQv0Ervy/10oYldE1zF2ablDEG7fwH7oCiu+KncsA7g1IOg6lb7qC/Y7w7oClv6sSK1kNK4QsD6OECDoim4Qplx6\r\nAge: 246264\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 12C494B8-DC00-4F56-A45B-28580FD9239A\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65968,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"29610094acb703084f79c42c17547a7c","sha1":"3c824ba387e36bcce1a5f1d0d14b513fb278db9d","sha256":"8c3dc9ee49224eff4a37ec488ff0a413f3150ec7a62640a466a802750a573146","sha512":"db986acc62bb0d35583a1c298b468e1fa7869269c738eadc82b944b1a8f9b2c0723087db8a065d60495938e834337e72e3c438089d1d02ff90f4983e0d6461fb","ssdeep":"1536:ObUUUNbT8bJcHe4DyC8KLT/KKeRfm4AH7XAlzS7M2Z:rbgNcHwE/eshbE/2Z","tlshash":"b25302e1df60cb022efe65ca89acf12ae204a0a61476453f7a231d6f3744016af973c4","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T12:19:11.209822Z","times_seen":2229,"resource_available":false,"data":null}},"time_used":1801,"timings":{"blocked":1457,"dns":0,"connect":0,"send":0,"wait":342,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_e9ecc337-e18a-4722-9eda-2e27fa32dae5.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.339Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_e9ecc337-e18a-4722-9eda-2e27fa32dae5.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 132257\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OaaTYK%2FDiIFnIE4226KtZx9yqjye9ysMsvl08diPw%2Bx27JUDR7H8yeuZJB%2BusC1meQ6M%2FSzSYc0tnwxR8F5RK2BvQG42Yqle9h%2BF5qi2CkxX0UYY0IwflvRyeGUc\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"5cdbeb01fd724f1bb7cab656a7f26600\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:21 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246271\r\ncf-cache-status: HIT\r\nCF-RAY: 996057490c612108-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962726=JzzEHLt9Hb5OKDgPEZRvfMAR0A/77JrXyMkda9GV0LsHvzOmoL6JsFP5kwgt0UFPW+XcC2aB9Gj9fvC6m/AeKOmAdxwAIVrn9zI0SdEk+PuwVYXkQ00iCcHMT1bZTq/XKL7CqmkSImsiXzBwlX0Vsi2F0vM7a+R/XvVzrt7iUROax41zD+ILS6/KoAW+vQ6B\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 2CCE3E81-F4C5-493D-9457-0F73DBA60EAE\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":132257,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"5cdbeb01fd724f1bb7cab656a7f26600","sha1":"cda5b8d10d40b3644d7338a4954bb2aacfd9ea42","sha256":"94ab7c32c0b1b4b526b394c0e9ef60da57601f69a4e57c155f689b5e8c7d2aed","sha512":"275c1f05f6dcb147ba73a5c089de897e605f4a4b758097024690aac3bcd9d8883bccadac6b8e02abe24673147fe431159f9eb0b1f77b0b556e42c6fd302bbf52","ssdeep":"3072:t3HnneSTvjcHceoD9xTo8pDbH6n1apXCp6f3nO5xe/VKUS:h3r289NDbHw1Ppq3PxS","tlshash":"e4d31286f50f3842f0f507f7ee699bbc8132b8185a76a08c2521faadcfdd1591b5c095","first_seen":"2025-08-29T11:05:53.29294Z","last_seen":"2025-12-04T08:51:36.794732Z","times_seen":238,"resource_available":false,"data":null}},"time_used":3649,"timings":{"blocked":2983,"dns":0,"connect":0,"send":0,"wait":334,"receive":332,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/assets/logo/favicon.ico","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.433Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /assets/logo/favicon.ico HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:13 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 58278\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nETag: \"68b00b6f-e3a6\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1761962713=I6K2XWhDVA0awyfD/5xFQzalvwM45oMG7bTkJxNueBZCYyD6N0TwCQwXhfcblgZK0e+1qHgBzUP/VfG80DBDvI+wPvDt6BsZi/QJSvwomwSgNwFdR9smI1hOBvr5s69iLkzG+c/AStWnqdtCh9L+Hw/Kj/X0HziC5Mz2XrlIuLxrjd4Nn0MDGVqRQTsSm0iZ\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 9351FA07-01E6-484C-B42B-F8472CEE38E7\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58278,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"7fb9203f2701deec1371d2fd0ddd079a","sha1":"a7d4ea5f1c3d103aaa3c078bf540b56404aec0e1","sha256":"2a342dd0f9977afb12227889cf13ff008d4cf1e9a4ca07fb4131d14af05978d0","sha512":"964cf7794a7b72bb9515927efe748563b6d46fe122b35baa4c7f57fafb09ea759e5e759a3000d385872218cdd08383a58a2b66feb9a712e6f3e9a06cc87e43b5","ssdeep":"1536:e7V6OVB39Hdm34GeF4KERayBlZ3WgaOlblY4+:e7V6OV7034GeFERd3WgaOlbGN","tlshash":"af43f10a258e86c73047c3921b2dc09b70d12c776b8daef9e6bc4a5816d54731bbd1ae","first_seen":"2025-08-29T11:05:53.165834Z","last_seen":"2026-03-18T12:35:38.966648Z","times_seen":1201,"resource_available":false,"data":null}},"time_used":694,"timings":{"blocked":172,"dns":0,"connect":0,"send":0,"wait":488,"receive":34,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/65246.1756903329400.c090be2c.