{"report_id":"b19e76b0-185d-4c0d-88ea-a32ce5347ff4","version":6,"status":"done","tags":[],"date":"2026-05-12T08:41:38Z","url":{"schema":"http","addr":"vip1-ttuex.com","fqdn":"vip1-ttuex.com","domain":"vip1-ttuex.com","tld":"com"},"ip":{"addr":"172.67.202.223","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"vip1-ttuex.com/","fqdn":"vip1-ttuex.com","domain":"vip1-ttuex.com","tld":"com"},"title":"交互式多彩光线背景","dom":{"size":3124,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"3317a1ec8301c77ae13fb79da548d1fd","sha1":"63e724dcae3451aaf6ac3a2c9ac655dae52fa8e5","sha256":"3a205cbf20feed937d4fecfffbb31292b2be956a537b601f9a80bf2a4561d4f8","sha512":"c2983e88ce303658ad4aa4c8ffc5157628b97fbb2cbe1140832e5893fbc30b35d7ffee6f634435df9c3ee17c645b2ac42d87e37bc0f2a54067e64773949a94a1","ssdeep":"","tlshash":"fe51e00962f30f7f106663261feb710c9a4081135686dc5cfe2ee31c4f7ac469967eaa","dom_hash":"domhash5f7c80c20a155f683c7d004aa92550f1","first_seen":"2026-05-12T08:41:40.453362Z","last_seen":"2026-05-12T08:41:40.453362Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"vip1-ttuex.com","fqdn":"vip1-ttuex.com","domain":"vip1-ttuex.com","tld":"com"},"ip":{"addr":"172.67.202.223","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-16T08:41:38Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"vip1-ttuex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"vip1-ttuex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"vip1-ttuex.com","ip":{"addr":"172.67.202.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-08-13","domain_rank":0,"first_seen":"2025-08-28T18:34:03.083261Z","last_seen":"2025-08-28T18:34:03.083261Z","alert_count":6,"request_count":3,"received_data":248921,"sent_data":1357,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"vip1-ttuex.com/","fqdn":"vip1-ttuex.com","domain":"vip1-ttuex.com","tld":"com"},"ip":{"addr":"172.67.202.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"241d77a42359b08c7fdaffc2afc72b59","sha1":"6dd63d03997a63b1bc063b6d37c5edc18746ae24","sha256":"7fb369b2c21fe774fc40295f2b94e35d00a10100d20ff68bb0bae1bb433036d4","sha512":"1c4992a00301d740aa6c7a390f6c2c2f89a705302ba0a6433fec9903a26a2e8360e1698d010ad381c37630046519feebe9b24ff817066bbe06413517c62be42c","ssdeep":"","tlshash":"4f41d11961f30f7a006a73261fdb710c96008123299aed5cfe2dc30c5f7ac129926eaa","size":2429,"data":"","first_seen":"2026-05-12T08:41:40.457335Z","last_seen":"2026-05-12T08:41:40.457335Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"vip1-ttuex.com/","fqdn":"vip1-ttuex.com","domain":"vip1-ttuex.com","tld":"com"},"ip":{"addr":"172.67.202.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-12T08:41:15.002Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vip1-ttuex.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 15 Mar 2026 09:02:30 GMT","end":"Sat, 13 Jun 2026 09:02:29 GMT"},"fingerprint":{"sha1":"1E:5F:90:0E:EC:41:BD:7D:CD:52:E8:E0:D4:22:3E:C0:F4:78:A7:3E","sha256":"0B:5E:4C:E4:4B:DD:FB:DE:A4:D3:EE:CE:6F:60:90:83:D7:CA:CD:ED:E6:19:EA:03:67:70:C7:F9:64:40:76:4C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: vip1-ttuex.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 12 May 2026 08:41:15 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Sun, 15 Mar 2026 19:27:39 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=doqxmyMBJneLZTQ7cQjMdFWk30dxhaeQsMpPO3pMKkc4tHgABwoQLNJHOPBzoqLWMCmK5qcv%2Bs9chlFn0E9EzVVD0jbb0DjFw66L%2BJnXlL%2FiBagN8a2vvVw85MUIKJD%2FJw%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9fa81f8d1a7c0b51-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3114,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"0e12719774e9944055e6b9e57bac4030","sha1":"e53c42e73d45ef26169d033300ac94ede51bf632","sha256":"cdaf18e7396034e6e59d01063b34bfd04f6d3d27b1ab61d64690bebeedee3875","sha512":"4000bb31f041a55dba821e1b7c66a7fff28d2093c7dba5e37ace575387b936dba6fb6c8e54ff7b7fcee239f90a8b3faffa1d9d0e87c1bb540c7a3c4f66f4dbf0","ssdeep":"","tlshash":"9a51e00962f30f7b106663251feb710c964081135686dc5cfe6ed31c4f7ac069967eaa","first_seen":"2026-05-12T08:41:40.454755Z","last_seen":"2026-05-12T08:41:40.454755Z","times_seen":1,"resource_available":false,"data":null}},"time_used":511,"timings":{"blocked":48,"dns":29,"connect":1,"send":0,"wait":414,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"vip1-ttuex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"vip1-ttuex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vip1-ttuex.com/img/loading.jpg","fqdn":"vip1-ttuex.com","domain":"vip1-ttuex.com","tld":"com"},"ip":{"addr":"172.67.202.