{"report_id":"c14f980f-1aa1-4cd2-b3cf-b4801dd003bd","version":0,"status":"done","tags":[],"date":"2026-09-20T12:39:32Z","url":{"schema":"http","addr":"v9191.cc/","fqdn":"v9191.cc","domain":"v9191.cc","tld":"cc"},"ip":{"addr":"103.204.13.160","port":0,"asn":209242,"as":"Cloudflare London, LLC","country":"Singapore","country_code":"SG"},"final":{"url":{"schema":"http","addr":"jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/","fqdn":"jjjx17.hdrm79.bdcdn.gznsrck.cn","domain":"gznsrck.cn","tld":"cn"},"title":"欢迎访问","dom":{"size":14129,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (11820)","md5":"e15c63e0231bdcd8736970e528c2d071","sha1":"66e3efd916c24efe2161da258c82147b28216941","sha256":"7e2029566c0e3a42b3a124dfa24c19558eaaea6fd8b880e76c595ba19b17ae7f","sha512":"5bee2be3bb881ad44fa0207d44a48b5cf77beefe89d8994b8851fd5daba99c6204c0382ed376ba15a5180e20e1a1865ef5aa978e1825d6fed0c1cf2118936b52","ssdeep":"384:ZHGVa7gcisiwitFi9NirTiiihkiWiF5iXETDfmqBE:Ya7gcisiwitFifiPiiihkiWi3iXEWn","tlshash":"4152ae22a54a046712f3ddc8d8b1bf5d31a3e70bc64eda006ebc52654fd7c3178698ba","dom_hash":"domhash5d370e43a8aa76ba8f175d7089fe0180","first_seen":"2026-09-20T12:39:44.512657Z","last_seen":"2026-09-20T12:39:44.512657Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"v9191.cc/","fqdn":"v9191.cc","domain":"v9191.cc","tld":"cc"},"ip":{"addr":"103.204.13.160","port":0,"asn":209242,"as":"Cloudflare London, LLC","country":"Singapore","country_code":"SG"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-25T12:39:32Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"v9191.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"tp.sqxzhv.cn","ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"domain_registered":"2025-12-31","domain_rank":0,"first_seen":"2026-07-14T16:10:04.799031Z","last_seen":"2026-09-05T02:14:10.800015Z","alert_count":0,"request_count":20,"received_data":3454839,"sent_data":10240,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"v9191.cc","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2026-09-17","domain_rank":0,"first_seen":"2026-09-20T12:39:35.589441Z","last_seen":"2026-09-20T12:39:35.589441Z","alert_count":3,"request_count":3,"received_data":1264,"sent_data":1274,"comment":"","tags":null,"fingerprints":null},{"fqdn":"cayr53.hpth91.bdcdn.zjyxqb.cn","ip":{"addr":"219.154.192.116","port":80,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"domain_registered":"2026-05-02","domain_rank":0,"first_seen":"2026-09-20T12:39:35.590546Z","last_seen":"2026-09-20T12:39:35.590546Z","alert_count":0,"request_count":2,"received_data":781,"sent_data":1000,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"23.145.136.185","ip":{"addr":"23.145.136.185","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":2,"received_data":262,"sent_data":659,"comment":"","tags":null,"fingerprints":null},{"fqdn":"forapi.jbbxck.com","ip":{"addr":"43.248.133.130","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":1,"received_data":204,"sent_data":555,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"mid.jbbxck.com","ip":{"addr":"43.248.133.130","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"domain_registered":"2025-03-07","domain_rank":0,"first_seen":"2026-09-20T12:39:35.591561Z","last_seen":"2026-09-20T12:39:35.591561Z","alert_count":0,"request_count":1,"received_data":866,"sent_data":459,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"jjjx17.hdrm79.bdcdn.gznsrck.cn","ip":{"addr":"219.154.192.101","port":80,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"domain_registered":"2025-09-29","domain_rank":0,"first_seen":"2026-09-20T12:39:35.588835Z","last_seen":"2026-09-20T12:39:35.588835Z","alert_count":0,"request_count":14,"received_data":1917979,"sent_data":7253,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"api.tgd32.com","ip":{"addr":"43.248.103.112","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"domain_registered":"2025-03-01","domain_rank":0,"first_seen":"2026-06-23T08:21:25.511121Z","last_seen":"2026-09-16T06:14:18.976578Z","alert_count":0,"request_count":8,"received_data":34306,"sent_data":4752,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"mid.jbbxck.com/js/2.js","fqdn":"mid.jbbxck.com","domain":"jbbxck.com","tld":"com"},"ip":{"addr":"43.248.133.130","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"597355f13035ff05d94565da9ba69afe","sha1":"44910c2338537d89225e50865afb117b9902cbff","sha256":"f0d700ad7cf2d0