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:14.001Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /js/65246.1756903329400.c090be2c.js HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:14 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-11f2c\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962714=X3amY441wvsjAI1xw2JJgjckwuib0itIgNKTTS4NwHGbaYMcSRe9Bsnv0C3cyCDUIDx9T8QKGfZZfGCtT7uRYZgsMcieRNZeslPqWb/4Qlg/gtt9evqjFMo2W1swogb+bhGIGk/Uy0+30C3DWkmBEvT48k/4zm2gOAlx12joojS2ndPSWw97gihjAzM8RQQv\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 18AEFE75-8370-4375-9B4A-82B8569BCC0F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":73516,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (48688)","md5":"9695de283c01f0fadf4795c612b010e2","sha1":"9e9b20c41d8eac731f465f87713f570eee532180","sha256":"82d3d78a522caa25376deb145964490b699e6d2c976ae6cdad15f2c4e57cfc7e","sha512":"5f583070eebf753cebbbad1720360c270ec09391ef530c0efb982a92e03b1a10689136cbb74c005fa386f20111b32a602557c0fdf5e2d716062da09d942e2f6e","ssdeep":"1536:r2+iDvYvNjx4Uyao0L8oDNzAuMMsTAQ0mqt2pXYzA4dANV1:i+iDYvPo0L8oZzAuMMsTA7mqt9zA4dA1","tlshash":"c773a501f78272384fa7e290220f2026e16d191505ac5bd8f179ffb93ef4954aa7d7b4","first_seen":"2025-09-04T00:49:32.778143Z","last_seen":"2025-12-29T13:58:58.019409Z","times_seen":420,"resource_available":true,"data":null}},"time_used":714,"timings":{"blocked":213,"dns":0,"connect":0,"send":0,"wait":500,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/18658e2800112e9a44f51af40cf562e47fffc?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.649Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/18658e2800112e9a44f51af40cf562e47fffc?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 18801\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"18658e2800112e9a44f51af40cf562e47fffc\"; filename*=utf-8''18658e2800112e9a44f51af40cf562e47fffc\r\ncontent-md5: wey1PGfS5lGfDuotB/mToA==\r\ncontent-transfer-encoding: binary\r\netag: \"FlXeXFEMwroXQcVO65DpM1sJcXSw\"\r\nlast-modified: Wed, 06 Jul 2022 13:06:30 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-25;QNM:cz27;SRCPROXY:cz14;SRC_***:61;SRCPROXY:61;QNM3:62;QNM3:95\r\nx-m-reqid: wSWFngusm\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: plMAAACmGI7aunMY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18801,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"c1ecb53c67d2e6519f0eea2d07f993a0","sha1":"55de5c510cc2ba1741c54eeb90e9335b097174b0","sha256":"ce9fd8e21e08c0c0edd427c1df2eda0f91ab567a04253f3fa073eef95caf649f","sha512":"ba7b6b4a09df310bd898e6efeb59927ea2a163bae24647f0b2a10a0895cccbb1d14fe3cb63c360e82741c8749d823155242fd5e35d3abddf3710af6b8d6cf638","ssdeep":"384:CbDNgMRoY39A6VuYTrEv/BNjEuhnEuCuOiR4khjmHLeAd0f3qOqUFCO9YR:CVv9ZVzO/jjEuquPOIJp00feU4OW","tlshash":"d282d106b2d3c76ac26f8a4b7809c52bc955e2f380575231b8e39bb575083b8d7d48c4","first_seen":"2025-10-05T21:06:15.212558Z","last_seen":"2026-04-05T21:57:02.164938Z","times_seen":14,"resource_available":false,"data":null}},"time_used":5122,"timings":{"blocked":1693,"dns":0,"connect":0,"send":0,"wait":842,"receive":2587,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/js/13575.1756903329400.cda1d494.js","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:09.702Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /js/13575.1756903329400.cda1d494.js HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:11 