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vip1-ttuex.com/","date":"2026-05-12T08:41:15.597Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vip1-ttuex.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 15 Mar 2026 09:02:30 GMT","end":"Sat, 13 Jun 2026 09:02:29 GMT"},"fingerprint":{"sha1":"1E:5F:90:0E:EC:41:BD:7D:CD:52:E8:E0:D4:22:3E:C0:F4:78:A7:3E","sha256":"0B:5E:4C:E4:4B:DD:FB:DE:A4:D3:EE:CE:6F:60:90:83:D7:CA:CD:ED:E6:19:EA:03:67:70:C7:F9:64:40:76:4C"}}},"request":{"raw":"GET /img/loading.jpg HTTP/1.1\r\nHost: vip1-ttuex.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vip1-ttuex.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 08:41:15 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sun, 15 Mar 2026 09:54:13 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"69b681c5-2d443\"\r\nexpires: Thu, 11 Jun 2026 08:41:15 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zs05WquVzHTs5xHGjRCKObbWK3k%2F55U4WHA%2BhblqPeNTqLXBb3m2lHKCQBa8CYrELLO5YB6iM9qYWG9zN8LPw2HW8O3Qh2Yhycfz%2FFeeKZ6Khht5DK7Ud2nJWY5itz3QDw%3D%3D\"}]}\r\ncf-ray: 9fa81f907f9cb505-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":185411,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1080, components 3","md5":"e5bbfd81d6e8ddb7b85548717e744fe2","sha1":"6ef43ff42adc1b6486fc9ec30d55173237da0406","sha256":"079a9cb2b5329bdd6426b0a2ae8bc1f0a1b0bddf1f720f4bfd45c9f8e1f96616","sha512":"9967419efededbdb6c3326d3412c4a7a34790d8ebd3a6a8ef33c350a493dbbc696340896db1c8c46f6495316752aeb83a09c826bb8b236e42e383650d8b078ba","ssdeep":"3072:qE0ov6zyU/aw6cNzFKfZy8AA7pN22tTotIIO7kUsjOcz6xpVa76iOWJ5LtYcA+c5:qE0oyrzFKfZTBTfIO7fY+HOxIchc5","tlshash":"b104136b11bcb443da7c74754dffa248ea62c06f228e7ad54c16fc670a6e3423a5e05c","first_seen":"2026-05-12T08:41:40.45572Z","last_seen":"2026-05-12T08:41:40.45572Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1097,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":374,"receive":723,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"vip1-ttuex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"vip1-ttuex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vip1-ttuex.com/favicon.ico","fqdn":"vip1-ttuex.com","domain":"vip1-ttuex.com","tld":"com"},"ip":{"addr":"172.67.202.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vip1-ttuex.com/","date":"2026-05-12T08:41:15.849Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vip1-ttuex.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 15 Mar 2026 09:02:30 GMT","end":"Sat, 13 Jun 2026 09:02:29 GMT"},"fingerprint":{"sha1":"1E:5F:90:0E:EC:41:BD:7D:CD:52:E8:E0:D4:22:3E:C0:F4:78:A7:3E","sha256":"0B:5E:4C:E4:4B:DD:FB:DE:A4:D3:EE:CE:6F:60:90:83:D7:CA:CD:ED:E6:19:EA:03:67:70:C7:F9:64:40:76:4C"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: vip1-ttuex.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vip1-ttuex.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 08:41:16 GMT\r\ncontent-type: text/html\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WPqn9wgC%2BLtuz8sSFHvWIIu1yeI%2F%2FbDIMX%2F2RMltjas0gLbHu4qp%2FbEEurAxeot1du49t5ad5%2F%2BqZebQt7%2FNXwY8uddxXfqVUicIwTZ3tgK68PgEKah0dlU4PjuBUA6HzQ%3D%3D\"}]}\r\npriority: u=6,i=?0\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=1800\r\ncf-cache-status: MISS\r\ncf-ray: 9fa81f920faab505-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":58296,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (56756)","md5":"cbb42513032d6c09e496731ac16c20a9","sha1":"c92f38a701aad58408451d24dd4c47b05f158cf0","sha256":"d189695b2f3bb92369881f2428fa861dca9d9a94c638d9bdc4e2fa747d6f315b","sha512":"3d76f1018afceaba7cbb4083f4a5b5758966ec2aa5d5c6b07d72361782809f7ed4bd34ed9e0c4154d01a2db7192155de8251e5a834dd90b8d9823d916e1b7285","ssdeep":"768:cHJYDDQHVZHIs91TXESJBjgBSp00yCqJ3Z+IYM3WiesRQiULO0bpD9tcNQEfdom2:cmDD6oeFUycwpk06hWp1b99c7VM","tlshash":"8443021803de40a2cd8978d9426f2f3d842a1863da1c94bd1f5b6df4ca0d8a4767f1e9","first_seen":"2024-11-25T13:26:01.204756Z","last_seen":"2026-08-13T14:58:15.851329Z","times_seen":13910,"resource_available":true,"data":null}},"time_used":789,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":402,"receive":387,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"vip1-ttuex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"vip1-ttuex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}