223d9083155d799ebe62aa7150c083fed085ff479eabc7921f","sha512":"cc9c176a482022531f73ee6054990517b12220af45335fba3ad20eadfa2465d3e1a830ca202dd28607f48be09e69df7befe02c01ec48857e094ab9806aaaae6e","ssdeep":"","tlshash":"f8f0c09a10bf1331d7ab608a4a4b6562303385cf3416ee487a4d43851fde56ec529598","size":552,"data":"","first_seen":"2026-09-20T12:39:44.573029Z","last_seen":"2026-09-20T12:39:44.573029Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"jjjx17.hdrm79.bdcdn.gznsrck.cn/client/assets/index-Bb9T-Y5G.js","fqdn":"jjjx17.hdrm79.bdcdn.gznsrck.cn","domain":"gznsrck.cn","tld":"cn"},"ip":{"addr":"219.154.192.101","port":80,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"e5500261ef14b90c873119199c460788","sha1":"fd55503b3cba3df6346e046afbdaf97784b51f64","sha256":"820b794d655864e011eb20ae2e2122da3fd0d9b25eea8d7b4a815a2410f527dc","sha512":"9549e645f48dc23253d0b9534ff1c2fa3c9d9cb7bc49819258dade013d0d05c2b1fdb26d79d1392f51dc60af6981f06d8f365682e285054558dd2eeabddf5217","ssdeep":"24576:KXlI7SZVY/63Dprq/xwPDbtvDaQ02wBiEFbMA+YsAVvF70pamq5AUoXvnym2X/ZP:KXlI7SZVY/63Dprq/xwPntvDaQ02wBim","tlshash":"04654bd932a5646287d26595503f0207723a7d0a3448c09cfa3efdeb2e69d09a47bf7c","size":1526802,"data":"","first_seen":"2026-08-21T06:15:04.241183Z","last_seen":"2026-09-20T12:39:44.574218Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"map[actor:server1.conn0.watcher16.process9//obj21 class:Object extensible:true frozen:false isError:false ownPropertyLength:3 preview:map[kind:Object ownProperties:map[code:map[configurable:true enumerable:true value:0 writable:true] data:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher16.process9//obj22 class:Object extensible:true frozen:false isError:false ownPropertyLength:1 sealed:false type:object] writable:true] message:map[configurable:true enumerable:true value: writable:true]] ownPropertiesLength:3] sealed:false type:object]","filename":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/assets/index-Bb9T-Y5G.js","line_number":39,"column_number":25327}]},"http":[{"url":{"schema":"http","addr":"jjjx17.hdrm79.bdcdn.gznsrck.cn/app/videos/getVideos","fqdn":"jjjx17.hdrm79.bdcdn.gznsrck.cn","domain":"gznsrck.cn","tld":"cn"},"ip":{"addr":"219.154.192.101","port":80,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.304Z","timestamp":1789907956304,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /app/videos/getVideos HTTP/1.1\r\nHost: jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: text/plain\r\ntoken: f9a3c4da525529ecd4119d9f48052ee3\r\ncode: pzka86\r\nContent-Length: 88\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":88,"data":"/whdUbk1JfSYAluxahp3lNNIAifwSkiroF/7fK78etVQYv5H6e0vrxW1eoVDp+xyqIh+yD+uHM1ktNItO+CLag=="}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Byte-nginx\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 4464\r\nConnection: keep-alive\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Allow-Methods: *\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\nDate: Sun, 20 Sep 2026 12:39:16 GMT\r\nReferrer-Policy: no-referrer\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nVia: cache81.jswxmp,mixed02.haxuchang-cu133\r\nX-Bdcdn-Cache-Status: TCP_MISS,TCP_MISS\r\nX-Request-Id: 943dfd8014b0f8b159b513c69d929be3\r\nX-Request-Ip: 195.64.118.152\r\nX-Response-Cache: miss\r\nX-Response-Cinfo: 195.64.118.152\r\nX-Tt-Trace-Tag: id=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5829,"size_decoded":5137,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"2033e7d4dd340f629d5f782b7b4b026d","sha1":"b07ef84ab5649131e69eb90bf6b10037364d2f39","sha256":"1bfc19c4518ab578b97255377a9b6b6ab7821c957dba12a82be7368b2e0ad72d","sha512":"c8871dd59cd2f55ff34749a2d9cf29d7852c46ce4059325832b1e3632f591974a056057d58610ab38ef34881d080969af8a27912ea6aedb1df0e320d040ed612","ssdeep":"96:uY8teWyL/snTonbpMGV0uOa56ymblAg3q3JBk42iLfAtZddNmw2vb95IQt2cnLmf:d8QjsTonbula5vmBAgeJO422A3cVPR58","tlshash":"49c17d7144e38b9b2319002aef379d73f9d531a16ceaa0536aa4f19049c0e7bb207d65","first_seen":"2026-09-20T12:39:44.516132Z","last_seen":"2026-09-20T12:39:44.516132Z","times_seen":1,"resource_available":true,"data":null}},"time_used":517,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":512,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250222/ovC1zQWR/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.831Z","timestamp":1789907956831,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tp.erlfhc.