{"report_id":"b96d16e6-cc45-49d3-96fa-138105e0ebd5","version":0,"status":"done","tags":[],"date":"2026-09-05T06:16:34Z","url":{"schema":"http","addr":"www.roofquotesnow.com/","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":0,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"final":{"url":{"schema":"http","addr":"www.roofquotesnow.com/","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"title":"赢博官方网站_赢博（中国）","dom":{"size":28379,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1524)","md5":"3394f7018da4ccdeb210ab8839f7dbf7","sha1":"32ce1842491bb605e395f44c6a85b84d18c0aa07","sha256":"1b61dcafe18c9b355d7db1462f1b663651ac5950e49e195901680500fbc2ff43","sha512":"7eb11c00bd316c7f35d509d39d03725c25f7f70289ac761daa279d968615d0b2768062ae75391f9fdcf354f7b10dc9492f30d530bea65c14c8b98e573608dd4f","ssdeep":"768:p880NxSYJxSYhxSY4CjdJ44o+elT62jA143/REbL:p880DSYvSYnSY/jdJ4Z1T62jA8g","tlshash":"58d2431093ed6d6a052252ca909c6b1eecdf7d33ed324d42b3bf5f49878abc29805497","dom_hash":"domhash78678f5445f0554b4ed4e0ccb2187655","first_seen":"2026-09-05T06:16:43.719055Z","last_seen":"2026-09-05T06:16:43.719055Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"www.roofquotesnow.com/","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":0,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-10T06:16:34Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.roofquotesnow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.zuizhongjs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.zuizhongjs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"zuizhongjs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"zuizhongjs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"zuizhongjs.com","ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"domain_registered":"2024-11-11","domain_rank":2159447,"first_seen":"2025-05-16T22:08:31.21743Z","last_seen":"2026-08-29T21:17:15.030999Z","alert_count":2,"request_count":1,"received_data":3163,"sent_data":481,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"www.hbjtjl.com","ip":{"addr":"60.205.123.83","port":80,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":13,"received_data":1619363,"sent_data":5699,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]},{"fqdn":"aaa.aimarksix.com","ip":{"addr":"156.245.247.30","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"domain_registered":"2026-08-01","domain_rank":0,"first_seen":"2026-08-14T06:57:05.558981Z","last_seen":"2026-08-30T07:34:22.705812Z","alert_count":0,"request_count":1,"received_data":469,"sent_data":479,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}]},{"fqdn":"www.roofquotesnow.com","ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":18,"request_count":18,"received_data":139366,"sent_data":8722,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"sdk.51.la","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2005-01-17","domain_rank":347679,"first_seen":"2021-03-08T16:03:51Z","last_seen":"2026-09-01T18:28:25.06294Z","alert_count":0,"request_count":3,"received_data":0,"sent_data":1029,"comment":"","tags":null,"fingerprints":null},{"fqdn":"www.ptfafa.com","ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"domain_registered":"2023-11-25","domain_rank":0,"first_seen":"2023-12-24T17:28:39Z","last_seen":"2026-08-29T21:17:15.09029Z","alert_count":36,"request_count":36,"received_data":1949369,"sent_data":20354,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"vv.sfgname.top","ip":{"addr":"156.245.247.30","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"domain_registered":"2026-05-25","domain_rank":0,"first_seen":"2026-08-17T07:13:29.30369Z","last_seen":"2026-09-04T22:00:35.978913Z","alert_count":0,"request_count":3,"received_data":5693,"sent_data":1553,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}]},{"fqdn":"www.zuizhongjs.com","ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"domain_registered":"2024-11-11","domain_rank":0,"first_seen":"2024-12-07T06:59:27.693003Z","last_seen":"2026-08-22T18:45:34.974941Z","alert_count":2,"request_count":1,"received_data":2043,"sent_data":463,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"http","addr":"www.roofquotesnow.com/public/static/home/js/jquery1.42.min.js","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"ed4e85ddc6e188c8490191794776f22e","sha1":"83b9249bbbcd563eef7546291d0407f0e70166ce","sha256":"8f764efbb2cdb303e3019325d811225ead27d656f8b40390de427db1415dc56a","sha512":"d8919c3b49d80e25163e29cd35f8a7f18dfd07880f72bbe3104c91e1fefd68d1d8a59708909ab57215fd2e334aa990084299c368ac57141421a6eca74e080edf","ssdeep":"1536:/KRUXRa8Dgwxcy2jpBNwch96SLk8Ek2BSrBGS1ia/eEk4aV2EXi8SMpQ47GKF:/u1zNwcv9qBy1HOg8SMpQ47GKF","tlshash":"7d83f8df77ca702247ab30b9006f550bf276199d684d4400f259d8e9bc78a4a823bf7e","size":87461,"data":"","first_seen":"2023-06-09T23:20:42Z","last_seen":"2026-09-05T06:16:43.727093Z","times_seen":4597,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"introduction_type":"eval","is_inline":false,"md5":"567646f064a9ec9d9c906faa2b54ac26","sha1":"4e0f36511484057993ff05fb097cd9331d56a0b2","sha256":"7626226cef8b4bdbc5705b44e16f7479518b11cf7e8c04466c768aaed47c3573","sha512":"b7249a0beeb9082e8a2aac9a8c01a33dd38bf3c266a6506d121bb2c5acfcc12fa726db0f3fe384b8a4dfd7028f01cc2121298788af8977e0e830435a93308bbc","ssdeep":"","tlshash":"ffb0924a7e1ac158690108c0e8b0ea38a079a8309d42edacc9aa683864c678c6f01910","size":125,"data":"","first_seen":"2024-12-19T08:11:36.846009Z","last_seen":"2026-09-05T06:16:43.760556Z","times_seen":563,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"836b817a09d6ae623cc653090cc89291","sha1":"a5327b9b9c6b66866f5ae290479418abbcf6e1a7","sha256":"60df3c789e7ccc0281db49c217442dde98ae3b59bb162dcb7b0eb5d32009469e","sha512":"d2350e4b9b1128ebbe11afdfe850c58f5806383350ed81394d24ac9b6d73585afa1eeba91c59500e88c947952ebad2643ba1ebafd271877a8fa018f8aced5e9c","ssdeep":"","tlshash":"d2f09eaedc45b15c56c624f9e79bd648d15e4025d00ad857a9d5c4cd2d38fc4142138c","size":516,"data":"","first_seen":"2026-01-24T23:36:07.907053Z","last_seen":"2026-09-05T06:16:43.761162Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/js/jquery.min.js","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"ed5d820aae73fcec34ea7157cfddddfc","sha1":"42febe5a54f6950910af22d5dad70d9f768b1621","sha256":"00b4b7ac4936e9decea689135a6d4a534a03879b8f48dc14530281b08ea09b6d","sha512":"b6391a0fed92f2c5f37817b7bbb06591044ab10285b10de03e15b961fce9b0334f9f0697ce0eed567a7c996304324eff8e1d8e2e723f8802753483c3cd518ff0","ssdeep":"1536:KxZLrMgzv9HXprbJGLz6sUdj4HR64F7omep/11E97fHWhZPMu0X8+2Hzd0elLTfJ:oFj4MOMt11UHUPu2HzdD0xzqXR","tlshash":"b9f31d8a6ae32031a227b07d4f5fd809b535985f1e88fd103e4c52a59f1c83c57baf99","size":157860,"data":"","first_seen":"2024-05-10T11:06:42Z","last_seen":"2026-09-05T06:16:43.744089Z","times_seen":3452,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/ky.html","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"5a14e10a404661762fe3e5d3951ac8d5","sha1":"e4c26c384c63c218380b7522e4237230b120c599","sha256":"52744c343690e4d765f11075bbb80ca31e96f437b563ea57aaf61a6cd69d6173","sha512":"078fcd948807c7d348ce3fb50c5b853d6d45fefc619167447fc8decb8de889dccce6f0df2779e9ab4b9339e9909c009597932d1e6e25d973a447705c0383ec48","ssdeep":"","tlshash":"06c08c017dc7cd28804042e28864e10890a8f52be602ad04b6ee40405f82b480800920","size":152,"data":"","first_seen":"2026-05-25T19:40:09.172559Z","last_seen":"2026-09-05T06:16:43.762389Z","times_seen":422,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/ky.html","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"cfa7ec5c5ecb40a09faa825a36559b73","sha1":"17f9abea157b50e013b48f8af8b4c72f6cf59081","sha256":"b0b2d46568b3a2edc2cf9a7c062693fade8bcb07bf4f29a4cf8a5bb7e4f94962","sha512":"53c51099107a73aca4b6980504f73ef4d92095de65931caf531228d6ec557bdd11a2c62e629e37a3fb08fefdb37f8ec181a0174b4618be3aea890e48dceb5e4c","ssdeep":"","tlshash":"a7016d4a25a2b55312bb35791b9f605079242443c08acf12bdace6c54f449bc927aa6f","size":684,"data":"","first_seen":"2026-05-25T23:00:17.242385Z","last_seen":"2026-09-05T06:16:43.763176Z","times_seen":177,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/ky.html","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"5d961723476165edd8c10d0627906057","sha1":"e305b57c19a02e778a633faccc8c911d714149bc","sha256":"ca63f6fefe0872f3b91eb5e2d7267a716d9926a7840281760c7521a85148cfd2","sha512":"8279655659bd2ae4aa85a3c701cab2e3d1d71e3d8b26a38eb12df1c36d1accd4b2c3a6d8f2181db1c71e113888171390d072952428d9865ffa970ae28fdedd6c","ssdeep":"","tlshash":"a35135ee24564cba0f57648873b0164464a12b6163b2dfdff9061d57b205cf98312def","size":2972,"data":"","first_seen":"2026-05-25T23:00:17.244305Z","last_seen":"2026-09-05T06:16:43.763807Z","times_seen":298,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/ky.html","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"Function","is_inline":false,"md5":"26421ac860f4dba7f27811712a149502","sha1":"aaf37d59cb4b28ac48ecefa82a2824a8e6210d5b","sha256":"266f482d6e5dd0302fca1871e22db5996e068d1188d1ba9cd96b892552fbcab3","sha512":"919156d81b248a368b0559741a8e0ce24a14178806923d1c1e783b25c3e61815727c3b81cf21e8f4ccd6c29c49f43e8a4d3cfe5bf386b43b01913f328d864e4d","ssdeep":"","tlshash":"6e9004d730c350345f53135404571cc5513cc470144c4d44c0c0d4517cd50345115c5c","size":39,"data":"","first_seen":"2023-04-12T04:16:13Z","last_seen":"2026-09-05T06:16:43.765396Z","times_seen":20563,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/public/static/plugins/layui/layui.js","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"017f3d95f25a1624511f76140b934e78","sha1":"257d89299f16d2e66d81f5cc55b4be2d2edca1de","sha256":"490c087acfee2c88da6a9f4b98df4535c9c2283c196af01c2c9284c123d85770","sha512":"a918a8a5de141a72ea93e01e8de1ff9d66d774865afe8e8199dc535534c66f0d33829dc4b657cb14a66fe0ccac0fad9bbc9c06f211f6d52d1f62cbe476056ecb","ssdeep":"96:63aT4iKlGXo3xUW1U07aSEf1ERrUn8Ax27il3Ju8uqls/D01b3/JLuVvu2:4aTZXU9b7+N8+l3g8uqS8z/h4W2","tlshash":"4cf19688bab23462437b306572af801da67b44ae390c4190d1ded9e53c76cae4377f5c","size":7612,"data":"","first_seen":"2026-09-05T06:16:43.768501Z","last_seen":"2026-09-05T06:16:43.768501Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.zuizhongjs.com/js/ky1.js","fqdn":"www.zuizhongjs.com","domain":"zuizhongjs.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"994f0c9a304160cbf2beb68093f36751","sha1":"9c8e3bf2883946a0d58a5336330463847c6cab11","sha256":"4011c3afd99ebf1b563b026776ea43a49dfa14a9ec7720201bf4b94d848f0b0c","sha512":"3f08ed48ce733be2a49a94a01c05fb4dc22a13f514fbd2059b201e90ec47fca3e0edb5892f1000686a05ff33925ab241b1010b2da9a9835e801799f3d17b9425","ssdeep":"","tlshash":"723132d4abd27d2d033153346c36da5496ba8831ed079d40785ffd909fa45a80eaacec","size":1765,"data":"","first_seen":"2025-09-30T03:00:09.656491Z","last_seen":"2026-09-05T06:16:43.72842Z","times_seen":483,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"197a91da5bd4ed9e508286066bf9d215","sha1":"3f30e8f7cb23c1a699600eba7c86296c6e8c443d","sha256":"3242cc54347fa7a60480033d5ec31d9234d4e35382388408b4b35d27015b261a","sha512":"d7850c64953a7a32ba338066223e9a7c5547394ab5f63b2e445feeab005f37144d6b0ff25d144181ef49740ecf2c24c1a53c88bf00a796c6b16b2f5cfee27b4c","ssdeep":"","tlshash":"30d023d57bbd7d016c343356c02d14c9a40c481117b754075ef754d942e0474457cf8c","size":243,"data":"","first_seen":"2026-09-05T06:16:43.769762Z","last_seen":"2026-09-05T06:16:43.769762Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"686da83ee61817a4db022b81f923a7d6","sha1":"f79f1de717bc7aa0abefe34bad446b71c36b9261","sha256":"84f5eec21f1f0c48dad03e9ed61b0186e9ff831acae54bb7bb7bff20dcd71fd0","sha512":"7edd6f7785ccfef3bdc36cbfc79eacc16dfcc27a9bcd1bf307300ea90202706e7c9b141cda1f69f3b1554c433508014efc613107cf1dd66e8d5db001c865cf5b","ssdeep":"","tlshash":"d1f09e6eec41a3646ac625b8979fd648d09e0026d40ad403a9dac5cd2c3cfc404213cc","size":516,"data":"","first_seen":"2026-01-24T23:36:07.906272Z","last_seen":"2026-09-05T06:16:43.770828Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vv.sfgname.top/stats.js?id=sf_ab7c0844226d283b7bb1c8bbebe54e33","fqdn":"vv.sfgname.top","domain":"sfgname.top","tld":"top"},"ip":{"addr":"156.245.247.30","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"485663e13df74ceeb6f14bda77207ccb","sha1":"6466760a1163b0f18832ce77cc99d8d307cff756","sha256":"a1c5488a924907f1bf7d5688c8c5a8a8185b6384ce9f70393a3d6bf5a3a99b89","sha512":"d96a1b77498f1e60ca1c7affe3fd07a59aec0c9b86b26a366634b1e54b0c8e7a4b0642561fb53dd86c5df0c7118e7c3eb459ad8d4143468a1effd0bdb179aed6","ssdeep":"","tlshash":"d0710e698ce330b5153b702a4baf91047636e0235586dd05bd8d66402f68b2e57f6ffc","size":3672,"data":"","first_seen":"2026-08-10T05:33:11.347821Z","last_seen":"2026-09-05T06:16:43.745545Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/public/static/plugins/layui/lay/modules/carousel.js","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"1bf0471c21f38d673bd24d0b4ce2d737","sha1":"e2b5bda5eaf5d370a680b37ff3e21124a0a70647","sha256":"3100ab3b307ba5cfefff8a94bd17b053b1d0a7ff42feb7b6d9da2e691ab25d5e","sha512":"facf1f1ca3ecbf3183f3dd84c61eba19e731e38dc923ab6025d71644bb4de52aa886b3f4dc0d540045d2c8642e55f60f71d516bbbd5d54379dc31d540993d0bf","ssdeep":"","tlshash":"d38121817b5f386741972453935f4c0896b719ba9b06d054f2a264fa6dfbc88223ef0f","size":3837,"data":"","first_seen":"2023-06-18T10:24:20Z","last_seen":"2026-09-05T06:16:43.738465Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zuizhongjs.com/js/26/8/8/ky1.js","fqdn":"zuizhongjs.com","domain":"zuizhongjs.