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-2f96c\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962711=G+xZvJTVy3tz9h+I9aQHv8vXbXmcjZEAyki4ZZ+qsKOIzlhmhy0JmwXiDHWWst8HNXLkp2G0HqpYxBE+5w3GNZE0DdM8Ng6J2SKlqN9Hpx5dW0hz60eNbku6JSeOzKhH6Y7Nutxe1Mhh9bObFptHWtt6U70oXjn/9RNiOB8aHEo7tE9C01FnEmIuxLlUNQY/\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 1CBBEC12-E3B4-4B57-9039-470A147BF3CD\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":194924,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"60a85822cef01147878bbad7876a1fe8","sha1":"94563a78fcb76c76cce769d2fc4021baf782c844","sha256":"5b0a33a268e1507f5e758833c854e3cda700d19c35357e4a2098263a80da8892","sha512":"c23f2184349d611d1c54c379a0aa29d9564ea4b76b44c049647f0caf9e5b9dfd809c87eb9fa94c58377df9a9540580d0920802784fe9f485380985f36eaa4a5b","ssdeep":"3072:z7jHoKRKphCnDgJoec+IDWIzls+7Xr0X7:sKRBgUPDWCW7","tlshash":"42141a84764170b8c396a165322f601ae22f789650dd9c24f3789ba47f7470df26fabc","first_seen":"2025-09-04T00:49:32.754298Z","last_seen":"2025-12-29T13:58:57.972807Z","times_seen":438,"resource_available":true,"data":null}},"time_used":2462,"timings":{"blocked":1556,"dns":0,"connect":0,"send":0,"wait":567,"receive":339,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/kc523-1/sponsor/sponsor_nav_web_3.png?1756903280095","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.971Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_3.png?1756903280095 HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:22 GMT\r\nContent-Type: image/png\r\nContent-Length: 7412\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-1cf4\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962722=kfzsfUw0f5QeOwOzB35C9zRbYYC1bo8MHVSYwpXnaUdNveFhhyssWExbW1NooqAwzajG/U7ziuOvfrzjYMMa2SisH+2Igfe3O0s6Am9BNqCdMMjXMSl3u2Is41Ung4zs3Sy4c1w10lLo61G2MsigkAzu1UlaHpJH/D8FVmX0q1MUV24Fyp4v8DuRvMAP3FGV\r\nAge: 249794\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: BD6A2DDD-2FDE-4088-BAF9-96866CF0116E\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7412,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 206 x 332, 8-bit colormap, non-interlaced","md5":"eb94a297c215863d5d2232eaa67f4779","sha1":"d006f382f63ada4e4ef65d124a75eac2e4e72dd0","sha256":"6bd46b617bf27cb28fb798d50b2d6daa2aaed1a278ed50e9aa549b6e4fac48c3","sha512":"dc7759393acb5e7d1a635b4d91d73e84abc41fe6afde99a85a8e4ed6f4f8b1b5819bbcaa80b1c213c00c89df8b81db512a7bff142b24c50565ff1e6289f1a30c","ssdeep":"192:Sfq39wgHGYB1fcUWobKUUR6IHaDmzDxfbTow:uQ9gCEUWoWUe6DeJQw","tlshash":"94e1ad76a7f6d695a6b7908cfece94050fbba2722c6352762b7b8c02170c339525b411","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T12:19:11.131457Z","times_seen":2134,"resource_available":false,"data":null}},"time_used":8672,"timings":{"blocked":8337,"dns":0,"connect":0,"send":0,"wait":334,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/undefined","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.949Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /undefined HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:14 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nCache-Control: public, s-maxage=600, max-age=0\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962714=X3amY441wvsjAI1xw2JJgjckwuib0itIgNKTTS4NwHGbaYMcSRe9Bsnv0C3cyCDUIDx9T8QKGfZZfGCtT7uRYZgsMcieRNZeslPqWb/4Qlg/gtt9evqjFMo2W1swogb+bhGIGk/Uy0+30C3DWkmBEvT48k/4zm2gOAlx12joojS2ndPSWw97gihjAzM8RQQv\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: EA61FE21-B9AE-4EC5-9987-529C1618668C\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23624,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5777)","md5":"87588e90bb24e209460bdbf1bcbcc074","sha1":"f3c57be16a0eaf6879f3469c6a2db7720a699832","sha256":"61ed38427305a473065294efb15ef101340cf9d3e19be35a6c6c86083698c328","sha512":"160c240e67f56096c7c519eeb5b11bd9fcac971ffbdaecd231be6aaba4f98a1dbf5f44a22c0edfbe64860e3039a11eba5be0eb13802c82e7033543d7891a8e51","ssdeep":"384:kR7B3v2VwiYwJvSoVXsp+pa/iZcVk97g6nMusplliz:kRdviNYiKop/E6wkpcu2lUz","tlshash":"9eb2292e8df349762523703a2bbfb208797180134309ed803e4de7584fd59aa46e7bd6","first_seen":"2025-09-04T00:49:32.720758Z","last_seen":"2025-12-29T13:58:58.052747Z","times_seen":445,"resource_available":false,"data":null}},"time_used":468,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":467,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/kc523-1/sponsor/sponsor_nav_web_1.png?1756903280095","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.965Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_1.png?1756903280095 HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:22 GMT\r\nContent-Type: image/png\r\nContent-Length: 7821\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-1e8d\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962722=kfzsfUw0f5QeOwOzB35C9zRbYYC1bo8MHVSYwpXnaUdNveFhhyssWExbW1NooqAwzajG/U7ziuOvfrzjYMMa2SisH+2Igfe3O0s6Am9BNqCdMMjXMSl3u2Is41Ung4zs3Sy4c1w10lLo61G2MsigkAzu1UlaHpJH/D8FVmX0q1MUV24Fyp4v8DuRvMAP3FGV\r\nAge: 249795\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: EFE51ADB-3ED8-4088-80FF-F8056FE6EE73\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7821,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 206 x 332, 8-bit colormap, non-interlaced","md5":"0eb441aa3c30cc3c92da984283938f90","sha1":"74a769808afa9b87ea483a82d47958bf05ab9b87","sha256":"146f45de163728bb850c9a8e6c1693dd4c82caf7b6e1f58728395003b84f286c","sha512":"d1c9c8824c4f42f71db8ce2b62955647aa55bb590305765cd931000d0fc6023f7d57cd3daf6992094365ca6ecb42f02f93d606d79f6643a2f89d52f71200461e","ssdeep":"192:AnUYZGCj89cpWsWKE+hAqF7k4Pk7KJw7OjF57HUNuvs7alaUd:AFEijWKE+hHF7kt7857HU/eRd","tlshash":"20f19f3eececd52cd1a745f68caf47a6142c5031ee9d7929b82fdc728649a409d403c5","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-22T12:19:11.155416Z","times_seen":2142,"resource_available":false,"data":null}},"time_used":8619,"timings":{"blocked":8292,"dns":0,"connect":0,"send":0,"wait":326,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/166455a3f50503155435b93c24a00e2b58d16?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:15.838Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/166455a3f50503155435b93c24a00e2b58d16?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 10194\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1727996\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"166455a3f50503155435b93c24a00e2b58d16\"; filename*=utf-8''166455a3f50503155435b93c24a00e2b58d16\r\ncontent-md5: QTBU59s5GsCvZ8xqY0wiJw==\r\ncontent-transfer-encoding: binary\r\netag: \"FuXRrmytypBmON0UylNF9cKYJcdy\"\r\nlast-modified: Wed, 06 Jul 2022 13:07:02 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-29;QNM3\r\nx-m-reqid: 90cRqLbjg\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: ldEAAABUtCYESm0Y\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10194,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"413054e7db391ac0af67cc6a634c2227","sha1":"e5d1ae6cadca906638dd14ca5345f5c29825c772","sha256":"c06b38b97aa5077c820d20961a3639c0202be14c47e2a21cba2fb4dd4101f86c","sha512":"02521556667085f6489bfcbf2a50e675ebfefe6a15b1883fa9350c901119a726ba0f7dbd68af5a016228e813296b9d1a8dc83d28b9249732db75b5b1aa963f12","ssdeep":"192:c04/PxIwGvp3FhopGEDKf1Z4I8bSL4/kD3gw9ws1PJ:cbPxjGNnEDKtZ412k/qp1PJ","tlshash":"9422bfef6fc0551f909251d292ad1ec6b7539bc793d348cb3164ed93a7ae02711ac207","first_seen":"2024-08-19T15:01:26.074379Z","last_seen":"2026-04-27T02:41:24.575726Z","times_seen":119,"resource_available":false,"data":null}},"time_used":7746,"timings":{"blocked":1506,"dns":0,"connect":0,"send":0,"wait":1970,"receive":4270,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/100620f15fc7885ef42508839e1e248ef3a39?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.013Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/100620f15fc7885ef42508839e1e248ef3a39?