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:34:08 GMT","end":"Fri, 11 Dec 2026 05:34:07 GMT"},"fingerprint":{"sha1":"D6:A9:75:61:81:9B:D9:C9:D7:B3:29:06:6F:36:61:73:6C:51:C9:7A","sha256":"E0:C6:92:E7:F5:56:CD:8D:6E:8D:05:84:1E:44:FB:B6:41:19:BF:4C:18:1D:1F:8C:09:A1:B3:88:CC:1B:88:49"}}},"request":{"raw":"GET /video/20250222/ovC1zQWR/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: application/pdf\r\ncontent-length: 227408\r\nlast-modified: Sun, 06 Jul 2025 18:27:03 GMT\r\netag: \"686abff7-37850\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":227408,"size_decoded":227740,"mime_type":"application/pdf","magic":"data","md5":"2e3085d732754482feb1a35181d608a3","sha1":"8332bff8b8dd7ad0c1588cd19e6469ba15edc7e2","sha256":"e73f931420df05e89fc0424616cb5444273401d0d7089967bb7fae42e074b3fe","sha512":"4765e747c7bc5228458802f15234afa5e952c86dc8aef9d9e4eb223e161d0bab4263716c6d492c2422b26880e6df2e284eee7e1a455e292ecf94b65376dd56dc","ssdeep":"6144:lnPGedoGQcG61EfqIhpdc72T8T0+sfkYgvE:9PvobfHh/c1TdsSE","tlshash":"072423d9ec5303b5478b34698807b20cf1bab7a528861ac6521dc13e4f9c26791efc3d","first_seen":"2026-09-20T12:39:44.517748Z","last_seen":"2026-09-20T12:39:44.517748Z","times_seen":1,"resource_available":false,"data":null}},"time_used":5077,"timings":{"blocked":-1,"dns":497,"connect":259,"send":0,"wait":619,"receive":2436,"ssl":1265},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250601/rXhTkPo9/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:17.540Z","timestamp":1789907957540,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tp.erlfhc.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:34:08 GMT","end":"Fri, 11 Dec 2026 05:34:07 GMT"},"fingerprint":{"sha1":"D6:A9:75:61:81:9B:D9:C9:D7:B3:29:06:6F:36:61:73:6C:51:C9:7A","sha256":"E0:C6:92:E7:F5:56:CD:8D:6E:8D:05:84:1E:44:FB:B6:41:19:BF:4C:18:1D:1F:8C:09:A1:B3:88:CC:1B:88:49"}}},"request":{"raw":"GET /video/20250601/rXhTkPo9/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: application/pdf\r\ncontent-length: 50320\r\nlast-modified: Sun, 06 Jul 2025 18:37:05 GMT\r\netag: \"686ac251-c490\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":50320,"size_decoded":50650,"mime_type":"application/pdf","magic":"data","md5":"8c4c2db647b2082fd42d8f758eb1c611","sha1":"e3f5e01beb21f7028c4c352404424e70798c5db3","sha256":"5900d3b5278dad911c4036f161b224ca959392f805e0091a079be6c63323f31d","sha512":"54ac01849993b2b982bd1ea5fd21ac9314ed1e1ca8500385e7c57713d4e54ffe1d8027515494209d060c20afa323b41c9df37d8221a4e3d0c3ac3562ce47771f","ssdeep":"768:d2rytNTF/uMo2HC6EW36iYOzuT2GRQRj/QERDnsuI1b3wA9g+iFWZDr3iwVpY:DPpPo2H7EW3ETXR4UAnsoAWFgywc","tlshash":"bf330131a29d9aa6ce2a62b3d6ead540cb23730d5f3f9c038c8145f277e16c1545eadc","first_seen":"2026-09-20T12:39:44.519344Z","last_seen":"2026-09-20T12:39:44.519344Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2477,"timings":{"blocked":584,"dns":0,"connect":0,"send":0,"wait":809,"receive":1084,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v9191.cc/","fqdn":"v9191.cc","domain":"v9191.cc","tld":"cc"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-20T12:39:00.629Z","timestamp":1789907940629,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: v9191.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-20T15:41:53.976884Z","times_seen":18570563,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"v9191.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"v9191.cc/","fqdn":"v9191.cc","domain":"v9191.cc","tld":"cc"},"ip":{"addr":"103.204.13.160","port":80,"asn":209242,"as":"Cloudflare London, LLC","country":"Singapore","country_code":"SG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-20T12:39:01.387Z","timestamp":1789907941387,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: v9191.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nContent-Length: 548\r\nConnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":548,"size_decoded":632,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"73d08ddeb464fad3d834aa44620713cc","sha1":"7d2087a6e9142907da3188f5091a826a9ec54138","sha256":"9a441313e12f0d91285af6ad93cd97cd0b373c87495a1975dc6a6c4421bed14e","sha512":"788ea0dfc5f17e4516d560f1497920878d26548fd3be0bf97e35d7cd21cf4032eb7c017e5d9829304a950cf0df24bbaea468e8e26575755fa5803331f8968f32","ssdeep":"","tlshash":"44f0b4cb9e349a680ed2268dc829a14c043b52ef2414f85b1ca39530d98cbce1e23aa4","first_seen":"2026-09-20T12:39:44.52179Z","last_seen":"2026-09-20T12:39:44.52179Z","times_seen":1,"resource_available":true,"data":null}},"time_used":824,"timings":{"blocked":-1,"dns":308,"connect":258,"send":0,"wait":257,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"v9191.