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"60b06036226d0c1b8282d527cbf53c3d","sha1":"6b49a42c039d97210a819a1652e5e0142de8e6a0","sha256":"f2c8bbaacbb69dbf2d10775693a7b7e61b9f88b95f6f7adad3a567f0af3f53dc","sha512":"e5f92f4b360c94ff650d6042cf14c8c1c14bf511cf39ae0c63c888b3fae9a3a1bcf421b980923ce88e53a3a8c157f49a862bde2652b12a480bc0e69f8e61f66b","ssdeep":"","tlshash":"3e51320fbc49e97467a519362e7bde8ca8fe1074101ed80694dfd4ac9c24ff6092678c","size":2885,"data":"","first_seen":"2025-10-12T08:21:52.969757Z","last_seen":"2026-09-05T06:16:43.755422Z","times_seen":163,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"199c4182647be5212bfe5c7700df20c2","sha1":"073338832b34653a05ee63be3e5e807146c20baa","sha256":"edb49e5301656eeab9e2d7a5babb509f254d5f84ba8f7a6e3bf4ab014cf8fff4","sha512":"37149d430a9d26ca47e13f17eeb24f4cfbf2745306be2ee502a7575801b29bd24e6cb3761d9ffe8e5f6b48536df9673c0e3fd5a341d615f2cc99d5ac5eacec68","ssdeep":"","tlshash":"bbf097aedc81a1586bc228bd97abda48d0ae0464d00bd807b5dac8cd2c38fcd042238c","size":516,"data":"","first_seen":"2026-01-24T23:36:07.89868Z","last_seen":"2026-09-05T06:16:43.771844Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/js/cslink.js?v=0.42477986199661855","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"c6d2f4639cb1b76c0684fef4132bf463","sha1":"7bb8c3cbe9ca41ed6a0ee81e7c56eca59d1218cf","sha256":"03fe158f890eb13247b28e30355e5642a274a8bc83b0d8a3dc57dbc80d5ea63c","sha512":"2169416646bc3e7a3dd2db629d9d6c33037f9f03e197638d22f01b811261d5fddc87215da291a7c00a7211293070dd6dd770a5efc3e2b64da8786eb8f7147e91","ssdeep":"48:ROps5HjfjIgluViajuBTgjZKjs0v8PippgTy3+lu7h7QmLjkM7lFju8Vp+5i4EAM:ROi7blexi2NKYJzTX2hpjkM7yJJk","tlshash":"93c1689785445c8203b51734afab352de1ff626dde1e894dbe8193e02e31037b909abd","size":5710,"data":"","first_seen":"2026-09-04T11:30:22.823766Z","last_seen":"2026-09-05T06:16:43.754206Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"813","filename":"https://www.zuizhongjs.com/js/ky1.js","line_number":32,"column_number":9}]},"http":[{"url":{"schema":"http","addr":"www.roofquotesnow.com/public/uploads/20260702/57e03d55d2acae460f017a6c34bfc8b2.jpg","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:06.669Z","timestamp":1788588966669,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/uploads/20260702/57e03d55d2acae460f017a6c34bfc8b2.jpg HTTP/1.1\r\nHost: www.roofquotesnow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nCookie: PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:09 GMT\r\nContent-Type: image/jpeg; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nLocation: http://www.hbjtjl.com/public/uploads/20260702/57e03d55d2acae460f017a6c34bfc8b2.jpg\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":2571,"timings":{"blocked":2354,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.roofquotesnow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:10.222Z","timestamp":1788588970222,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /js-sdk-pro.min.js HTTP/1.1\r\nHost: sdk.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.hbjtjl.com/favicon.ico","fqdn":"www.hbjtjl.com","domain":"hbjtjl.com","tld":"com"},"ip":{"addr":"60.205.123.83","port":80,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:12.086Z","timestamp":1788588972086,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.hbjtjl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://www.roofquotesnow.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Sat, 05 Sep 2026 06:16:12 GMT\r\nServer: Apache\r\nUpgrade: h2\r\nConnection: Upgrade, close\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nContent-Security-Policy: default-src 'self' *.lysbyj.com *.baidu.com *.miancp.com *.youku.com; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'\r\nContent-Length: 1822\r\nContent-Type: text/html; charset=utf-8\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/image/wblogo.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.387Z","timestamp":1788588972387,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/image/wblogo.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 8085\r\nLast-Modified: Wed, 15 Jan 2025 12:48:20 GMT\r\nConnection: keep-alive\r\nETag: \"6787ae94-1f95\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8085,"size_decoded":8318,"mime_type":"image/png","magic":"PNG image data, 183 x 50, 8-bit/color RGBA, non-interlaced","md5":"ba4e53b518e93e6e98714c2548233f05","sha1":"003d6c28449cf1a1a929c328cd87a4ef8c4cf660","sha256":"f5ab541d2b50b2cf444e34876cb5e9ec0e6977c90b4672229cf00e82a66812fb","sha512":"c82da480049b25f39fa3e7bde737726e60999bec0ef90c072e0d21c8c6a925b25383a4240eae6f5717102275e424c99fdae99c6f5f1ff624176a0a216814dc61","ssdeep":"192:NpYCRfvmOunO75kKwl0DRg/fjs6OciKT5Qk+P2yzftTz2:NpjdvBuxKG0i/b+KlDHy132","tlshash":"c0f1bfcfa080d8dd1b772cfd1b76f16432e7ec1639894a00f5e1840d93a45c49b4a682","first_seen":"2023-05-05T14:06:31Z","last_seen":"2026-09-05T06:16:43.721748Z","times_seen":1405,"resource_available":false,"data":null}},"time_used":2726,"timings":{"blocked":2497,"dns":0,"connect":0,"send":0,"wait":229,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/font/iconfont.e7187704.woff2","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:13.441Z","timestamp":1788588973441,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/font/iconfont.e7187704.woff2 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:14 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T06:16:43.722434Z","times_seen":1336,"resource_available":false,"data":null}},"time_used":1042,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1042,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/public/uploads/20260702/97d9789bae0c5c56061167e03e66e2cc.png","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:06.670Z","timestamp":1788588966670,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/uploads/20260702/97d9789bae0c5c56061167e03e66e2cc.png HTTP/1.1\r\nHost: www.roofquotesnow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nCookie: PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:09 GMT\r\nContent-Type: image/jpeg; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nLocation: http://www.hbjtjl.com/public/uploads/20260702/97d9789bae0c5c56061167e03e66e2cc.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":2761,"timings":{"blocked":2559,"dns":0,"connect":0,"send":0,"wait":202,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.roofquotesnow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/font/latin.fab57614.woff2","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.797Z","timestamp":1788588972797,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/font/latin.fab57614.woff2 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:13 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T06:16:43.722434Z","times_seen":1336,"resource_available":false,"data":null}},"time_used":637,"timings":{"blocked":364,"dns":0,"connect":0,"send":0,"wait":273,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/font/iconfont.407a95e9.woff2","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:13.527Z","timestamp":1788588973527,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/font/iconfont.407a95e9.woff2 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:13 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T06:16:43.722434Z","times_seen":1336,"resource_available":false,"data":null}},"time_used":281,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":281,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vv.sfgname.top/collect","fqdn":"vv.sfgname.top","domain":"sfgname.top","tld":"top"},"ip":{"addr":"156.245.247.30","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"beacon","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:25.261Z","timestamp":1788588985261,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vv.sfgname.top","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 04 Sep 2026 06:00:24 GMT","end":"Thu, 03 Dec 2026 06:00:23 GMT"},"fingerprint":{"sha1":"43:87:F5:F4:97:3E:94:6C:45:26:8F:F7:C1:47:A3:BF:67:1D:84:BA","sha256":"C8:F9:92:19:37:2C:9E:D5:49:ED:8F:33:D5:99:FE:EB:B4:DF:10:B0:BE:AE:32:14:37:23:AA:E8:F4:B5:E9:E7"}}},"request":{"raw":"POST /collect HTTP/1.1\r\nHost: vv.sfgname.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 479\r\nSec-Fetch-Storage-Access: none\r\nOrigin: http://www.roofquotesnow.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":479,"data":"{\"schema\":3,\"trackingId\":\"sf_ab7c0844226d283b7bb1c8bbebe54e33\",\"kind\":\"heartbeat\",\"eventId\":\"1fed9bcf965c0ea39c3052d1612b0a9b\",\"pageEventId\":\"73f095569e796c7c1a27be24ff2f9905\",\"visitorId\":\"103676365ac04c585ba5122e5bfe6cf4\",\"hostname\":\"www.roofquotesnow.com\",\"url\":\"http://www.roofquotesnow.com/\",\"title\":\"赢博官方网站_赢博（中国）\",\"referrer\":\"\",\"screen\":\"1280x1024\",\"language\":\"en-US\",\"timezone\":\"UTC\",\"automation\":false,\"durationMs\":15018,\"timestamp\":1788588985256}"}},"response":{"raw":"HTTP/2 204 \r\nserver: openresty\r\ndate: Sat, 05 Sep 2026 06:16:25 GMT\r\naccess-control-allow-headers: Content-Type\r\naccess-control-allow-methods: POST, OPTIONS\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-robots-tag: noindex, nofollow, noarchive, nosnippet, noimageindex\r\ncontent-security-policy: default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'\r\nx-frame-options: DENY\r\npermissions-policy: camera=(), geolocation=(), microphone=(), payment=(), usb=()\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/picture/rbsmgwmig0oaqpqmaabq2kzlptk31.webp","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:11.488Z","timestamp":1788588971488,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/picture/rbsmgwmig0oaqpqmaabq2kzlptk31.webp HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/ky.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:12 GMT\r\nContent-Type: image/webp\r\nContent-Length: 40503\r\nLast-Modified: Mon, 25 Dec 2023 15:21:00 GMT\r\nConnection: keep-alive\r\nETag: \"65899ddc-9e37\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40503,"size_decoded":40738,"mime_type":"image/webp","magic":"PNG image data, 206 x 173, 8-bit/color RGBA, non-interlaced","md5":"b6e859bef31336d0a03ad2ed18cd4e31","sha1":"db8b7b1e320d7e115254a646d97ab5780c52e0ae","sha256":"170ec291fd15ea3d6ff4112026d4cda5a52127fbb9afdec2360c067bc69c4047","sha512":"f6fdd16d6544a3d267d355429af12d61d17a45740b9575a9372e4f65b33908baa09be698f83584c11544830a2b5b860e7a46a1bbde718e42facae789a771ca5f","ssdeep":"768:A22vHjG0B15BZjNKTprKdweaFRo5grne0rg3RUCifsX:Ar1XZjNKThlZY5grZs33ifsX","tlshash":"1803f1d2e5605c47d171371e820e2e834c3e4b927bd8de6af95e9df5e2418fb85021a3","first_seen":"2023-05-18T07:54:04Z","last_seen":"2026-09-05T06:16:43.723049Z","times_seen":3535,"resource_available":false,"data":null}},"time_used":1394,"timings":{"blocked":849,"dns":0,"connect":0,"send":0,"wait":268,"receive":277,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/image/ldlogo.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.378Z","timestamp":1788588972378,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/image/ldlogo.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:13 GMT\r\nContent-Type: image/png\r\nContent-Length: 220743\r\nLast-Modified: Thu, 29 Feb 2024 07:27:24 GMT\r\nConnection: keep-alive\r\nETag: \"65e031dc-35e47\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":220743,"size_decoded":220979,"mime_type":"image/png","magic":"PNG image data, 3600 x 2000, 8-bit colormap, non-interlaced","md5":"492093dcf4b1ba9c13b19de1903d974a","sha1":"5e4a03772362bf9c43bc9a5ad75682564f5d0f76","sha256":"009a0d5c28b46ef15643b4f1b90f4af852846bce2b65a443d231d41cd21e24f5","sha512":"a1caaa66263ed8ce703221060978c9f5985ac72533b50127e272ddfc2090dbbaa00ae2f9c460b8937d3fa92397457b2b0dee538cedbf023b2d414d7a9b281c34","ssdeep":"6144:Wx8WwUNUfdl+GUc6QOkWF2zuwJKf3yeEOjEEBF:Wx83U5GUsOkNzuwkf3XEOdBF","tlshash":"d42402b5b322429fc13e5b265ac73df595f58eb106f4e77ac4653a0a033980fce91898","first_seen":"2024-05-09T23:18:45Z","last_seen":"2026-09-05T06:16:43.723657Z","times_seen":3024,"resource_available":false,"data":null}},"time_used":2933,"timings":{"blocked":841,"dns":0,"connect":0,"send":0,"wait":243,"receive":1849,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/image/kaiyunlogo.