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 01 Nov 2025 02:05:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 36619\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 0\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"100620f15fc7885ef42508839e1e248ef3a39\"; filename*=utf-8''100620f15fc7885ef42508839e1e248ef3a39\r\ncontent-md5: 5yEwykOeSyjNY1Ky+wdoCA==\r\ncontent-transfer-encoding: binary\r\netag: \"Fn_4UBDdMEK5lqSfhIqFjso1e2aN\"\r\nlast-modified: Wed, 06 Jul 2022 12:49:07 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-25;QNM:cz27;SRCPROXY:cz13;SRC_***:70/304;SRCPROXY:70/304;QNM3:71/304;QNM3:89\r\nx-m-reqid: dK7FmVmY3\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Validate,Hit\r\nx-reqid: oc0AAACDBnW7d3MY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36619,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"e72130ca439e4b28cd6352b2fb076808","sha1":"7ff85010dd3042b996a49f848a858eca357b668d","sha256":"87b0531e017130d3c2fabfd56129f67fcf4cb82f4adcae1d69b2725573e7f6e0","sha512":"180b1885c3e9a82a56dee1bc58e182d5a716ec0bad6da9a4efcbc59c0c3a98d8a6de61cc9536cc59e9c929843226c2018c951db566c8864f6e5731a47d96a67d","ssdeep":"768:vCxo89XQnQi5uoBn7NSpU99XF/fCrRM259+B3DzyLm4Udu:vUQQmPMUFC9MxBCr","tlshash":"9cf2f1cdd7cf80c6055941693b892efa2acc8143a5149ec82f9f786a9b11df85a32d73","first_seen":"2023-07-08T08:51:57Z","last_seen":"2026-06-06T10:10:24.277145Z","times_seen":254,"resource_available":false,"data":null}},"time_used":11799,"timings":{"blocked":1332,"dns":0,"connect":0,"send":0,"wait":1971,"receive":8496,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/heying.d446c85d.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.788Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/heying.d446c85d.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 1425\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-591\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962714=X3amY441wvsjAI1xw2JJgjckwuib0itIgNKTTS4NwHGbaYMcSRe9Bsnv0C3cyCDUIDx9T8QKGfZZfGCtT7uRYZgsMcieRNZeslPqWb/4Qlg/gtt9evqjFMo2W1swogb+bhGIGk/Uy0+30C3DWkmBEvT48k/4zm2gOAlx12joojS2ndPSWw97gihjAzM8RQQv\r\nAge: 249787\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 4D97DB06-EAF2-49AD-BB80-4813B23F78E7\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1425,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced","md5":"c0d0c516850381dd1ca39dd94b08f21b","sha1":"54522affec52debd9c0bd3784f0ce9bf692f5d6d","sha256":"301cbb9a8c3fae88d732c8b8fdfe40113e3257831d37150e95564cc0f9b8fbe7","sha512":"6d6b1263f2de2b35237c784fd0aa127c469f8b6ebf347ff1987d791611d5b36f0909f3a81f9db6b1571756ecae60454d854e776e5ed782acbdfcce4fda2b9c86","ssdeep":"","tlshash":"dd213b5023742cd0e8ae3457ef12e5fdb823417994f8dd0c99b9bc3e84908b1057a48e","first_seen":"2025-09-04T00:49:32.953523Z","last_seen":"2026-07-22T12:19:11.107168Z","times_seen":2177,"resource_available":false,"data":null}},"time_used":789,"timings":{"blocked":482,"dns":0,"connect":0,"send":0,"wait":307,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_b0506ddf-52e0-4b2d-8f59-16f795505312.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.330Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_b0506ddf-52e0-4b2d-8f59-16f795505312.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:25 GMT\r\nContent-Type: image/png\r\nContent-Length: 473762\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AdLjVQDGSfWmRG5IxMYh2CZVKjIJnqdN2WdKTSRCQeLQKshGU7dbt5f1%2BcaJaAdwQEMuSYAeunrfPRZ8s0UXaNwEgLgtXX37aBWXhDMxpawG6t5N%2B2t7IWYVkQ%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"cc5f88340212cac674500954aead1456\"\r\nLast-Modified: Mon, 08 Sep 2025 20:42:18 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246270\r\ncf-cache-status: HIT\r\nCF-RAY: 99605748a86b5c88-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962725=yIoYJXnoX32vTrxda1zOc8miVG32U7nJJc12gDZ+In6cgnf8S38tKUUUMfLseQr/q8eimpOabVTJjmX6tFPOJmPT1E15RMXJLCAOTkmUEPpCMU6llWgDlqx+fr9zASS472DYjzlMiWRiDMxvJl4PxLo/nm3fsJVZbP5/iPuwIDPxIrhHcKVoSg2HyE5+IDkE\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 