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"jjjx17.hdrm79.bdcdn.gznsrck.cn/app/index/checkToken","fqdn":"jjjx17.hdrm79.bdcdn.gznsrck.cn","domain":"gznsrck.cn","tld":"cn"},"ip":{"addr":"219.154.192.101","port":80,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:14.369Z","timestamp":1789907954369,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /app/index/checkToken HTTP/1.1\r\nHost: jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: text/plain\r\nContent-Length: 88\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":88,"data":"XmEZ5pVsDqT1jrNTt8GL1ZCq+wUmgq1tVd+uXZU/gp4r2+AYPtbN6KvDO878x3Y11h9HwoIt4rc57w/EQSGHLw=="}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Byte-nginx\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 94\r\nConnection: keep-alive\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Allow-Methods: *\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\nDate: Sun, 20 Sep 2026 12:39:14 GMT\r\nReferrer-Policy: no-referrer\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nVia: cache61.sccdmp,mixed01.haxuchang-cu133\r\nX-Bdcdn-Cache-Status: TCP_MISS,TCP_MISS\r\nX-Request-Id: 633445155e818f464ebb10d2b9c3155b\r\nX-Request-Ip: 195.64.118.152\r\nX-Response-Cache: miss\r\nX-Response-Cinfo: 195.64.118.152\r\nX-Tt-Trace-Tag: id=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":78,"size_decoded":765,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"dac55880af307bd518fb4cd058344903","sha1":"00e428d2a8ce72bda5dc1245cd7c1f45cdacc0cd","sha256":"33218f1e571792a19cdce288fee3778a5f93b2a1b54f0eca6064a08a9a903c52","sha512":"e967daa607f5579fe77dc2614e76933ce7d6c917d115f997c036cbf74922167de036782f0bb51ccdd0686f2f633bb772135f17d5ac5c6ad8ab4e147ca7654c33","ssdeep":"","tlshash":"83a012245628083d4203218874cc210a46952005091413014dc62a0045134651107130","first_seen":"2026-09-20T12:39:44.523288Z","last_seen":"2026-09-20T12:39:44.523288Z","times_seen":1,"resource_available":true,"data":null}},"time_used":491,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":491,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.tgd32.com/uploads/20250524/7ff12e0328f38964d66065d67f91d352.png","fqdn":"api.tgd32.com","domain":"tgd32.com","tld":"com"},"ip":{"addr":"43.248.103.112","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.624Z","timestamp":1789907956624,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.tgd32.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 28 Aug 2026 11:37:54 GMT","end":"Thu, 26 Nov 2026 11:37:53 GMT"},"fingerprint":{"sha1":"08:3D:30:14:89:D6:EA:DE:E2:15:75:77:09:AF:E6:43:53:CC:59:4C","sha256":"11:AD:37:D0:C8:25:36:08:F9:3B:39:C2:CB:9F:8E:6C:EF:F3:64:2F:21:BE:CD:22:08:C7:4D:62:1A:3B:A7:6A"}}},"request":{"raw":"GET /uploads/20250524/7ff12e0328f38964d66065d67f91d352.png HTTP/1.1\r\nHost: api.tgd32.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: image/png\r\ncontent-length: 3580\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 24 May 2025 13:36:57 GMT\r\netag: W/\"6831cb79-106b\"\r\nexpires: Wed, 14 Oct 2026 15:58:55 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4203,"size_decoded":3949,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"7ff12e0328f38964d66065d67f91d352","sha1":"66a2903cb2cc1c0aced508b68cd0fd0251d00210","sha256":"5a11ec9789977ba26b90d4c521d9b2a7b3a93b1746e885b5d4ece6f6612be095","sha512":"c2bdabf2754a430ffac69faea3ffe33343083c385fe9e3fa47f21edd8eceb37637e35515d5536f1fde993771f78ad617685dff205592ff4a64a789635d288c04","ssdeep":"96:DS5qknmWozPisacNsSHtm5PzRZz0ei36iJqRlhyXXqbynk5:DSoknyaxS4LDzmBnXEV","tlshash":"97813a197bb5ac41054ee814acdb2593470a41c444d0e5f8fcc5e90bd8702bedd0f697","first_seen":"2026-06-10T20:35:05.635538Z","last_seen":"2026-09-20T12:39:44.524884Z","times_seen":8,"resource_available":false,"data":null}},"time_used":1535,"timings":{"blocked":-1,"dns":375,"connect":460,"send":0,"wait":483,"receive":0,"ssl":217},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"jjjx17.hdrm79.bdcdn.gznsrck.cn/app/videos/getVideos","fqdn":"jjjx17.hdrm79.bdcdn.gznsrck.cn","domain":"gznsrck.cn","tld":"cn"},"ip":{"addr":"219.154.192.101","port":80,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.647Z","timestamp":1789907956647,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /app/videos/getVideos