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.386Z","timestamp":1788588972386,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/image/kaiyunlogo.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 15054\r\nLast-Modified: Wed, 18 Sep 2024 07:04:06 GMT\r\nConnection: keep-alive\r\nETag: \"66ea7b66-3ace\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15054,"size_decoded":15288,"mime_type":"image/png","magic":"PNG image data, 814 x 200, 8-bit colormap, non-interlaced","md5":"5bdb83ec9f353d69c2ebc9c36cef090e","sha1":"e3a542a5b41ab05a8a444c3f106186806d1f025e","sha256":"fc148ba9a62f11da475123e65ced85cb59d9715e2c202655e4322942803bde0e","sha512":"465c1eb28d8641c930c163efdafb203a10dd280eb47d5fdc121459bc243309ee18c8fd5f1162bc39402ee416d6ad4034a83253195d5961633a23620a6dfcc261","ssdeep":"192:JpKA2giu6cjK+61eWj17lwRm+M2HtS7NGO+bgJvlClT+ehacY7qZFimlLKztvuBJ:Xk+6Jx7lwRmCpOPJ4T1oulZwtHa","tlshash":"1e62d1c3420996a3fe3624fc31850bada934fcbe5411f725d621758fc9f4aa34c9191e","first_seen":"2023-09-17T16:12:24Z","last_seen":"2026-09-05T06:16:43.724272Z","times_seen":3610,"resource_available":false,"data":null}},"time_used":2655,"timings":{"blocked":2307,"dns":0,"connect":0,"send":0,"wait":348,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/font/iconfont.e7187704.woff2","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.904Z","timestamp":1788588972904,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/font/iconfont.e7187704.woff2 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:13 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T06:16:43.722434Z","times_seen":1336,"resource_available":false,"data":null}},"time_used":266,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":266,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/font/iconfont.e7187704.ttf","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:13.235Z","timestamp":1788588973235,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/font/iconfont.e7187704.ttf HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:13 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T06:16:43.722434Z","times_seen":1336,"resource_available":false,"data":null}},"time_used":277,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":277,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/public/static/home/js/jquery1.42.min.js","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:06.650Z","timestamp":1788588966650,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/home/js/jquery1.42.min.js HTTP/1.1\r\nHost: www.roofquotesnow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nCookie: PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:06 GMT\r\nContent-Type: text/javascript;charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nLocation: http://www.hbjtjl.com/public/static/home/js/jquery1.42.min.js\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":391,"timings":{"blocked":-1,"dns":0,"connect":185,"send":0,"wait":206,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.roofquotesnow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/public/static/home/image/logo.jpg","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:06.663Z","timestamp":1788588966663,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/home/image/logo.jpg HTTP/1.1\r\nHost: www.roofquotesnow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nCookie: PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:09 GMT\r\nContent-Type: image/jpeg; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nLocation: http://www.hbjtjl.com/public/static/home/image/logo.jpg\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":2775,"timings":{"blocked":2571,"dns":0,"connect":0,"send":0,"wait":204,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.roofquotesnow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.hbjtjl.com/public/uploads/20260430/8cfda14e274ab97fffcfae1c536fb81d.png","fqdn":"www.hbjtjl.com","domain":"hbjtjl.com","tld":"com"},"ip":{"addr":"60.205.123.83","port":80,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:09.246Z","timestamp":1788588969246,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/uploads/20260430/8cfda14e274ab97fffcfae1c536fb81d.png HTTP/1.1\r\nHost: www.hbjtjl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://www.roofquotesnow.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 05 Sep 2026 06:16:09 GMT\r\nServer: Apache\r\nUpgrade: h2\r\nConnection: Upgrade, close\r\nLast-Modified: Thu, 30 Apr 2026 07:10:05 GMT\r\nETag: \"685bd-650a827582cf8\"\r\nAccept-Ranges: bytes\r\nContent-Length: 427453\r\nContent-Security-Policy: default-src 'self' *.lysbyj.com *.baidu.com *.miancp.com *.youku.com; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":427453,"size_decoded":427913,"mime_type":"image/png","magic":"PNG image data, 696 x 447, 8-bit/color RGB, non-interlaced","md5":"5f5fe66ccc78b7d768a129187bce21ac","sha1":"6cb285283809701d8ba5434b60a968b83e3fd7c8","sha256":"d4ce76b9b101bdc711600ac9c45d11a5267b333c90892c4d40ea40f0e14a4d19","sha512":"3e90753bc22b16b146232ca38f8d5ee74cedad72d18c631bdf9a3d32b0f8ad630923d03a8fe664d37f8db65fdec57b3acd774a60bfee7b0246dbd94b1de88659","ssdeep":"6144:CBalWAQ5NBK8U6Otgi/feRKnj3SQfxxMctfE/QQBc10hJRPkPU4Z6UWtxXiTR7yH:mSWAQc8xONmRKnj3OkMFhJRG6UWDy0rX","tlshash":"5c942325f81063b5d0dddc5ba4a9ac38789faa12819756888edfd3b7f4167f10302ed2","first_seen":"2026-09-05T06:16:43.724873Z","last_seen":"2026-09-05T06:16:43.724873Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1572,"timings":{"blocked":0,"dns":0,"connect":224,"send":0,"wait":224,"receive":1124,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/picture/rbsmgwmmnw-ahnf9aabt7ce2zgq87.webp","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:11.491Z","timestamp":1788588971491,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/picture/rbsmgwmmnw-ahnf9aabt7ce2zgq87.webp HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/ky.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:12 GMT\r\nContent-Type: image/webp\r\nContent-Length: 21484\r\nLast-Modified: Mon, 25 Dec 2023 15:21:03 GMT\r\nConnection: keep-alive\r\nETag: \"65899ddf-53ec\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21484,"size_decoded":21719,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ccf323bf4e1c41b61aaa296ea59b8b81","sha1":"83f1f27a2fc6c58c751b5e7fc627015a1991b374","sha256":"c7959283d90c9940056378a35789761735a565490945094cd5b77c6b4bf1cc74","sha512":"e75e1bfd61482f56c07ebaa6591f3bee348cc1badbec88a9cfffe930cc5da68a8ccb80271a324fda8d0563b9ccdd4c966a14e4435caa9b9da3fbe1679a6a6e8d","ssdeep":"384:ioDvU5aozxCzakUC75bUncSMiubtHuyO9+2lm/3t0mn/gK0QqbLDng7v:1o4LaagncSzEtH4+DF0mYZfUv","tlshash":"b1a2e1f798af70b3532a495c93f695ee5b84ab340c8dac43e879986ca3352734831e05","first_seen":"2023-05-18T07:54:03Z","last_seen":"2026-09-05T06:16:43.726533Z","times_seen":3511,"resource_available":false,"data":null}},"time_used":1068,"timings":{"blocked":849,"dns":0,"connect":0,"send":0,"wait":216,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/font/latin.fab57614.woff2","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.415Z","timestamp":1788588972415,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/font/latin.fab57614.woff2 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:12 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T06:16:43.722434Z","times_seen":1336,"resource_available":false,"data":null}},"time_used":357,"timings":{"blocked":139,"dns":0,"connect":0,"send":0,"wait":218,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/font/iconfont.e7187704.ttf","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:14.096Z","timestamp":1788588974096,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/font/iconfont.e7187704.ttf HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:14 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T06:16:43.722434Z","times_seen":1336,"resource_available":false,"data":null}},"time_used":264,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":264,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/public/static/home/image/ad.jpg","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:06.665Z","timestamp":1788588966665,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/home/image/ad.jpg HTTP/1.1\r\nHost: www.roofquotesnow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nCookie: PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:09 GMT\r\nContent-Type: image/jpeg; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nLocation: http://www.hbjtjl.com/public/static/home/image/ad.jpg\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":2744,"timings":{"blocked":2354,"dns":0,"connect":185,"send":0,"wait":205,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.roofquotesnow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.hbjtjl.com/public/static/home/js/jquery1.42.min.js","fqdn":"www.hbjtjl.com","domain":"hbjtjl.com","tld":"com"},"ip":{"addr":"60.205.123.83","port":80,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:07.048Z","timestamp":1788588967048,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/home/js/jquery1.42.min.js HTTP/1.1\r\nHost: www.hbjtjl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://www.roofquotesnow.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 05 Sep 2026 06:16:07 GMT\r\nServer: Apache\r\nUpgrade: h2\r\nConnection: Upgrade, close\r\nLast-Modified: Tue, 30 Jan 2024 09:06:03 GMT\r\nETag: \"155a5-61026125ab4c0-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nContent-Security-Policy: default-src 'self' *.lysbyj.com *.baidu.com *.miancp.com *.youku.com; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'\r\nContent-Length: 30335\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":87461,"size_decoded":30852,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"ed4e85ddc6e188c8490191794776f22e","sha1":"83b9249bbbcd563eef7546291d0407f0e70166ce","sha256":"8f764efbb2cdb303e3019325d811225ead27d656f8b40390de427db1415dc56a","sha512":"d8919c3b49d80e25163e29cd35f8a7f18dfd07880f72bbe3104c91e1fefd68d1d8a59708909ab57215fd2e334aa990084299c368ac57141421a6eca74e080edf","ssdeep":"1536:/KRUXRa8Dgwxcy2jpBNwch96SLk8Ek2BSrBGS1ia/eEk4aV2EXi8SMpQ47GKF:/u1zNwcv9qBy1HOg8SMpQ47GKF","tlshash":"7d83f8df77ca702247ab30b9006f550bf276199d684d4400f259d8e9bc78a4a823bf7e","first_seen":"2023-06-09T23:20:42Z","last_seen":"2026-09-05T06:16:43.727093Z","times_seen":4597,"resource_available":true,"data":null}},"time_used":1058,"timings":{"blocked":0,"dns":121,"connect":229,"send":0,"wait":473,"receive":235,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.zuizhongjs.com/js/ky1.js","fqdn":"www.zuizhongjs.com","domain":"zuizhongjs.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:09.055Z","timestamp":1788588969055,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.zuizhongjs.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:33:01 GMT","end":"Wed, 04 Nov 2026 18:33:00 GMT"},"fingerprint":{"sha1":"46:8D:46:07:63:70:13:16:D5:F8:65:DA:BA:08:9C:FD:D0:87:7B:BF","sha256":"E2:39:1A:F2:C8:91:5E:E3:E9:92:87:1F:4F:A5:A5:1A:AA:79:6C:CD:DB:0D:1F:98:9B:A9:18:65:C7:74:71:CB"}}},"request":{"raw":"GET /js/ky1.js HTTP/1.1\r\nHost: www.zuizhongjs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:10 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Sun, 28 Sep 2025 07:25:51 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"68d8e2ff-6e5\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1765,"size_decoded":1183,"mime_type":"application/javascript","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"994f0c9a304160cbf2beb68093f36751","sha1":"9c8e3bf2883946a0d58a5336330463847c6cab11","sha256":"4011c3afd99ebf1b563b026776ea43a49dfa14a9ec7720201bf4b94d848f0b0c","sha512":"3f08ed48ce733be2a49a94a01c05fb4dc22a13f514fbd2059b201e90ec47fca3e0edb5892f1000686a05ff33925ab241b1010b2da9a9835e801799f3d17b9425","ssdeep":"","tlshash":"723132d4abd27d2d033153346c36da5496ba8831ed079d40785ffd909fa45a80eaacec","first_seen":"2025-09-30T03:00:09.656491Z","last_seen":"2026-09-05T06:16:43.72842Z","times_seen":483,"resource_available":true,"data":null}},"time_used":1147,"timings":{"blocked":-1,"dns":50,"connect":217,"send":0,"wait":218,"receive":0,"ssl":662},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.zuizhongjs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.zuizhongjs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/font/iconfont.e7187704.woff2","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.786Z","timestamp":1788588972786,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/font/iconfont.e7187704.woff2 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:13 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T06:16:43.722434Z","times_seen":1336,"resource_available":false,"data":null}},"time_used":376,"timings":{"blocked":107,"dns":0,"connect":0,"send":0,"wait":269,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/public/static/home/image/icon/certificate.png","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:06.673Z","timestamp":1788588966673,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/home/image/icon/certificate.png HTTP/1.1\r\nHost: www.roofquotesnow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nCookie: PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:09 GMT\r\nContent-Type: image/jpeg; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nLocation: http://www.hbjtjl.com/public/static/home/image/icon/certificate.