5B798103-98B4-48F7-93BB-B69A9697B8C9\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":473762,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"cc5f88340212cac674500954aead1456","sha1":"f90402519324070fe5387747aa568406615353b9","sha256":"eddd66a7205f52d67435b916c2fffea6024a6ecffdf74627cec55c7e4aa9f1fc","sha512":"fd5276c4c317e70b7c660edc9b4f71fb45c690d159a5ecaef28f9f9bb077225eda071915b2a5a6bdd28a525517e6ef38881b1d76201fecfe84f2093dce47a7dc","ssdeep":"12288:eY/dfPbc6XDpHO8KH4+h1+CNA93hMXHov7REUn+cBw5n+HtH:93b1SHQZhM3NABBw5GH","tlshash":"75a433612695f7273775ebf0cd7311ea3181e500a3ea64a7df6bc11a41e68a0b4ec31a","first_seen":"2025-08-29T11:05:53.308158Z","last_seen":"2025-12-29T08:12:31.3923Z","times_seen":284,"resource_available":false,"data":null}},"time_used":3416,"timings":{"blocked":2361,"dns":0,"connect":0,"send":0,"wait":342,"receive":713,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/partner.dca3fc6e.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.997Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/partner.dca3fc6e.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:22 GMT\r\nContent-Type: image/png\r\nContent-Length: 28969\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-7129\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962722=kfzsfUw0f5QeOwOzB35C9zRbYYC1bo8MHVSYwpXnaUdNveFhhyssWExbW1NooqAwzajG/U7ziuOvfrzjYMMa2SisH+2Igfe3O0s6Am9BNqCdMMjXMSl3u2Is41Ung4zs3Sy4c1w10lLo61G2MsigkAzu1UlaHpJH/D8FVmX0q1MUV24Fyp4v8DuRvMAP3FGV\r\nAge: 249790\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 68694FB9-C3BF-4CEF-9808-1D4158525CB4\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28969,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 480 x 151, 8-bit/color RGBA, non-interlaced","md5":"7374b72d05130af2d77119eb0eb4ba10","sha1":"5b3e5e621329685de250121b2fd9c798f46f7d65","sha256":"059a622a7f1f0f1f239d624f19b0f5531c0f0aedadb8ccd40d2570a76dd56752","sha512":"c2d0f744838a882c8ac15de6bb0bfbeb3dd2f31550cc7a259b9890ea38eddf835902171c1346ed7e1d2005ba18b929d598002d60b7355df72073d955521b18b0","ssdeep":"768:tAAoY1X4ITISUWhiqmMiuCaUENwHoacq8zqWx6:abaX4SIYIdMMow8zqi6","tlshash":"a2d2e0ecdc3058f1f533894dc979813a6f3886ba05e359817a36f92bddc3e8506491e6","first_seen":"2025-08-29T11:05:53.287538Z","last_seen":"2026-07-22T12:19:11.199264Z","times_seen":2289,"resource_available":false,"data":null}},"time_used":8930,"timings":{"blocked":8597,"dns":0,"connect":0,"send":0,"wait":332,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size704x442_7f760e34-ebbd-4cfc-bc28-666cc8a6234f.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.334Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size704x442_7f760e34-ebbd-4cfc-bc28-666cc8a6234f.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 242762\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VknXkGx3cbHBNkHpUQ7%2FuMyZ9kfbmWqK4KaD22Iu5U%2FCP%2F7UFN2hQOiX443fyLfCtrJnIYDJE0XscAiN6ymbBkg9TaKyC21ne2dmUpmYPf%2FA41Ae13FQdpGqwoyS\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"8d6414b9a03ebecda6026e71db5c722b\"\r\nLast-Modified: Thu, 18 Sep 2025 11:12:00 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246270\r\ncf-cache-status: HIT\r\nCF-RAY: 9960574b297d0435-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962726=JzzEHLt9Hb5OKDgPEZRvfMAR0A/77JrXyMkda9GV0LsHvzOmoL6JsFP5kwgt0UFPW+XcC2aB9Gj9fvC6m/AeKOmAdxwAIVrn9zI0SdEk+PuwVYXkQ00iCcHMT1bZTq/XKL7CqmkSImsiXzBwlX0Vsi2F0vM7a+R/XvVzrt7iUROax41zD+ILS6/KoAW+vQ6B\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 0D0F4B54-FBDD-4DE6-992B-2FD06989AC1B\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":242762,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 704 x 442, 8-bit/color RGBA, non-interlaced","md5":"8d6414b9a03ebecda6026e71db5c722b","sha1":"3afa8517807eaa556541da8bfa2a85cd64543e25","sha256":"f8c741596d8b7a6849030ab73cf98cca0b3aa37fc8696845b2ac8e31d52ffb21","sha512":"0375d4b767373b491dc0030a0ce6390e2a772c58bbfb55d54d75e6efb45287b5929b2bdbbae6a5f2eb889136f09ba6cb5441eb9e340d3cf811b90ede739fb84f","ssdeep":"6144:EDtODfBnbPbUu8ZWsJnBVoLx/hO8RakAdAZDdO0:EhOLBnbR89JnBiyLd0O0","tlshash":"1b3412bd2c1f1b8375ff5dd94ec555ebbb2431abc8a94280a556892e70701e3b837283","first_seen":"2025-08-29T11:05:53.168348Z","last_seen":"2025-12-29T13:58:58.073143Z","times_seen":290,"resource_available":false,"data":null}},"time_used":3232,"timings":{"blocked":2547,"dns":0,"connect":0,"send":0,"wait":338,"receive":347,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/img/home-bg.1e09954b.