HTTP/1.1\r\nHost: jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: text/plain\r\ntoken: f9a3c4da525529ecd4119d9f48052ee3\r\ncode: pzka86\r\nContent-Length: 88\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":88,"data":"/whdUbk1JfSYAluxahp3lNNIAifwSkiroF/7fK78etVQYv5H6e0vrxW1eoVDp+xyqIh+yD+uHM1ktNItO+CLag=="}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Byte-nginx\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 4451\r\nConnection: keep-alive\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Allow-Methods: *\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\nDate: Sun, 20 Sep 2026 12:39:17 GMT\r\nReferrer-Policy: no-referrer\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nVia: cache79.jswxmp,mixed01.haxuchang-cu133\r\nX-Bdcdn-Cache-Status: TCP_MISS,TCP_MISS\r\nX-Request-Id: af3f46869bc3afccb518b84cdcbfcefd\r\nX-Request-Ip: 195.64.118.152\r\nX-Response-Cache: miss\r\nX-Response-Cinfo: 195.64.118.152\r\nX-Tt-Trace-Tag: id=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5812,"size_decoded":5124,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"98841565a63d1e78bf75a3d7fef221e8","sha1":"7e7086cbab957b4a9ebe0e798a2edaff8e76830e","sha256":"586c118d8bf771e60b35212d48ee0c809f02f6d3457aede13cc93bed97668d8f","sha512":"20e9b2b713b9e475b7c0c43314023ca52957d0213c2604b825e75efc3c733cf68d6ca95d7aefe90747ba3ad8461dabb5d8d7e8218381a60883e21f4dc74d2f06","ssdeep":"96:XK7q6AwvP/n37yDbclb7pW8X9iNL8MfkI9ln0zY5w5KoEyXVfLSIzLMj:PwvP/ODEbFFln6l0Y5y4yhOhj","tlshash":"b4c18eb7db184aca7af25980ffc4f284ee8593415dadb9d5b0f763240dae21b4423d90","first_seen":"2026-09-20T12:39:44.526771Z","last_seen":"2026-09-20T12:39:44.526771Z","times_seen":1,"resource_available":true,"data":null}},"time_used":876,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":875,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250527/fhTiwo8W/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:17.533Z","timestamp":1789907957533,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tp.erlfhc.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:34:08 GMT","end":"Fri, 11 Dec 2026 05:34:07 GMT"},"fingerprint":{"sha1":"D6:A9:75:61:81:9B:D9:C9:D7:B3:29:06:6F:36:61:73:6C:51:C9:7A","sha256":"E0:C6:92:E7:F5:56:CD:8D:6E:8D:05:84:1E:44:FB:B6:41:19:BF:4C:18:1D:1F:8C:09:A1:B3:88:CC:1B:88:49"}}},"request":{"raw":"GET /video/20250527/fhTiwo8W/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: application/pdf\r\ncontent-length: 46800\r\nlast-modified: Sun, 06 Jul 2025 18:35:26 GMT\r\netag: \"686ac1ee-b6d0\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":46800,"size_decoded":47130,"mime_type":"application/pdf","magic":"data","md5":"6fc6694e817656488dbd9463c06139a0","sha1":"be4c809dcefac13198227c94ba3d6ca91f59bcda","sha256":"bc3c3870909ad93a5db20f4ff6d590df9ffc5fbeb45d4c7d993ac5d71a1d5ecb","sha512":"24b36b516883ca83ed17c941ff6fc5990709ab3a5e516f38885cd782f4f915fc05aec72d7c16675bf74d21fa46e90e8be4ea2047c4d10e5d78184d7d16a31b0a","ssdeep":"768:Z4Fb66JmJPKK0haETvSFnEt4n9KYNwFykjdvEVy0lhYa+xOc0eTINUakCddRgM7L:Zcm2hOEt4n9KYSljFwyaYak0E0UazRd/","tlshash":"da23f13764aaa89bb9b7b24f371a576a914e710bb18812a3cc9d5c313eec221171c71d","first_seen":"2026-09-20T12:39:44.528196Z","last_seen":"2026-09-20T12:39:44.528196Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2212,"timings":{"blocked":591,"dns":0,"connect":0,"send":0,"wait":808,"receive":813,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250224/gkwhmsFO/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:17.536Z","timestamp":1789907957536,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tp.erlfhc.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:34:08 GMT","end":"Fri, 11 Dec 2026 05:34:07 GMT"},"fingerprint":{"sha1":"D6:A9:75:61:81:9B:D9:C9:D7:B3:29:06:6F:36:61:73:6C:51:C9:7A","sha256":"E0:C6:92:E7:F5:56:CD:8D:6E:8D:05:84:1E:44:FB:B6:41:19:BF:4C:18:1D:1F:8C:09:A1:B3:88:CC:1B:88:49"}}},"request":{"raw":"GET /video/20250224/gkwhmsFO/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: application/pdf\r\ncontent-length: 53168\r\nlast-modified: Sun, 06 Jul 2025 18:28:02 GMT\r\netag: \"686ac032-cfb0\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":53168,"size_decoded":53498,"mime_type":"application/pdf","magic":"data","md5":"6bcee0c7a83ec4dab5dd86f2543c6cd6","sha1":"9c230f06bde046d1faff4616ee4087e35e1dee37","sha256":"1e2538a37a6bf152fca39656e1fc854b5fd63070d4b05798d7fdee0a63c6b1e4","sha512":"14c0a848088fd5abed28cd07143867a0232f64a3770a784bc45acccddf22c622e6649ccca8324977b47cc0aaddd1ac49f9c24c068fec2a524c626e189b1f3cb5","ssdeep":"1536:feIK2+VQoXHU1jtTWAQu3XAbgE9r6ViS8bj:felU1VWAQuygz0j","tlshash":"4a33029144044cfcbf7e7be23b921b2e0b86affe1671d681b524500d093da524dd36b2","first_seen":"2026-09-20T12:39:44.529518Z","last_seen":"2026-09-20T12:39:44.529518Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2208,"timings":{"blocked":586,"dns":0,"connect":0,"send":0,"wait":808,"receive":814,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"v9191.cc/favicon.ico","fqdn":"v9191.cc","domain":"v9191.cc","tld":"cc"},"ip":{"addr":"103.204.13.160","port":80,"asn":209242,"as":"Cloudflare London, LLC","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://v9191.cc/","date":"2026-09-20T12:39:04.909Z","timestamp":1789907944909,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: v9191.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://v9191.cc/\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nContent-Length: 548\r\nConnection: close\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":548,"size_decoded":632,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"73d08ddeb464fad3d834aa44620713cc","sha1":"7d2087a6e9142907da3188f5091a826a9ec54138","sha256":"9a441313e12f0d91285af6ad93cd97cd0b373c87495a1975dc6a6c4421bed14e","sha512":"788ea0dfc5f17e4516d560f1497920878d26548fd3be0bf97e35d7cd21cf4032eb7c017e5d9829304a950cf0df24bbaea468e8e26575755fa5803331f8968f32","ssdeep":"","tlshash":"44f0b4cb9e349a680ed2268dc829a14c043b52ef2414f85b1ca39530d98cbce1e23aa4","first_seen":"2026-09-20T12:39:44.52179Z","last_seen":"2026-09-20T12:39:44.52179Z","times_seen":1,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"v9191.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","fqdn":"jjjx17.hdrm79.bdcdn.gznsrck.cn","domain":"gznsrck.cn","tld":"cn"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-20T12:39:10.153Z","timestamp":1789907950153,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /client/index.html HTTP/1.1\r\nHost: jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-20T15:41:53.976884Z","times_seen":18570563,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.tgd32.com/uploads/20250524/7bbac55dfd897601974c4ce7ffee08eb.png","fqdn":"api.tgd32.com","domain":"tgd32.com","tld":"com"},"ip":{"addr":"43.248.103.112","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.613Z","timestamp":1789907956613,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.tgd32.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 28 Aug 2026 11:37:54 GMT","end":"Thu, 26 Nov 2026 11:37:53 GMT"},"fingerprint":{"sha1":"08:3D:30:14:89:D6:EA:DE:E2:15:75:77:09:AF:E6:43:53:CC:59:4C","sha256":"11:AD:37:D0:C8:25:36:08:F9:3B:39:C2:CB:9F:8E:6C:EF:F3:64:2F:21:BE:CD:22:08:C7:4D:62:1A:3B:A7:6A"}}},"request":{"raw":"GET /uploads/20250524/7bbac55dfd897601974c4ce7ffee08eb.png HTTP/1.1\r\nHost: api.tgd32.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: image/png\r\ncontent-length: 3639\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 24 May 2025 13:41:16 GMT\r\netag: W/\"6831cc7c-113b\"\r\nexpires: Wed, 14 Oct 2026 15:58:54 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4411,"size_decoded":4008,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"7bbac55dfd897601974c4ce7ffee08eb","sha1":"d80dc8ede1121d73de9ed81812bb24240cacaa64","sha256":"f4c8818f0a58b395fdafb8567314296401cae4a743c62f42328e17ad507d7dce","sha512":"05eaa5891180a27dad42437a243a27c05bfb9a4cce3cb559dc3cab892405198f315c96300f9eca37ded0fdfe2266d5006a8dc4eb70326368afc3671b2661e7a8","ssdeep":"96:DSPknmWI5Ngje2DHwBwHOHtogJYEpxxXmZgx5+ECv/dI2q:DSPknXe2DQBwu3JYyqgWEg/qD","tlshash":"66915c78fc204930555bff44647e7643967b83806b41f4e1bdcb9552ac201bae80dc9b","first_seen":"2026-06-10T20:35:05.637839Z","last_seen":"2026-09-20T12:39:44.531005Z","times_seen":8,"resource_available":false,"data":null}},"time_used":1757,"timings":{"blocked":-1,"dns":386,"connect":474,"send":0,"wait":380,"receive":0,"ssl":517},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.tgd32.com/uploads/20250524/1ed318ff95569b709c4fdbd30c31760c.png","fqdn":"api.tgd32.com","domain":"tgd32.com","tld":"com"},"ip":{"addr":"43.248.103.112","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.631Z","timestamp":1789907956631,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.tgd32.