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":2559,"timings":{"blocked":2354,"dns":0,"connect":0,"send":0,"wait":205,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.roofquotesnow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/public/static/home/image/icon/3.jpg","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:06.674Z","timestamp":1788588966674,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/home/image/icon/3.jpg HTTP/1.1\r\nHost: www.roofquotesnow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nCookie: PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:09 GMT\r\nContent-Type: image/jpeg; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nLocation: http://www.hbjtjl.com/public/static/home/image/icon/3.jpg\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":2587,"timings":{"blocked":2354,"dns":0,"connect":0,"send":0,"wait":233,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.roofquotesnow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.hbjtjl.com/public/static/home/image/icon/1.jpg","fqdn":"www.hbjtjl.com","domain":"hbjtjl.com","tld":"com"},"ip":{"addr":"60.205.123.83","port":80,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:09.449Z","timestamp":1788588969449,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/home/image/icon/1.jpg HTTP/1.1\r\nHost: www.hbjtjl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://www.roofquotesnow.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 05 Sep 2026 06:16:10 GMT\r\nServer: Apache\r\nUpgrade: h2\r\nConnection: Upgrade, close\r\nLast-Modified: Wed, 20 Jul 2022 06:39:39 GMT\r\nETag: \"440d-5e436dd7ee0c0\"\r\nAccept-Ranges: bytes\r\nContent-Length: 17421\r\nContent-Security-Policy: default-src 'self' *.lysbyj.com *.baidu.com *.miancp.com *.youku.com; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'\r\nContent-Type: image/jpeg\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":17421,"size_decoded":17880,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC (Windows), datetime=2022:07:05 11:08:33], baseline, precision 8, 74x74, components 3","md5":"9eec2a6ee19c8b5af3da04f89a6503b4","sha1":"e37d934067fb1488315a92021796dfb24ceb21f3","sha256":"f0cd9a91f93f726ecb4473fd44bcc7a1965ef625774c5dfd3a78e1b70ed7483a","sha512":"4967c9b5648fbcad0385808cae0114dcbf6773e952831a40b1fc83356f838271bdfeeb66c21ecc85845b4fce2bb72349ce866649f1b3c230a87393755fc7ceee","ssdeep":"192:v8WQ4xp28y4lziwtHWQ4xwaknr/34HYNMtKwetbOfMmwXEvZvAf7nVNXl:ve46Pirtr4QnrP4HYNg7Y6ngEvZvAL/V","tlshash":"c3725b29ffa2cd62f5d4623894e5d7d6a3a39e409f632245b89c27057b706c0dd4c383","first_seen":"2026-09-05T06:16:43.72899Z","last_seen":"2026-09-05T06:16:43.72899Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1554,"timings":{"blocked":851,"dns":0,"connect":234,"send":0,"wait":235,"receive":234,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/public/static/plugins/layui/font/iconfont.woff2?v=256","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:10.283Z","timestamp":1788588970283,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/plugins/layui/font/iconfont.woff2?v=256 HTTP/1.1\r\nHost: www.roofquotesnow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/public/static/plugins/layui/css/layui.css\r\nCookie: PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:10 GMT\r\nContent-Type: application/font-woff2\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25964,"size_decoded":26262,"mime_type":"application/font-woff2","magic":"Web Open Font Format (Version 2), TrueType, length 25964, version 1.0","md5":"d8c214c89e33a7bea93d656bd865e869","sha1":"c188dbfc6951b7c305940ac3a279227aeb5617f4","sha256":"bef73f87b8a3972427dcece922ed8f59d1d01c4a3fd572316efa70de9aec9c09","sha512":"0e5897c1b874a714fbab221e97717c5bd8b6c525b539a24eca76391206f931abf5cad2441743c441239ca2830f3fb33c34d207e13ee4d1eb3eeba806763f8405","ssdeep":"768:4kZIXl8feK5HavVh7VQB+l9yDbzKu1eNxECo:4kZIV8fqxQB+l03zdeNq3","tlshash":"fbc2e1c340bb8ab8b077783c6a9e96b9d51134261dde919427cc096043feb49eace701","first_seen":"2023-04-14T13:17:16Z","last_seen":"2026-09-05T06:16:43.730178Z","times_seen":1071,"resource_available":false,"data":null}},"time_used":551,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":365,"receive":186,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.roofquotesnow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/image/htylogo.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.383Z","timestamp":1788588972383,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/image/htylogo.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 9364\r\nLast-Modified: Thu, 03 Sep 2026 08:58:41 GMT\r\nConnection: keep-alive\r\nETag: \"6a9936c1-2494\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9364,"size_decoded":9597,"mime_type":"image/png","magic":"PNG image data, 443 x 200, 8-bit colormap, non-interlaced","md5":"940657198c47298a61944bd9c93f7b29","sha1":"44a26eacc507f7ae6a02879e18b231eb4b110587","sha256":"a49787a14b6e4290a6c785704651e3f36976ebef00aa2c492e970a23983f651d","sha512":"aa7c761fec656ce507c083c952423b80c75f632a4b9a440928416212bb5602c7ee6ec4fed48b85bc40c56ea188c0c4658c152ae11bb2c4779d82d662ec591b6e","ssdeep":"192:eddDxM//qac1TSnMqYKFmttqRanPJJcnpaVlX/rW5ivcSF9+lu/:enxM//qXdNKkttwaBCnpoX/WEcc9+lu/","tlshash":"0912ae5f104ac17c09ec20a356a519c62b7c5ffac60bb2068a9d347e6338cb4e344fda","first_seen":"2024-08-19T20:37:01.61435Z","last_seen":"2026-09-05T06:16:43.730738Z","times_seen":136,"resource_available":false,"data":null}},"time_used":2307,"timings":{"blocked":2002,"dns":0,"connect":0,"send":0,"wait":305,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/font/iconfont.e7187704.woff","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:13.016Z","timestamp":1788588973016,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/font/iconfont.e7187704.woff HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:13 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T06:16:43.722434Z","times_seen":1336,"resource_available":false,"data":null}},"time_used":213,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":213,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/public/static/plugins/layui/css/layui.css","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:06.646Z","timestamp":1788588966646,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/plugins/layui/css/layui.css HTTP/1.1\r\nHost: www.roofquotesnow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nCookie: PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:07 GMT\r\nContent-Type: text/css;charset=gbk\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nSet-Cookie: PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0; path=/\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"sf49hpbn3avo2u30ni3b1jjjt0","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":74482,"size_decoded":14148,"mime_type":"text/css; charset=gbk","magic":"ASCII text, with very long lines (65504)","md5":"c4249598bcedf7c98df74ec181810d7a","sha1":"13cb73020cd05e8cfbd3d616f2dacc761b8255fe","sha256":"6b6257d99e9369f60e7541988291e615e818a6b7ae1ecb93de2893f083429325","sha512":"11f152bfb30657b6d3a445ae67ce0c4aba8b88c17724e67670c8a219e7b04a7fe88122601057827acd0766d513955c8630ca82ba3823f1a0492335922a53c15c","ssdeep":"768:nnEWwcY/8zYbRzyclDj1JpZlwyQaIYKsR3zdVhlu9Tr1BpRBtfKa6G6nr4wdk7np:EWwcY/8oG68weHmavq8","tlshash":"37739632e6012c957a2bd215b1dcbdfda0789512ea634e6df3823b1b87848471077f6b","first_seen":"2026-09-05T06:16:43.731283Z","last_seen":"2026-09-05T06:16:43.731283Z","times_seen":1,"resource_available":false,"data":null}},"time_used":629,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":447,"receive":182,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.roofquotesnow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.hbjtjl.com/public/static/home/image/icon/certificate.png","fqdn":"www.hbjtjl.com","domain":"hbjtjl.com","tld":"com"},"ip":{"addr":"60.205.123.83","port":80,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:09.241Z","timestamp":1788588969241,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/home/image/icon/certificate.png HTTP/1.1\r\nHost: www.hbjtjl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://www.roofquotesnow.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 05 Sep 2026 06:16:09 GMT\r\nServer: Apache\r\nUpgrade: h2\r\nConnection: Upgrade, close\r\nLast-Modified: Wed, 20 Jul 2022 06:40:50 GMT\r\nETag: \"4ab-5e436e1ba4080\"\r\nAccept-Ranges: bytes\r\nContent-Length: 1195\r\nContent-Security-Policy: default-src 'self' *.lysbyj.com *.baidu.com *.miancp.com *.youku.com; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1195,"size_decoded":1651,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced","md5":"9399a46f3dca3dc35a0bc0948fa23495","sha1":"22a8dfe3cb524672b280c66a7408aff1dd08ba46","sha256":"a9114191395921ea316496e600ad7a04baa73572d39ddbb7bfa07f9574f5a669","sha512":"42b71d8f1cc823656ff981d80310839f007ed3844ae0c7ba22666ea8ffe375e09990ded2aef91e7dbe08fb85bb995c18ef787354132d7796afe108ca921fac5a","ssdeep":"","tlshash":"ca210abf74488db79eb129dfd18f44f085979502b8f11606c404cb3510f110d5e09776","first_seen":"2026-09-05T06:16:43.732761Z","last_seen":"2026-09-05T06:16:43.732761Z","times_seen":1,"resource_available":false,"data":null}},"time_used":348,"timings":{"blocked":-1,"dns":0,"connect":174,"send":0,"wait":174,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:10.224Z","timestamp":1788588970224,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /js-sdk-pro.min.js HTTP/1.1\r\nHost: sdk.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vv.sfgname.top/collect","fqdn":"vv.sfgname.top","domain":"sfgname.top","tld":"top"},"ip":{"addr":"156.245.247.30","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"beacon","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:10.257Z","timestamp":1788588970257,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vv.sfgname.top","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 04 Sep 2026 06:00:24 GMT","end":"Thu, 03 Dec 2026 06:00:23 GMT"},"fingerprint":{"sha1":"43:87:F5:F4:97:3E:94:6C:45:26:8F:F7:C1:47:A3:BF:67:1D:84:BA","sha256":"C8:F9:92:19:37:2C:9E:D5:49:ED:8F:33:D5:99:FE:EB:B4:DF:10:B0:BE:AE:32:14:37:23:AA:E8:F4:B5:E9:E7"}}},"request":{"raw":"POST /collect HTTP/1.1\r\nHost: vv.sfgname.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 474\r\nSec-Fetch-Storage-Access: none\r\nOrigin: http://www.roofquotesnow.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":474,"data":"{\"schema\":3,\"trackingId\":\"sf_ab7c0844226d283b7bb1c8bbebe54e33\",\"kind\":\"pageview\",\"eventId\":\"73f095569e796c7c1a27be24ff2f9905\",\"pageEventId\":\"73f095569e796c7c1a27be24ff2f9905\",\"visitorId\":\"103676365ac04c585ba5122e5bfe6cf4\",\"hostname\":\"www.roofquotesnow.com\",\"url\":\"http://www.roofquotesnow.com/\",\"title\":\"赢博官方网站_赢博（中国）\",\"referrer\":\"\",\"screen\":\"1280x1024\",\"language\":\"en-US\",\"timezone\":\"UTC\",\"automation\":false,\"durationMs\":0,\"timestamp\":1788588970256}"}},"response":{"raw":"HTTP/2 204 \r\nserver: openresty\r\ndate: Sat, 05 Sep 2026 06:16:10 GMT\r\naccess-control-allow-headers: Content-Type\r\naccess-control-allow-methods: POST, OPTIONS\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-robots-tag: noindex, nofollow, noarchive, nosnippet, noimageindex\r\ncontent-security-policy: default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'\r\nx-frame-options: DENY\r\npermissions-policy: camera=(), geolocation=(), microphone=(), payment=(), usb=()\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/cslink/cslink.js?v=0.44282210733146177","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.034Z","timestamp":1788588972034,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /cslink/cslink.js?v=0.44282210733146177 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/ky.