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:16.598Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /img/home-bg.1e09954b.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://x78d.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:22 GMT\r\nContent-Type: image/png\r\nContent-Length: 4014\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-fae\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962722=kfzsfUw0f5QeOwOzB35C9zRbYYC1bo8MHVSYwpXnaUdNveFhhyssWExbW1NooqAwzajG/U7ziuOvfrzjYMMa2SisH+2Igfe3O0s6Am9BNqCdMMjXMSl3u2Is41Ung4zs3Sy4c1w10lLo61G2MsigkAzu1UlaHpJH/D8FVmX0q1MUV24Fyp4v8DuRvMAP3FGV\r\nAge: 246270\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 14267CE7-9B98-422E-B344-8689F6B484C8\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4014,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 278 x 80, 8-bit colormap, non-interlaced","md5":"ed0eb6c81f949885511fbbe4d666a2f0","sha1":"d74fb98c3b01727753bb182eb5ee5d6eedf3da4a","sha256":"7fecf4ed61ab1535aafe2800474ac643b49264b83f54fc1da596d7334868ae75","sha512":"dd2f749e24e6b35f80fa77856c9c8b1cb1e0cacb9250b947403283e152d8bb9e7bf539df00ca6743d4162aeac014e47ce82191b62847fabe6cbb5693b4cd7fec","ssdeep":"","tlshash":"1a816c7eb31a4997296ff194138b387d74b0709d0b546934388a9c31a4791fcf39e526","first_seen":"2025-08-29T11:05:53.155399Z","last_seen":"2026-07-22T12:19:11.192152Z","times_seen":2246,"resource_available":false,"data":null}},"time_used":5658,"timings":{"blocked":808,"dns":0,"connect":0,"send":0,"wait":4850,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/css/64906.1756903329400.0ab0fca2.css","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:13.719Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /css/64906.1756903329400.0ab0fca2.css HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:14 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-1439\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962714=X3amY441wvsjAI1xw2JJgjckwuib0itIgNKTTS4NwHGbaYMcSRe9Bsnv0C3cyCDUIDx9T8QKGfZZfGCtT7uRYZgsMcieRNZeslPqWb/4Qlg/gtt9evqjFMo2W1swogb+bhGIGk/Uy0+30C3DWkmBEvT48k/4zm2gOAlx12joojS2ndPSWw97gihjAzM8RQQv\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 8FA09D8C-8B9B-4B60-841C-F1ED24FF5931\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5177,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (5177), with no line terminators","md5":"a0ef4268641ef0b005737ce8cc0c4b44","sha1":"9bb50b9000a419e7a701392b0d7d6c992cf585bb","sha256":"f64c7a7e6ecd620d1c7f8cc67e1eda83a0a115a8d86f3954efdaba3c09d62e66","sha512":"07605ebd7e16aef28f0ad5ed406f29ea9b77e8ba6b2079c810aacf8faf0b4a8d18d4f7775c62860cbf6d4379729a60076103a4daa833c860ddebeee3793ccbe2","ssdeep":"48:ZSPkOO2s2L5Pukasq+nArLkrL4QuQKhUjUkM5P6CdRDRWURcWaTHR/:iOvyP2r4rEDFP61LR/","tlshash":"d1b1412f01703349641bad6807dc67098325d8b399eb37da259d2a0dcbc3f861eb718b","first_seen":"2025-06-26T16:31:28.933081Z","last_seen":"2026-07-22T12:19:11.195765Z","times_seen":3505,"resource_available":false,"data":null}},"time_used":473,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":473,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_9986c108-3fd7-4f35-9443-f78ce32e1660.png","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:23.369Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_9986c108-3fd7-4f35-9443-f78ce32e1660.png HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:27 GMT\r\nContent-Type: image/png\r\nContent-Length: 20774\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Rcv9F1XxAJH%2BeES1GkMojsSwVrlgkihyQU%2BASAzeQhDfzLEUgKmn3TYG7NNxtD3n7ZNT8d1vqodJR61KneSnyKysD1A3yJs54%2B5NbJZ1GnSWK80lgsf2o7kSoEPX\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"b4734010f7828ca2c22c389ee510755e\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:03 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 246263\r\ncf-cache-status: HIT\r\nCF-RAY: 