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 28 Aug 2026 11:37:54 GMT","end":"Thu, 26 Nov 2026 11:37:53 GMT"},"fingerprint":{"sha1":"08:3D:30:14:89:D6:EA:DE:E2:15:75:77:09:AF:E6:43:53:CC:59:4C","sha256":"11:AD:37:D0:C8:25:36:08:F9:3B:39:C2:CB:9F:8E:6C:EF:F3:64:2F:21:BE:CD:22:08:C7:4D:62:1A:3B:A7:6A"}}},"request":{"raw":"GET /uploads/20250524/1ed318ff95569b709c4fdbd30c31760c.png HTTP/1.1\r\nHost: api.tgd32.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:19 GMT\r\ncontent-type: image/png\r\ncontent-length: 2917\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 24 May 2025 13:39:26 GMT\r\netag: W/\"6831cc0e-e5f\"\r\nexpires: Wed, 14 Oct 2026 15:58:54 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3679,"size_decoded":3285,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"1ed318ff95569b709c4fdbd30c31760c","sha1":"bd108a542e87e97fed94f012b9fe36aa8e587b9c","sha256":"eede7f09ad53c9a5ffc6fdd03f6058b1caf72eef635a7ec0c1bd3ef42d520a4b","sha512":"0a6667596fb173baf00571df6858e1fd3f9734726b68eddeda59d7751cc0dd57c73fb44d0f4ced0657216134d8fc63171454e840a4d0369c9a91b6656ec0ffc6","ssdeep":"","tlshash":"7d711b39e791ac50829efe4a9deea3136a2ad7c5d6c0e474adc9cc0614701fd84099e6","first_seen":"2026-06-10T20:35:05.640298Z","last_seen":"2026-09-20T12:39:44.532877Z","times_seen":8,"resource_available":false,"data":null}},"time_used":2646,"timings":{"blocked":-1,"dns":368,"connect":184,"send":0,"wait":761,"receive":0,"ssl":1332},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.tgd32.com/uploads/20250524/f76d58ec0d413ba838e1db55ce72613b.png","fqdn":"api.tgd32.com","domain":"tgd32.com","tld":"com"},"ip":{"addr":"43.248.103.112","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.641Z","timestamp":1789907956641,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.tgd32.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 28 Aug 2026 11:37:54 GMT","end":"Thu, 26 Nov 2026 11:37:53 GMT"},"fingerprint":{"sha1":"08:3D:30:14:89:D6:EA:DE:E2:15:75:77:09:AF:E6:43:53:CC:59:4C","sha256":"11:AD:37:D0:C8:25:36:08:F9:3B:39:C2:CB:9F:8E:6C:EF:F3:64:2F:21:BE:CD:22:08:C7:4D:62:1A:3B:A7:6A"}}},"request":{"raw":"GET /uploads/20250524/f76d58ec0d413ba838e1db55ce72613b.png HTTP/1.1\r\nHost: api.tgd32.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: image/png\r\ncontent-length: 2425\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 24 May 2025 13:38:43 GMT\r\netag: W/\"6831cbe3-c96\"\r\nexpires: Wed, 14 Oct 2026 15:58:54 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3222,"size_decoded":2793,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"f76d58ec0d413ba838e1db55ce72613b","sha1":"614556f4ca9bacf1fd608e10328991b9d8a22713","sha256":"d3635eac1aac4ecce2667c110b2a1e44b5d33bc91a29bff6f28c3053ed35f8b5","sha512":"5d95f15f063701c04b5e80dc2988366ebc00dc52e6e91c6e88c4e0d5645c599c691d98ffab03ab02a2cb86f3d3609a271b8f487897e95fbc3cd10662286b441a","ssdeep":"","tlshash":"3661094de6225c61461efa80bcd612561f2b0ec4dfe0a9b5ecccc80358726f9c94ead7","first_seen":"2026-06-10T20:35:05.633574Z","last_seen":"2026-09-20T12:39:44.534345Z","times_seen":8,"resource_available":false,"data":null}},"time_used":1517,"timings":{"blocked":1034,"dns":0,"connect":0,"send":0,"wait":483,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250527/HpAytNTx/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.830Z","timestamp":1789907956830,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tp.erlfhc.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:34:08 GMT","end":"Fri, 11 Dec 2026 05:34:07 GMT"},"fingerprint":{"sha1":"D6:A9:75:61:81:9B:D9:C9:D7:B3:29:06:6F:36:61:73:6C:51:C9:7A","sha256":"E0:C6:92:E7:F5:56:CD:8D:6E:8D:05:84:1E:44:FB:B6:41:19:BF:4C:18:1D:1F:8C:09:A1:B3:88:CC:1B:88:49"}}},"request":{"raw":"GET /video/20250527/HpAytNTx/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:22 GMT\r\ncontent-type: application/pdf\r\ncontent-length: 524480\r\nlast-modified: Sun, 06 Jul 2025 18:35:56 GMT\r\netag: \"686ac20c-800c0\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":524480,"size_decoded":524812,"mime_type":"application/pdf","magic":"data","md5":"5a59e6abbd4c26469b47132ed750604c","sha1":"dcf19823ed85b63e36aa99114537dea289fe541e","sha256":"39fc6c66c102f7be85af37e086669d9093b6ac55ab6c0f99086be4edfa4a88a4","sha512":"a8d782f0baf3810fcc06ccc9a978b1f629c39da494a621016d7515040e63aa3039489c5ebfc003307be72f535799dce54b8d511f95b0ec505151217544faf495","ssdeep":"12288:C2qdJahDwcL3xM8H+HMvQZogHX0jVh7oJJEMQ:id6DdL3d5QhEjVhmEMQ","tlshash":"70b4233c855f006f9b4a1cfb2b67a213b9bd982f5ff598500be8e46755f0412489b48f","first_seen":"2026-09-20T12:39:44.536861Z","last_seen":"2026-09-20T12:39:44.536861Z","times_seen":1,"resource_available":false,"data":null}},"time_used":5813,"timings":{"blocked":-1,"dns":498,"connect":483,"send":0,"wait":1294,"receive":280,"ssl":3257},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250219/eRdqWXSv/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.840Z","timestamp":1789907956840,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tp.erlfhc.