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:12 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T06:16:43.722434Z","times_seen":1336,"resource_available":false,"data":null}},"time_used":247,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/image/leyulogo.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.381Z","timestamp":1788588972381,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/image/leyulogo.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 5939\r\nLast-Modified: Sun, 01 Jun 2025 06:13:05 GMT\r\nConnection: keep-alive\r\nETag: \"683bef71-1733\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5939,"size_decoded":6172,"mime_type":"image/png","magic":"PNG image data, 250 x 100, 8-bit colormap, non-interlaced","md5":"0766823d7d695ab7be2022a7856ba852","sha1":"8784e00785274e6a63bc8f83461d4786953b6e76","sha256":"a0f09589fdb876045b3ff19713921db68e488d1a853ac7d3872241f9bf624594","sha512":"0ab9505feb5f8a8312f9ae3ebf10a1131b37b5e545e663df68a7f941b597a3ab5c9c14bad11c74b3bd54b5e20347249e673a99e1449db46b6e23c3218d38f764","ssdeep":"96:tWaPv1GR74oIl25kQN0Fw731k8PFwrD2oX6cHuvQoAD7uvsk9wzibJD9msveFW/5:UaPgR77Il25SmRkfrz6cOvQouukJqxmE","tlshash":"42c19fd6184a5a61e142090fd4a8ea0cf8f4f15fe6dc26e4df5c8ad787c3cc85be5184","first_seen":"2024-06-11T19:41:23Z","last_seen":"2026-09-05T06:16:43.733991Z","times_seen":3218,"resource_available":false,"data":null}},"time_used":2637,"timings":{"blocked":1702,"dns":0,"connect":0,"send":0,"wait":935,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.hbjtjl.com/public/static/home/image/icon/3.jpg","fqdn":"www.hbjtjl.com","domain":"hbjtjl.com","tld":"com"},"ip":{"addr":"60.205.123.83","port":80,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:09.267Z","timestamp":1788588969267,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/home/image/icon/3.jpg HTTP/1.1\r\nHost: www.hbjtjl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://www.roofquotesnow.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 05 Sep 2026 06:16:10 GMT\r\nServer: Apache\r\nUpgrade: h2\r\nConnection: Upgrade, close\r\nLast-Modified: Wed, 20 Jul 2022 06:39:39 GMT\r\nETag: \"4199-5e436dd7ee0c0\"\r\nAccept-Ranges: bytes\r\nContent-Length: 16793\r\nContent-Security-Policy: default-src 'self' *.lysbyj.com *.baidu.com *.miancp.com *.youku.com; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'\r\nContent-Type: image/jpeg\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":16793,"size_decoded":17252,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC (Windows), datetime=2022:07:05 11:09:54], baseline, precision 8, 74x74, components 3","md5":"71b36791279eacd9d50c9188f68b0e52","sha1":"aa3a154d2248ce6388d21a512d28a07ca5475857","sha256":"fe9779e99548a00289845b10000af82b37d52fb78b7fd3b44ad19acecc12a5be","sha512":"814d1df3a81463c4382bd8851f00854399fda1e5b79c4f93748a2330418c1c00713b24cba70dc79062999decfcfb12a03212f27329cf294ac4b3180f0bb7b19d","ssdeep":"192:ZFIsMTYn328y4ltit1IsMTYnSaknM/W4HYNMtKwetFJxt3Wo/Jv9UliPWP:ZuPioQnMe4HYNg7YFJz3Wo/b5Pg","tlshash":"5f724c3aeb91de52f4d5523444fac7c2e3639e54a7132189795ca5063fb07c19e4c387","first_seen":"2026-09-05T06:16:43.734547Z","last_seen":"2026-09-05T06:16:43.734547Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1313,"timings":{"blocked":0,"dns":0,"connect":220,"send":0,"wait":872,"receive":220,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.hbjtjl.com/public/static/home/image/info.jpg","fqdn":"www.hbjtjl.com","domain":"hbjtjl.com","tld":"com"},"ip":{"addr":"60.205.123.83","port":80,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:09.430Z","timestamp":1788588969430,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/home/image/info.jpg HTTP/1.1\r\nHost: www.hbjtjl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://www.roofquotesnow.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 05 Sep 2026 06:16:09 GMT\r\nServer: Apache\r\nUpgrade: h2\r\nConnection: Upgrade, close\r\nLast-Modified: Wed, 20 Jul 2022 06:39:39 GMT\r\nETag: \"a228-5e436dd7ee0c0\"\r\nAccept-Ranges: bytes\r\nContent-Length: 41512\r\nContent-Security-Policy: default-src 'self' *.lysbyj.com *.baidu.com *.miancp.com *.youku.com; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'\r\nContent-Type: image/jpeg\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":41512,"size_decoded":41971,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC (Windows), datetime=2022:07:06 15:04:31], baseline, precision 8, 360x120, components 3","md5":"2e672c838022549fec6512cf3eec693a","sha1":"fbaf58d22f497dd47880b098f7bb40509e9ae793","sha256":"30b70c7469262fefdd5770768344fa6136887ce7fa37b5b82c27a2ecacb78faa","sha512":"17d705d8435916b903f27353eaf98363f088f9c85a79e1a4cf2482f0e01fd603745c6e6f378bd6b9c19f3c72bd8c1bf2b17c8da5855150ff11bbe19055100b55","ssdeep":"768:LDt0PDCtkobrYyokvawgFagkUMoqQgugNC85q6iKTszwINeI:lgMkCtywgFauWSgEn6LSn","tlshash":"4e13d09317239c61fbd287394567e782e310de881b6357c2789ebb453fb22929c19707","first_seen":"2026-09-05T06:16:43.735893Z","last_seen":"2026-09-05T06:16:43.735893Z","times_seen":1,"resource_available":false,"data":null}},"time_used":870,"timings":{"blocked":0,"dns":0,"connect":217,"send":0,"wait":218,"receive":435,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.roofquotesnow.com/","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-05T06:16:05.421Z","timestamp":1788588965421,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: www.roofquotesnow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.roofquotesnow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-05T06:16:05.714Z","timestamp":1788588965714,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: www.roofquotesnow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:06 GMT\r\nContent-Type: text/html; charset=gbk\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nSet-Cookie: PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0; path=/\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"sf49hpbn3avo2u30ni3b1jjjt0","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":25176,"size_decoded":5537,"mime_type":"text/html; charset=gbk","magic":"HTML document, Unicode text, UTF-8 text","md5":"55ac619c7e8ca6bf50f0bb8e3a22e96d","sha1":"35cec6b1455dd09d42aac01a8a3b16a5bfd5a300","sha256":"2dbdddff86ec9f9781755d1e9abb646a8cb8b7be5092e554a955cd383acb078f","sha512":"83bdc87f3c3043b23109eb206b8fbf9fb925d5ef11aef4a09c5d2d525b734dcfbc4f3fd7db94e130bbbd74f625740893490c53205d10d2f535cb5f8ddca80b63","ssdeep":"384:DWm/iIf8wz+zFEEbAgOCXbmOKJOULao5EnHOr0uEejeNZ80I9D3393Snce7wC+R+:ymFJWZg4J0c2jtGIwXSebz0NS","tlshash":"e0c2045063ed6d9e0632624e90986b1eecdf7c33e9b24dc2b37f1a1543cab92d809457","first_seen":"2026-09-05T06:16:43.737214Z","last_seen":"2026-09-05T06:16:43.737214Z","times_seen":1,"resource_available":false,"data":null}},"time_used":626,"timings":{"blocked":-1,"dns":49,"connect":185,"send":0,"wait":392,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.roofquotesnow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.hbjtjl.com/public/static/plugins/layui/lay/modules/carousel.js","fqdn":"www.hbjtjl.com","domain":"hbjtjl.com","tld":"com"},"ip":{"addr":"60.205.123.83","port":80,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:10.445Z","timestamp":1788588970445,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/plugins/layui/lay/modules/carousel.js HTTP/1.1\r\nHost: www.hbjtjl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://www.roofquotesnow.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 05 Sep 2026 06:16:10 GMT\r\nServer: Apache\r\nUpgrade: h2\r\nConnection: Upgrade, close\r\nLast-Modified: Mon, 22 Feb 2021 13:22:22 GMT\r\nETag: \"efd-5bbecb1219f80-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nContent-Security-Policy: default-src 'self' *.lysbyj.com *.baidu.com *.miancp.com *.youku.com; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'\r\nContent-Length: 1375\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":3837,"size_decoded":1889,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (3805)","md5":"1bf0471c21f38d673bd24d0b4ce2d737","sha1":"e2b5bda5eaf5d370a680b37ff3e21124a0a70647","sha256":"3100ab3b307ba5cfefff8a94bd17b053b1d0a7ff42feb7b6d9da2e691ab25d5e","sha512":"facf1f1ca3ecbf3183f3dd84c61eba19e731e38dc923ab6025d71644bb4de52aa886b3f4dc0d540045d2c8642e55f60f71d516bbbd5d54379dc31d540993d0bf","ssdeep":"","tlshash":"d38121817b5f386741972453935f4c0896b719ba9b06d054f2a264fa6dfbc88223ef0f","first_seen":"2023-06-18T10:24:20Z","last_seen":"2026-09-05T06:16:43.738465Z","times_seen":5,"resource_available":true,"data":null}},"time_used":473,"timings":{"blocked":102,"dns":0,"connect":185,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/favicon.ico","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:11.873Z","timestamp":1788588971873,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.roofquotesnow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nCookie: PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:12 GMT\r\nContent-Type: image/jpeg; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nLocation: http://www.hbjtjl.com/favicon.ico\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":206,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":206,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.roofquotesnow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/image/ag-66-4.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.374Z","timestamp":1788588972374,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/image/ag-66-4.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:13 GMT\r\nContent-Type: image/png\r\nContent-Length: 189185\r\nLast-Modified: Wed, 18 Sep 2024 07:03:31 GMT\r\nConnection: keep-alive\r\nETag: \"66ea7b43-2e301\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":189185,"size_decoded":189421,"mime_type":"image/png","magic":"PNG image data, 750 x 694, 8-bit colormap, non-interlaced","md5":"93c0060e234caf0bf804261f3cfd574c","sha1":"284959e512593ed4a2d9163b5bb604df7ca860d0","sha256":"3b3517b2a149662c9083c8307dc28e5c514a2f5e726e5ce9ce14ea931fcb304c","sha512":"0e6221c046dbc56c41dbaf7766d58605662ae7abdbf4666491433e9fc5b268f5fda3b8436034f6ba9a899e6316ebb22ab85f1a5fefd6cd301e4bd81d764b15f5","ssdeep":"3072:9djIZfl0x1w6OMDXDpTp8U0IRfFMpfxHI5c7AEtqSCOQhjArSO/G0+W//R5zx:9dUFdMTDpTp84JIpHI5c7z4+QSrzG0+u","tlshash":"8b0423f1f20c558fd9f45270bdecd62734305aa30b7a16b1c4a677c21eba21f4198d9a","first_seen":"2024-09-19T08:05:07Z","last_seen":"2026-09-05T06:16:43.73986Z","times_seen":3144,"resource_available":false,"data":null}},"time_used":1630,"timings":{"blocked":795,"dns":0,"connect":0,"send":0,"wait":276,"receive":559,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/image/sport-item-bg.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.389Z","timestamp":1788588972389,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/image/sport-item-bg.