9960577e497a8564-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761962727=DaQzn+czGW4s8AUV75xtyTdP/KsCbn3bgvwlYe3BLSQQI7lIo0LGUvmc74g+8WEtWq/m4UyZ5pbJ1/+xshqMO/OpZWANbjoUIjrsb8Duns4JFiqY/MRtJrWrdVWNjKqH9t8CitMvPt65N9PNOiP0pKLoGtnU+n6PpEbM+7UVGp717N9m6IylUEADU1KorbL9\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: B9186791-92A1-4BB4-8997-781683AEA9EB\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20774,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit colormap, non-interlaced","md5":"b4734010f7828ca2c22c389ee510755e","sha1":"757202b8e2a145b911c7d7693bbf5fd753ede9e6","sha256":"7baac8631e3b6377f2aff7262dae5a82e2e5f5ce14edf950e64e6426e674cff4","sha512":"fa9b53fe2c82ab0fcdd8f6d004083cb25c718eca270b6866a760de7df1775ec06b8be572baa3dbf90e5da20f0a9d807ee10df13b31e397b2ac35ffb78d5070e1","ssdeep":"384:7MUqGTUfqNN66k60ie1NIgiVG+V+DhwuNJ7SOEOsWM7RKjFQ8ZrG++eR:7YwUfg6I0b1N9S+DmQJ7SLOIAji8Z6g","tlshash":"e692d0d3168a6abbe615da79c15e10879ad2a00155f8f9038db7c74bc7324cc0979bc3","first_seen":"2025-08-29T11:05:53.157247Z","last_seen":"2025-12-29T13:58:58.067607Z","times_seen":293,"resource_available":false,"data":null}},"time_used":4079,"timings":{"blocked":3723,"dns":0,"connect":0,"send":0,"wait":355,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"x78d.xyz/ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb","fqdn":"x78d.xyz","domain":"x78d.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.180","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://x78d.xyz/","date":"2025-11-01T02:05:14.815Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b224h.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 05:34:51 GMT","end":"Fri, 23 Jan 2026 05:34:50 GMT"},"fingerprint":{"sha1":"EF:97:E4:00:B1:FF:E0:0E:47:23:91:03:EB:A6:A8:26:51:58:83:2A","sha256":"9C:8C:8D:F5:2C:39:19:55:AC:C7:8B:71:36:EE:A3:65:3E:D5:45:B8:0B:D1:EB:22:CF:7A:54:65:AD:D5:6F:80"}}},"request":{"raw":"GET /ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb HTTP/1.1\r\nHost: x78d.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://x78d.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://x78d.xyz\r\nXign: OouQnLhnzB3HTvEeHGvRsBqg/epHsv6lzdwjhwjHi4CNoodxHVCEQv5QzO5g7kqjyrzyCzAqI6nozYwbxRpqIfmuM0028Y+rBVTsbiyrXFicFk/iANiOm5Htl454Vog53zs91j6v7sEmrUKkpAcEjie+IorFvtFlnvARgOU6/kI=\r\ntimestamp: 1761962714779\r\nsign: 94f1c5u710205d20\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: Kc3Md8YTTSx5jDErM6fkSDaKwC66eyT6\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 01 Nov 2025 02:05:15 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Sat, 01 Nov 2025 02:15:15 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761962715=rr8RSxjhoP257i6Bcaw8RAyhBBSN9LM0Zm++tGYblKe4lINKan0tJxjQ+awisU8PAffPWL2lcq89/R+JBdA2+2HktmKNjDSnqKoe2VIyZmQ3Jj1FpRTp4eaNKE7YN/wPW35Fl7rDBMfqAKJhefHKWxPz13RlmOx2Fr6dM18340tRhTsZua9KEtmXkrf8aDdq\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1761374003\r\nX-Request-Id: 39E0479F-5DF9-47BF-B6C2-03A309DD20DD\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6556,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"fa4803817ac939be26cf8e1954e3e765","sha1":"3894e39c72e1c052158981cfe71e77993c3aae39","sha256":"10cfae880e803996c80de25ec4d7aaa4a67440917f2dabf24824fb0be5c8ea0f","sha512":"c2e76c21c2c6f00b416beb1340d9fa6808f7355da5ca6c7fafbf19b8a59486a80e4d0611c96581e4d4ba2350c407bbc8e9c0c7b811cbb9e8523f9245d878449b","ssdeep":"192:Vra8lKwA7WqyT3BnwneHyZrwUP8ge3yLdMXA4SRJBfdJgrGfMOMg:0Z37WdDBCUyeUP8geCASqOMg","tlshash":"fa12af1ad7625714b03a40eeb50b8b84a119919befe6bba9ca5049e818a010876fc16b","first_seen":"2025-10-31T13:59:12.487539Z","last_seen":"2025-11-01T02:05:52.112294Z","times_seen":2,"resource_available":false,"data":null}},"time_used":988,"timings":{"blocked":516,"dns":0,"connect":0,"send":0,"wait":465,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Bet365","trigger":"x78d.xyz","verdict":"phishing","severity":"medium","comment":"Bet365","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"x78d.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}