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 12434\r\nLast-Modified: Wed, 18 Sep 2024 07:04:18 GMT\r\nConnection: keep-alive\r\nETag: \"66ea7b72-3092\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12434,"size_decoded":12668,"mime_type":"image/png","magic":"PNG image data, 624 x 400, 2-bit colormap, non-interlaced","md5":"ac76c6c7dd993b8bba750449be70d3ea","sha1":"2c1111bcdfa2b3549c8e440c472b866553a270d8","sha256":"b909239d687e0c2dea7608a984bd4a8ad8fe589ec72079a9305f836971c9667c","sha512":"39a33c45472eb07f3d7bd89c60e91a13ad15d94ab4a965b3ff5bdc836383b7bbb5a1a3e03ffcddd14e600583f1f38adb8066347e14f88c51dcab40a8bf0de6cf","ssdeep":"192:YYjq+N9vUOkM3NQeisvtvRdy1/VsBlArzT89SaSkqxUSriFlKtq9RcIyMMwEGI6V:Y2N9vUPpeDvn8WoX8saqxULlb9gMMwVV","tlshash":"d042c0abffcb072865968497030f71a0ea0915ee98298bcd164c7b7b161c054b16caee","first_seen":"2023-09-17T16:12:24Z","last_seen":"2026-09-05T06:16:43.740456Z","times_seen":4235,"resource_available":false,"data":null}},"time_used":3214,"timings":{"blocked":2637,"dns":0,"connect":0,"send":0,"wait":577,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/font/latin.fab57614.woff2","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.417Z","timestamp":1788588972417,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/font/latin.fab57614.woff2 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:12 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T06:16:43.722434Z","times_seen":1336,"resource_available":false,"data":null}},"time_used":470,"timings":{"blocked":193,"dns":0,"connect":0,"send":0,"wait":277,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/public/static/home/image/info.jpg","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:06.672Z","timestamp":1788588966672,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/home/image/info.jpg HTTP/1.1\r\nHost: www.roofquotesnow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nCookie: PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:09 GMT\r\nContent-Type: image/jpeg; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nLocation: http://www.hbjtjl.com/public/static/home/image/info.jpg\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":2749,"timings":{"blocked":2354,"dns":0,"connect":186,"send":0,"wait":209,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.roofquotesnow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/css/main.css","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:11.485Z","timestamp":1788588971485,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/css/main.css HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/ky.html\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:11 GMT\r\nContent-Type: text/css\r\nLast-Modified: Tue, 31 Mar 2026 16:33:11 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"69cbf747-19ad3\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":105171,"size_decoded":54129,"mime_type":"text/css","magic":"ASCII text, with very long lines (20966)","md5":"6b8750dae27b146925feb84c3c5a0d91","sha1":"cba3935d437f78124b6745f0d575d084dc892c94","sha256":"7e7e7d34ce1d4c86a33885c7feba1ec676a196ba1f6b55cd2d1c5499fce8ecab","sha512":"58dbae270b7dea282736b54aac9059ee0973832e1b4d15f369fea33e56d50e2c0264d40f4f9805f9d0c7c8f146dff91e0f9098f89073c12fc018985bc542afe7","ssdeep":"1536:TZyed1/Pbxez/S0sGvVHlaLE4STizU0X4qrriMnWf9Z1l41u:NVWzPbfaLE38pS71","tlshash":"b5a35c6126f27415b12f89bf72df7b183b3c80434809f9197ef459acef893a541a2b45","first_seen":"2026-03-31T21:52:09.978873Z","last_seen":"2026-09-05T06:16:43.741028Z","times_seen":468,"resource_available":false,"data":null}},"time_used":856,"timings":{"blocked":-1,"dns":0,"connect":262,"send":0,"wait":218,"receive":427,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/image/1.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:11.488Z","timestamp":1788588971488,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/image/1.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/ky.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 375671\r\nLast-Modified: Wed, 18 Sep 2024 07:03:21 GMT\r\nConnection: keep-alive\r\nETag: \"66ea7b39-5bb77\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":375671,"size_decoded":375907,"mime_type":"image/png","magic":"PNG image data, 700 x 480, 8-bit/color RGBA, non-interlaced","md5":"16b85bfb3c5900c9a2ae11265b83c9f3","sha1":"7e3fbaddfd99d9f0da4dec4054aeeb9bce19cea4","sha256":"23f2fee730f4a41090ee7fb54df6cd6535458f25c97a53d2d5297b2076d2256e","sha512":"ddb3943583367df200cfad1c48a0393158b90ea3dea7b31ffef2cef3962cd9b0519e86337d0a48ecc20103d6bd3f6297e951b3e4c312254d2e497988574a613a","ssdeep":"6144:aBgTqju9DrGF8Jbd12thIECEu0VRDAfqTFutvzc7nPx:13Ds8JJwmE5+GIZzcTZ","tlshash":"218423f9521a3ce33b81a63929389da4fc5bf4da33d1ce757a0574ec4e31682b859c08","first_seen":"2024-02-29T22:08:49Z","last_seen":"2026-09-05T06:16:43.741584Z","times_seen":3764,"resource_available":false,"data":null}},"time_used":6232,"timings":{"blocked":3553,"dns":0,"connect":0,"send":0,"wait":395,"receive":2284,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/picture/rbsmgwmigzeaqeisaabdvano3pe24.webp","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:11.490Z","timestamp":1788588971490,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/picture/rbsmgwmigzeaqeisaabdvano3pe24.webp HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/ky.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:15 GMT\r\nContent-Type: image/webp\r\nContent-Length: 44556\r\nLast-Modified: Mon, 25 Dec 2023 15:21:02 GMT\r\nConnection: keep-alive\r\nETag: \"65899dde-ae0c\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":44556,"size_decoded":44791,"mime_type":"image/webp","magic":"PNG image data, 206 x 173, 8-bit/color RGBA, non-interlaced","md5":"6194ced01b173481e68b89111c85d6b1","sha1":"35a559992114129a74eac4d5c165bcd9a6a2e3f1","sha256":"bf9c1ba4745317154616c229e8abf30963b05a905c43e0e38b3d795c714b6074","sha512":"ae946a383c19f2072ead7621a8a058498c8bc04272397c3d5939e2e0b988cb833b04cf3eb5c023884664e163fb0f5ca2a62d24bd998db47a70af4d1d8ca6609b","ssdeep":"768:wbU7XS2F2IS772TDQnsnw4zcI2jWEVXUy2+Ly70uHLvUZtT5miRxH0a5FxsF3:wci2F2IS772TDQsnw4zJ4NFUK5uzUZts","tlshash":"7b1302204fad1c6c223f233446852697a06cbe5c39139df50ac9b4de1e9ac3b81559bf","first_seen":"2023-05-18T07:54:04Z","last_seen":"2026-09-05T06:16:43.742471Z","times_seen":3496,"resource_available":false,"data":null}},"time_used":4948,"timings":{"blocked":3624,"dns":0,"connect":0,"send":0,"wait":852,"receive":472,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/public/uploads/20260430/8cfda14e274ab97fffcfae1c536fb81d.png","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:06.667Z","timestamp":1788588966667,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/uploads/20260430/8cfda14e274ab97fffcfae1c536fb81d.png HTTP/1.1\r\nHost: www.roofquotesnow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nCookie: PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:09 GMT\r\nContent-Type: image/jpeg; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nLocation: http://www.hbjtjl.com/public/uploads/20260430/8cfda14e274ab97fffcfae1c536fb81d.png\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":2565,"timings":{"blocked":2354,"dns":0,"connect":0,"send":0,"wait":211,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.roofquotesnow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/ky.html","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:10.217Z","timestamp":1788588970217,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/ky.html HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:11 GMT\r\nContent-Type: text/html\r\nLast-Modified: Tue, 01 Sep 2026 07:57:45 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a968579-4fec\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":20460,"size_decoded":5413,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1181)","md5":"93e44067a2694c8ce22cf74ae7695a9f","sha1":"78d9cc4a4b60d0b2283de1713c0cee436f7fca4f","sha256":"4d38f2d8e665ef47a6f1644ea535bb4ec7643b597d2f8bd2dde3daed75bf4da8","sha512":"44998d4390fd61cdd566bb0f1c99dccec24509f000f377b15aa521fabf9a9ed9a89acd3ada7752e2822409bea0bc1ae1ca48e34d99a73cb7094ff7bd7a04a6f3","ssdeep":"384:i5eLAa76E6dODCJkBeNtVZ3aojKAxuxMx0xSxh:IA76E6dODCJkgNHZ3aojKMCYgWh","tlshash":"eb922e6644f304771273a0a66b6a678b3fa4ea13c90b8b457bec1be45fc2d52cd0354e","first_seen":"2026-09-04T11:30:22.791313Z","last_seen":"2026-09-05T06:16:43.743042Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1172,"timings":{"blocked":0,"dns":102,"connect":266,"send":0,"wait":266,"receive":0,"ssl":537},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:10.225Z","timestamp":1788588970225,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /js-sdk-pro.min.js HTTP/1.1\r\nHost: sdk.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/public/static/plugins/layui/lay/modules/carousel.js","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:10.237Z","timestamp":1788588970237,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/plugins/layui/lay/modules/carousel.js HTTP/1.1\r\nHost: www.roofquotesnow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nCookie: PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:10 GMT\r\nContent-Type: text/javascript;charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nLocation: http://www.hbjtjl.com/public/static/plugins/layui/lay/modules/carousel.js\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":203,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":203,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.roofquotesnow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/js/jquery.min.js","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:11.480Z","timestamp":1788588971480,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/js/jquery.min.js HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/ky.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:11 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Wed, 18 Sep 2024 07:04:28 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"66ea7b7c-268a4\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":157860,"size_decoded":44977,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"ed5d820aae73fcec34ea7157cfddddfc","sha1":"42febe5a54f6950910af22d5dad70d9f768b1621","sha256":"00b4b7ac4936e9decea689135a6d4a534a03879b8f48dc14530281b08ea09b6d","sha512":"b6391a0fed92f2c5f37817b7bbb06591044ab10285b10de03e15b961fce9b0334f9f0697ce0eed567a7c996304324eff8e1d8e2e723f8802753483c3cd518ff0","ssdeep":"1536:KxZLrMgzv9HXprbJGLz6sUdj4HR64F7omep/11E97fHWhZPMu0X8+2Hzd0elLTfJ:oFj4MOMt11UHUPu2HzdD0xzqXR","tlshash":"b9f31d8a6ae32031a227b07d4f5fd809b535985f1e88fd103e4c52a59f1c83c57baf99","first_seen":"2024-05-10T11:06:42Z","last_seen":"2026-09-05T06:16:43.744089Z","times_seen":3452,"resource_available":true,"data":null}},"time_used":525,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":265,"receive":260,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/image/xingkonglogo.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.384Z","timestamp":1788588972384,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/image/xingkonglogo.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 223768\r\nLast-Modified: Thu, 03 Sep 2026 08:57:01 GMT\r\nConnection: keep-alive\r\nETag: \"6a99365d-36a18\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":223768,"size_decoded":224004,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced","md5":"edd9be4994e7d947ac7a97beed79d344","sha1":"0842ce3ecd6d7ef707f9905070eabcd767d2c186","sha256":"7126721e848b63c0ab1b306c33cf5876cd20f1cce6afd280f20ab5a58b3af2b2","sha512":"933946932099af2518c55b52166b70df4f4bbe25714438c4a8c4e9e1349e55baf582ab794036b89cb3c41835eadeb081efafa44500a1c0b6a422f63f4a21aa97","ssdeep":"3072:sF38TGkMvaq5tdTktJHXbylZ+r94B4E3F5Z9MIjU37NHPiMqB7OGrRA3JrGOMyai:sIcbdIL3biVrg5viMqBZAZqhyaOxR","tlshash":"8624128b1011ff5ae3c47d7513650174ea86e0b5b0920b7aa7bfc67fc86a4bf08956c1","first_seen":"2025-12-19T00:49:12.438961Z","last_seen":"2026-09-05T06:16:43.744654Z","times_seen":21,"resource_available":false,"data":null}},"time_used":4619,"timings":{"blocked":2094,"dns":0,"connect":0,"send":0,"wait":289,"receive":2236,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/font/montserrat-regular.949efd65.ttf","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.413Z","timestamp":1788588972413,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/font/montserrat-regular.949efd65.ttf HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:12 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T06:16:43.722434Z","times_seen":1336,"resource_available":false,"data":null}},"time_used":368,"timings":{"blocked":91,"dns":0,"connect":0,"send":0,"wait":277,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vv.sfgname.top/stats.js?id=sf_ab7c0844226d283b7bb1c8bbebe54e33","fqdn":"vv.sfgname.top","domain":"sfgname.top","tld":"top"},"ip":{"addr":"156.245.247.30","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:06.645Z","timestamp":1788588966645,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vv.sfgname.top","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 04 Sep 2026 06:00:24 GMT","end":"Thu, 03 Dec 2026 06:00:23 GMT"},"fingerprint":{"sha1":"43:87:F5:F4:97:3E:94:6C:45:26:8F:F7:C1:47:A3:BF:67:1D:84:BA","sha256":"C8:F9:92:19:37:2C:9E:D5:49:ED:8F:33:D5:99:FE:EB:B4:DF:10:B0:BE:AE:32:14:37:23:AA:E8:F4:B5:E9:E7"}}},"request":{"raw":"GET /stats.js?id=sf_ab7c0844226d283b7bb1c8bbebe54e33 HTTP/1.1\r\nHost: vv.sfgname.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Sat, 05 Sep 2026 06:16:07 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sat, 08 Aug 2026 21:35:02 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a77a106-e58\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=300, stale-while-revalidate=60\r\ncross-origin-resource-policy: cross-origin\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nx-robots-tag: noindex, nofollow, noarchive\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3672,"size_decoded":1912,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"485663e13df74ceeb6f14bda77207ccb","sha1":"6466760a1163b0f18832ce77cc99d8d307cff756","sha256":"a1c5488a924907f1bf7d5688c8c5a8a8185b6384ce9f70393a3d6bf5a3a99b89","sha512":"d96a1b77498f1e60ca1c7affe3fd07a59aec0c9b86b26a366634b1e54b0c8e7a4b0642561fb53dd86c5df0c7118e7c3eb459ad8d4143468a1effd0bdb179aed6","ssdeep":"","tlshash":"d0710e698ce330b5153b702a4baf91047636e0235586dd05bd8d66402f68b2e57f6ffc","first_seen":"2026-08-10T05:33:11.347821Z","last_seen":"2026-09-05T06:16:43.745545Z","times_seen":19,"resource_available":true,"data":null}},"time_used":1163,"timings":{"blocked":-1,"dns":109,"connect":265,"send":0,"wait":258,"receive":0,"ssl":264},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/public/static/home/image/icon/1.jpg","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:06.672Z","timestamp":1788588966672,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/home/image/icon/1.jpg HTTP/1.1\r\nHost: www.roofquotesnow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nCookie: PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:09 GMT\r\nContent-Type: image/jpeg; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nLocation: http://www.hbjtjl.com/public/static/home/image/icon/1.jpg\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":2769,"timings":{"blocked":2565,"dns":0,"connect":0,"send":0,"wait":204,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.roofquotesnow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.hbjtjl.com/public/static/home/image/logo.jpg","fqdn":"www.hbjtjl.com","domain":"hbjtjl.com","tld":"com"},"ip":{"addr":"60.205.123.83","port":80,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:09.454Z","timestamp":1788588969454,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/home/image/logo.jpg HTTP/1.1\r\nHost: www.hbjtjl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://www.roofquotesnow.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 05 Sep 2026 06:16:10 GMT\r\nServer: Apache\r\nUpgrade: h2\r\nConnection: Upgrade, close\r\nLast-Modified: Wed, 20 Jul 2022 06:39:40 GMT\r\nETag: \"bfaa-5e436dd8e2300\"\r\nAccept-Ranges: bytes\r\nContent-Length: 49066\r\nContent-Security-Policy: default-src 'self' *.lysbyj.com *.baidu.com *.miancp.com *.youku.com; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'\r\nContent-Type: image/jpeg\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":49066,"size_decoded":49525,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC (Windows), datetime=2022:07:05 10:45:00], baseline, precision 8, 750x100, components 3","md5":"6fce766c6b3d07d9c536da65b5203f03","sha1":"b1b5beddac47c6b58b34ed9ff40a24423d75a197","sha256":"a45828f4c453b48a0d0340a38e53e1da6b2e4ea7b50603bc4339904aec772475","sha512":"b0b27e4156970e3e033e1676b6d38dc9debe054d19dff8e5820f78640bc3a6b7ff86b351f064e50c84ce2d27f22ea329a57d2c591bf962fe82c2d3658f3558f0","ssdeep":"768:gJQbP+QKfYyRyHmGotbal9oIJU3HhsVQG5b+3APTSHnpdYtjnSR2ciaSR:YfVeLsCJWBTGdHOHnItjnSRNi9R","tlshash":"0223cf246f148e93fcd6be3b11d4ea96b3736d80922313837d1c6e543fb59804c6969b","first_seen":"2026-09-05T06:16:43.746093Z","last_seen":"2026-09-05T06:16:43.746093Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2000,"timings":{"blocked":1279,"dns":0,"connect":180,"send":0,"wait":180,"receive":360,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/image/ayxlogo.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.380Z","timestamp":1788588972380,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/image/ayxlogo.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:13 GMT\r\nContent-Type: image/png\r\nContent-Length: 4529\r\nLast-Modified: Thu, 03 Sep 2026 08:57:51 GMT\r\nConnection: keep-alive\r\nETag: \"6a99368f-11b1\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4529,"size_decoded":4762,"mime_type":"image/png","magic":"PNG image data, 216 x 86, 8-bit colormap, non-interlaced","md5":"e256973ea8d16108426bb96c7ab000d0","sha1":"141d705413daa1b5ff2839bd34966fc630280261","sha256":"2f3bb5cae805e7494c488c26382b1fad126a21ee7585c46888334f75035ee724","sha512":"5ec60df88754b4fff41fbd59401f1bb5bb5cf6b49647a075fa4e4443365981bb5d532898cdd62cbd3b17883cb154333757a99f58cb60cbd780fe8fb6834fb826","ssdeep":"96:aOkWAfVwL2sk5S+0a2GJo0EklIwU5B00PhdFhIg6U1:aOkVKJk5SBcJooU5G0PhZI01","tlshash":"e9916c0a6eb023f136afd0794098bba827050e28b1db5d765062eda6544eec9a701d37","first_seen":"2024-08-19T13:14:17.540946Z","last_seen":"2026-09-05T06:16:43.747276Z","times_seen":127,"resource_available":false,"data":null}},"time_used":1902,"timings":{"blocked":1047,"dns":0,"connect":0,"send":0,"wait":855,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/image/milanlogo.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.382Z","timestamp":1788588972382,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/image/milanlogo.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 261865\r\nLast-Modified: Thu, 03 Sep 2026 08:54:28 GMT\r\nConnection: keep-alive\r\nETag: \"6a9935c4-3fee9\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":261865,"size_decoded":262101,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced","md5":"653170f130c48a691b70d23562e4c087","sha1":"1c9835581e97e86500c4b07060cec2379c8ce592","sha256":"e57fe10de66383e647ee13491a9361417b4493ee1150c95794eb8972b27f5741","sha512":"e6a4873138540ced22996ef709b8bb8c273d254576c293646d04c42e4f4af2dda214d14817be2fc5212647ac7092cfba4715e4b86e68d278f99589b8adc5e9da","ssdeep":"6144:xVrxb4rxy9UbRsIDaXafcBhoFwBlKwSvdsptcE:nxb4Ny9WG4fPwmE/","tlshash":"1b4412933828dd84f2d5e031ba641fc8ee552b10b43d71c8db9eab50744a8fe5f86e64","first_seen":"2025-12-19T00:49:12.430387Z","last_seen":"2026-09-05T06:16:43.748268Z","times_seen":20,"resource_available":false,"data":null}},"time_used":2809,"timings":{"blocked":1972,"dns":0,"connect":0,"send":0,"wait":281,"receive":556,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/font/montserrat-black.be2a4b98.ttf","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.421Z","timestamp":1788588972421,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/font/montserrat-black.be2a4b98.ttf HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:12 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T06:16:43.722434Z","times_seen":1336,"resource_available":false,"data":null}},"time_used":650,"timings":{"blocked":367,"dns":0,"connect":0,"send":0,"wait":283,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/font/iconfont.e7187704.woff","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:13.814Z","timestamp":1788588973814,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/font/iconfont.e7187704.woff HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:13 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T06:16:43.722434Z","times_seen":1336,"resource_available":false,"data":null}},"time_used":277,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":277,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/public/static/home/css/common.css","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:06.648Z","timestamp":1788588966648,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/home/css/common.css HTTP/1.1\r\nHost: www.roofquotesnow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nCookie: PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:07 GMT\r\nContent-Type: text/css;charset=gbk\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nSet-Cookie: PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0; path=/\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"sf49hpbn3avo2u30ni3b1jjjt0","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":7150,"size_decoded":1729,"mime_type":"text/css; charset=gbk","magic":"Unicode text, UTF-8 text","md5":"eba680e481dea024978d926854739561","sha1":"1a26f91d69448bd33afc42c2f8fd0fe5e4c0c08b","sha256":"de57d02e41101a8e352a1911bdb6ce8461ff08f88cc09d4f1a8fb2ed4162e726","sha512":"388e60bcef59f5c6bd678847b02a7fd2ec2a44e10e8382b3166fba2d95e0e5d84268ddbcba03887b0a35338e88d394674d91ee4ed0fdf3b969fea277721d1f9c","ssdeep":"96:0w+n7BEYB9ZJzWfznINbRytgT/Lompf2uoHiWGssi:MBWfExUtgT/Lom+","tlshash":"ade17d3b7b21244ae62952bffe10ae595b0f9093bf8f0e707ad03d2c81484941973b8d","first_seen":"2026-09-05T06:16:43.749234Z","last_seen":"2026-09-05T06:16:43.749234Z","times_seen":1,"resource_available":false,"data":null}},"time_used":521,"timings":{"blocked":-1,"dns":0,"connect":187,"send":0,"wait":333,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.roofquotesnow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.roofquotesnow.com/public/static/plugins/layui/layui.js","fqdn":"www.roofquotesnow.com","domain":"roofquotesnow.com","tld":"com"},"ip":{"addr":"154.196.125.1","port":80,"asn":142062,"as":"qlhost","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:06.651Z","timestamp":1788588966651,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/plugins/layui/layui.js HTTP/1.1\r\nHost: www.roofquotesnow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nCookie: PHPSESSID=sf49hpbn3avo2u30ni3b1jjjt0\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:07 GMT\r\nContent-Type: text/javascript;charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nLocation: http://www.hbjtjl.com/public/static/plugins/layui/layui.js\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":453,"timings":{"blocked":-1,"dns":0,"connect":221,"send":0,"wait":232,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.roofquotesnow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/picture/sj.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:11.492Z","timestamp":1788588971492,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/picture/sj.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/ky.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 18810\r\nLast-Modified: Wed, 18 Sep 2024 07:08:50 GMT\r\nConnection: keep-alive\r\nETag: \"66ea7c82-497a\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18810,"size_decoded":19044,"mime_type":"image/png","magic":"RIFF (little-endian) data, Web/P image","md5":"cdb0153d8cc3dbec5e43d569a03ab2c4","sha1":"0a7c9c3952a48a331a76089f57db3e1b618b0821","sha256":"11d707bf46d3e44e7057580208377df9b8839b00403b94495d3a9f85db23842c","sha512":"159222b548ccfbacd31fd37e9b52bdde0ff662f6b2f21b06c51a0e97022d7d8200b15ca365fb96b9063c76853ec883ebd3caf571816016639e0f953e7541238a","ssdeep":"384:a/5XGHoNGqbcToc+gL5KqF94ombm0PgVT5nlDGXIgVC28hJSb/:oXGHqPQTj+gF7oPgVTYIgU28ha/","tlshash":"9882e11861446beec0430d68fce676fbcaa059cf3a60d5251eb637237b72260abf9055","first_seen":"2023-09-17T16:12:24Z","last_seen":"2026-09-05T06:16:43.750629Z","times_seen":3693,"resource_available":false,"data":null}},"time_used":1122,"timings":{"blocked":848,"dns":0,"connect":0,"send":0,"wait":274,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/image/background.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.358Z","timestamp":1788588972358,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/image/background.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:13 GMT\r\nContent-Type: image/png\r\nContent-Length: 181983\r\nLast-Modified: Wed, 18 Sep 2024 07:03:42 GMT\r\nConnection: keep-alive\r\nETag: \"66ea7b4e-2c6df\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":181983,"size_decoded":182219,"mime_type":"image/png","magic":"PNG image data, 1920 x 1030, 8-bit colormap, non-interlaced","md5":"05bf65d40291d266c59f26f96e67cc72","sha1":"a82f0c303aa0db6e99b37cd73853d7a6810c3e47","sha256":"1a977499b07e4c440c3b1c4284f83140194739f0308cd5090f5f7157a1cd34f3","sha512":"782b2c8345334a55ab399e0767618b74a2bad35835953181831197ce640e4016c6d829f7b5ec02ef2ebb90c91a4aed08ef611ce0b69396874f6b8fe91528ff8d","ssdeep":"3072:yH+fSTQYIsZeo40OdAbcP5CSxRg5rKI/vSk+sD1WDHMfwNNo4rDR:8+aQY1ZI95CSxK57Sk+vIfwk4rDR","tlshash":"4c0412aa6cb708f3c5844cacb0b4add476ebebac05dc7ccef691089d9953c190e84756","first_seen":"2023-09-17T16:12:24Z","last_seen":"2026-09-05T06:16:43.751239Z","times_seen":3752,"resource_available":false,"data":null}},"time_used":2528,"timings":{"blocked":0,"dns":0,"connect":212,"send":0,"wait":219,"receive":1383,"ssl":714},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.hbjtjl.com/public/uploads/20260702/97d9789bae0c5c56061167e03e66e2cc.png","fqdn":"www.hbjtjl.com","domain":"hbjtjl.com","tld":"com"},"ip":{"addr":"60.205.123.83","port":80,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:09.443Z","timestamp":1788588969443,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/uploads/20260702/97d9789bae0c5c56061167e03e66e2cc.png HTTP/1.1\r\nHost: www.hbjtjl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://www.roofquotesnow.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 05 Sep 2026 06:16:10 GMT\r\nServer: Apache\r\nUpgrade: h2\r\nConnection: Upgrade, close\r\nLast-Modified: Thu, 02 Jul 2026 01:38:31 GMT\r\nETag: \"b3b02-65596dd9c778a\"\r\nAccept-Ranges: bytes\r\nContent-Length: 736002\r\nContent-Security-Policy: default-src 'self' *.lysbyj.com *.baidu.com *.miancp.com *.youku.com; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":736002,"size_decoded":736462,"mime_type":"image/png","magic":"PNG image data, 540 x 340, 8-bit/color RGBA, non-interlaced","md5":"8453fc569b07d8e3ba6ce03a3b636531","sha1":"9d423af5733995b048769a0be5f42708fd9b2c37","sha256":"5f6c76d9233eecb071305fcd789d0204a45c8f473b50f66ebde9695d38725642","sha512":"b32cd568a66ffdf8d310d8ac814a60caf65c567dc0a33c63e81be2d2207b6c8c0fdc06ee9cdeb3bb2b64c0d0200d9a78745af0adc1230ce18b80d42806eae980","ssdeep":"3072:8gBo0XffbVkIDxjUDj/Wy/84jwOtEReRr3nc6OTSxfN0jzYr5V3KtssZWsL1wQZQ:9dVAJ/RVEARzzXxfa3YrnE3hG","tlshash":"def43113bf44ea16d5591e358960cbe55320fc0dab61838b34c6bf6fbdae5c3ae41284","first_seen":"2026-09-05T06:16:43.751794Z","last_seen":"2026-09-05T06:16:43.751794Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3727,"timings":{"blocked":205,"dns":0,"connect":173,"send":0,"wait":747,"receive":2602,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/font/iconfont.599951c1.woff2","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:12.419Z","timestamp":1788588972419,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/font/iconfont.599951c1.woff2 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:12 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T06:16:43.722434Z","times_seen":1336,"resource_available":false,"data":null}},"time_used":571,"timings":{"blocked":357,"dns":0,"connect":0,"send":0,"wait":214,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.hbjtjl.com/public/uploads/20260702/57e03d55d2acae460f017a6c34bfc8b2.jpg","fqdn":"www.hbjtjl.com","domain":"hbjtjl.com","tld":"com"},"ip":{"addr":"60.205.123.83","port":80,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:09.250Z","timestamp":1788588969250,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/uploads/20260702/57e03d55d2acae460f017a6c34bfc8b2.jpg HTTP/1.1\r\nHost: www.hbjtjl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://www.roofquotesnow.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 05 Sep 2026 06:16:10 GMT\r\nServer: Apache\r\nUpgrade: h2\r\nConnection: Upgrade, close\r\nLast-Modified: Thu, 02 Jul 2026 01:44:29 GMT\r\nETag: \"1ae15-65596f2f58319\"\r\nAccept-Ranges: bytes\r\nContent-Length: 110101\r\nContent-Security-Policy: default-src 'self' *.lysbyj.com *.baidu.com *.miancp.com *.youku.com; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'\r\nContent-Type: image/jpeg\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":110101,"size_decoded":110562,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS3 Windows, datetime=2026:07:02 09:44:04], baseline, precision 8, 900x573, components 3","md5":"c5e5849ce72f8ebf6fd6664b3aeae3a1","sha1":"d7cc05ea8fb78090b0e4b855e88695116e9563c3","sha256":"35c8a459ee6c3716f0ba9af0fd97de0a4639413ebe66fb8162736dbd52bf3d56","sha512":"7d2bcd65812f6c4779cafe8c248ea41110e07e63ac733c1e82aa0bc49f5b31f74daec845ce51adbb718ed83210cbf99fb611d289721530c865b23f7106d955a3","ssdeep":"1536:BWTWZBxjAXURI3hdUbI/MdoNQNzIAYJfjDk3w/2s4hpydRBAcub80BWLdi:0S3VQU63MIc0i5CjDk+Spy9+wLs","tlshash":"f3b302353ea48fc4c9d402f5b8aedfca3702bd765a83090bb65e294e3bb9580dd1d940","first_seen":"2026-09-05T06:16:43.752994Z","last_seen":"2026-09-05T06:16:43.752994Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1490,"timings":{"blocked":0,"dns":0,"connect":184,"send":0,"wait":763,"receive":543,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.hbjtjl.com/public/static/home/image/ad.jpg","fqdn":"www.hbjtjl.com","domain":"hbjtjl.com","tld":"com"},"ip":{"addr":"60.205.123.83","port":80,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:09.424Z","timestamp":1788588969424,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/home/image/ad.jpg HTTP/1.1\r\nHost: www.hbjtjl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://www.roofquotesnow.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 05 Sep 2026 06:16:09 GMT\r\nServer: Apache\r\nUpgrade: h2\r\nConnection: Upgrade, close\r\nLast-Modified: Tue, 18 Apr 2023 03:02:02 GMT\r\nETag: \"1c07c-5f9938812de80\"\r\nAccept-Ranges: bytes\r\nContent-Length: 114812\r\nContent-Security-Policy: default-src 'self' *.lysbyj.com *.baidu.com *.miancp.com *.youku.com; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'\r\nContent-Type: image/jpeg\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":114812,"size_decoded":115273,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":1123,"timings":{"blocked":0,"dns":0,"connect":223,"send":0,"wait":223,"receive":677,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/js/cslink.js?v=0.42477986199661855","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:11.482Z","timestamp":1788588971482,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/js/cslink.js?v=0.42477986199661855 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/ky.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:11 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Fri, 04 Sep 2026 09:29:49 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a9a8f8d-164e\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5710,"size_decoded":1641,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"c6d2f4639cb1b76c0684fef4132bf463","sha1":"7bb8c3cbe9ca41ed6a0ee81e7c56eca59d1218cf","sha256":"03fe158f890eb13247b28e30355e5642a274a8bc83b0d8a3dc57dbc80d5ea63c","sha512":"2169416646bc3e7a3dd2db629d9d6c33037f9f03e197638d22f01b811261d5fddc87215da291a7c00a7211293070dd6dd770a5efc3e2b64da8786eb8f7147e91","ssdeep":"48:ROps5HjfjIgluViajuBTgjZKjs0v8PippgTy3+lu7h7QmLjkM7lFju8Vp+5i4EAM:ROi7blexi2NKYJzTX2hpjkM7yJJk","tlshash":"93c1689785445c8203b51734afab352de1ff626dde1e894dbe8193e02e31037b909abd","first_seen":"2026-09-04T11:30:22.823766Z","last_seen":"2026-09-05T06:16:43.754206Z","times_seen":2,"resource_available":true,"data":null}},"time_used":213,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":213,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"aaa.aimarksix.com/redirect.js","fqdn":"aaa.aimarksix.com","domain":"aimarksix.com","tld":"com"},"ip":{"addr":"156.245.247.30","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:06.642Z","timestamp":1788588966642,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"aaa.aimarksix.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 19:21:28 GMT","end":"Fri, 06 Nov 2026 19:21:27 GMT"},"fingerprint":{"sha1":"23:76:69:F6:F3:81:7F:D2:AE:AD:02:63:D8:3C:8A:DB:BF:F6:11:06","sha256":"03:BC:76:3B:1A:35:A7:69:17:75:67:FE:3A:9C:59:2B:A1:FA:CC:EC:A5:91:63:20:E6:90:C5:54:04:3D:05:6B"}}},"request":{"raw":"GET /redirect.js HTTP/1.1\r\nHost: aaa.aimarksix.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Sat, 05 Sep 2026 06:16:07 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 0\r\ncache-control: private, no-store, no-cache, must-revalidate, max-age=0\r\nvary: User-Agent, Sec-CH-UA-Mobile\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nx-robots-tag: noindex, nofollow, noarchive\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":469,"mime_type":"application/javascript; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T07:58:30.445842Z","times_seen":18289230,"resource_available":true,"data":null}},"time_used":1112,"timings":{"blocked":-1,"dns":83,"connect":254,"send":0,"wait":254,"receive":0,"ssl":521},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zuizhongjs.com/js/26/8/8/ky1.js","fqdn":"zuizhongjs.com","domain":"zuizhongjs.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:06.653Z","timestamp":1788588966653,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.zuizhongjs.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:33:01 GMT","end":"Wed, 04 Nov 2026 18:33:00 GMT"},"fingerprint":{"sha1":"46:8D:46:07:63:70:13:16:D5:F8:65:DA:BA:08:9C:FD:D0:87:7B:BF","sha256":"E2:39:1A:F2:C8:91:5E:E3:E9:92:87:1F:4F:A5:A5:1A:AA:79:6C:CD:DB:0D:1F:98:9B:A9:18:65:C7:74:71:CB"}}},"request":{"raw":"GET /js/26/8/8/ky1.js HTTP/1.1\r\nHost: zuizhongjs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.roofquotesnow.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:08 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Sat, 11 Oct 2025 08:31:10 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"68ea15ce-b45\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2885,"size_decoded":1091,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (555)","md5":"60b06036226d0c1b8282d527cbf53c3d","sha1":"6b49a42c039d97210a819a1652e5e0142de8e6a0","sha256":"f2c8bbaacbb69dbf2d10775693a7b7e61b9f88b95f6f7adad3a567f0af3f53dc","sha512":"e5f92f4b360c94ff650d6042cf14c8c1c14bf511cf39ae0c63c888b3fae9a3a1bcf421b980923ce88e53a3a8c157f49a862bde2652b12a480bc0e69f8e61f66b","ssdeep":"","tlshash":"3e51320fbc49e97467a519362e7bde8ca8fe1074101ed80694dfd4ac9c24ff6092678c","first_seen":"2025-10-12T08:21:52.969757Z","last_seen":"2026-09-05T06:16:43.755422Z","times_seen":163,"resource_available":true,"data":null}},"time_used":2375,"timings":{"blocked":-1,"dns":76,"connect":232,"send":0,"wait":227,"receive":0,"ssl":1840},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"zuizhongjs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"zuizhongjs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.hbjtjl.com/public/static/plugins/layui/layui.js","fqdn":"www.hbjtjl.com","domain":"hbjtjl.com","tld":"com"},"ip":{"addr":"60.205.123.83","port":80,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.roofquotesnow.com/","date":"2026-09-05T06:16:07.109Z","timestamp":1788588967109,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /public/static/plugins/layui/layui.js HTTP/1.1\r\nHost: www.hbjtjl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://www.roofquotesnow.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 05 Sep 2026 06:16:07 GMT\r\nServer: Apache\r\nUpgrade: h2\r\nConnection: Upgrade, close\r\nLast-Modified: Mon, 22 Feb 2021 13:22:25 GMT\r\nETag: \"1db0-5bbecb14f6640-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nContent-Security-Policy: default-src 'self' *.lysbyj.com *.baidu.com *.miancp.com *.youku.com; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'\r\nContent-Length: 3183\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":7600,"size_decoded":3698,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (7554)","md5":"4ecf0648fd24314cfa43d647ab0b03dc","sha1":"be7c5c17e379692723b459bf8a6f882b201b3c30","sha256":"7091b5d337c0403b986f28731020cf02f6418a9e86b83f7813f27fde13b8324d","sha512":"3ac55748de389d3ab2873564dedd522dc0600a0851aca0a4648df04527b723f6fa221d5b9fea34567d7d2f83a811be06501569ead13531801aa4a3f9191c90b2","ssdeep":"96:63aT4iKlGXo3xUW1U07aSEf1ERrUn8AIT7il3Ju8uqls/D01b3/JLuVvu2:4aTZXU9b7+N8DKl3g8uqS8z/h4W2","tlshash":"8df19688baf23462437b3065b2af801da67b44ad394c4190d1dad9e53c76cae4377f5c","first_seen":"2023-03-08T01:45:17Z","last_seen":"2026-09-05T06:16:43.758538Z","times_seen":491,"resource_available":true,"data":null}},"time_used":739,"timings":{"blocked":0,"dns":60,"connect":223,"send":0,"wait":456,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun1/static/picture/rbsmgwmigyqad1n-aaa_2muwpem57.webp","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun1/ky.html","date":"2026-09-05T06:16:11.489Z","timestamp":1788588971489,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun1/static/picture/rbsmgwmigyqad1n-aaa_2muwpem57.webp HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun1/ky.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 06:16:14 GMT\r\nContent-Type: image/webp\r\nContent-Length: 16344\r\nLast-Modified: Mon, 25 Dec 2023 15:21:01 GMT\r\nConnection: keep-alive\r\nETag: \"65899ddd-3fd8\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16344,"size_decoded":16579,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"be49e8277eb92cafb253fa49edb79022","sha1":"5cc65c308aa4f315b27936fc4647b37f58efdeae","sha256":"1b8cb8ad18ad2b3e0738be463ac16ec39c2bab4d56afe06cfcc5b0fa59c45391","sha512":"bfcca34c67fd47b4119ba484b0d670d5be6ef1b07d3029ea97330338252045ebec536cf90ca48ec649cd50afc4428f412237137b9d4261214715873eedaf8093","ssdeep":"384:CVlYgoa1xatkPb5WHRKY+z3eppmsOfwH/s6j:IYg575E4Y+Hj4H/s6j","tlshash":"df72cf0b455b902138cd7a9311463a50538fde107f8ab4fd6e63baa551281931fb733e","first_seen":"2023-05-18T07:54:03Z","last_seen":"2026-09-05T06:16:43.759993Z","times_seen":3591,"resource_available":false,"data":null}},"time_used":2898,"timings":{"blocked":849,"dns":0,"connect":303,"send":0,"wait":1130,"receive":0,"ssl":616},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}