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:34:08 GMT","end":"Fri, 11 Dec 2026 05:34:07 GMT"},"fingerprint":{"sha1":"D6:A9:75:61:81:9B:D9:C9:D7:B3:29:06:6F:36:61:73:6C:51:C9:7A","sha256":"E0:C6:92:E7:F5:56:CD:8D:6E:8D:05:84:1E:44:FB:B6:41:19:BF:4C:18:1D:1F:8C:09:A1:B3:88:CC:1B:88:49"}}},"request":{"raw":"GET /video/20250219/eRdqWXSv/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: application/pdf\r\ncontent-length: 127856\r\nlast-modified: Sun, 06 Jul 2025 18:25:58 GMT\r\netag: \"686abfb6-1f370\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":127856,"size_decoded":128188,"mime_type":"application/pdf","magic":"data","md5":"a6e13fdc1cb807f321cb971172357b29","sha1":"75aeef4212d1081fcd72c6d58948b2987775d128","sha256":"19836af538bf3373f9bbacc52a1ab17a478505aaee1deccdf023523fd0e20b4c","sha512":"170a14c15f9ebfb758a041f30bdfce17d31a4c8b9b742028170a9cdcbcdad758d92c04934ce0ba1a49b4bccd91d6bd5366ac8463111926ba813711c3d439dbbb","ssdeep":"1536:oaX43BNbZ0GMjp7KYoGqolvpVrVjxHxiLCJwg0YN+Rirg28x5vwFRvtDwzzcqQIj:To3BNi5MYoGxvbhjbCAwgXc7vIYI4j","tlshash":"e4c31213c09721b7d98d652a2f6b1bf1bb4b0f9860e08d49ad0b51e67e4fdcf048d606","first_seen":"2026-09-20T12:39:44.539226Z","last_seen":"2026-09-20T12:39:44.539226Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3178,"timings":{"blocked":1282,"dns":0,"connect":0,"send":0,"wait":808,"receive":1088,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"cayr53.hpth91.bdcdn.zjyxqb.cn/zz/pzka86?FrJh","fqdn":"cayr53.hpth91.bdcdn.zjyxqb.cn","domain":"zjyxqb.cn","tld":"cn"},"ip":{"addr":"219.154.192.116","port":80,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-20T12:39:09.063Z","timestamp":1789907949063,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /zz/pzka86?FrJh HTTP/1.1\r\nHost: cayr53.hpth91.bdcdn.zjyxqb.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://v9191.cc/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: Byte-nginx\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Allow-Methods: *\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-cache,must-revalidate\r\nDate: Sun, 20 Sep 2026 12:39:09 GMT\r\nLocation: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D\r\nReferrer-Policy: no-referrer\r\nStrict-Transport-Security: max-age=31536000\r\nVia: cache79.jswxmp,mixed02.haxuchang-cu133\r\nX-Bdcdn-Cache-Status: TCP_MISS,TCP_MISS\r\nX-Request-Id: 4babfc21627fcbfb712bea209c5dfbe0\r\nX-Request-Ip: 195.64.118.152\r\nX-Response-Cache: miss\r\nX-Response-Cinfo: 195.64.118.152\r\nX-Tt-Trace-Tag: id=5\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-20T15:41:53.976884Z","times_seen":18570563,"resource_available":true,"data":null}},"time_used":1082,"timings":{"blocked":-1,"dns":325,"connect":257,"send":0,"wait":500,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"jjjx17.hdrm79.bdcdn.gznsrck.cn/app/index/getAllConfig","fqdn":"jjjx17.hdrm79.bdcdn.gznsrck.cn","domain":"gznsrck.cn","tld":"cn"},"ip":{"addr":"219.154.192.101","port":80,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:15.400Z","timestamp":1789907955400,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /app/index/getAllConfig HTTP/1.1\r\nHost: jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: text/plain\r\ntoken: f9a3c4da525529ecd4119d9f48052ee3\r\ncode: pzka86\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Byte-nginx\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 2531\r\nConnection: keep-alive\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Allow-Methods: *\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\nDate: Sun, 20 Sep 2026 12:39:16 GMT\r\nReferrer-Policy: no-referrer\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nVia: cache78.jswxmp,mixed01.haxuchang-cu133\r\nX-Bdcdn-Cache-Status: TCP_MISS,TCP_MISS\r\nX-Request-Id: 69def2a59f911c477b10b6fe79e699f5\r\nX-Request-Ip: 195.64.118.152\r\nX-Response-Cache: miss\r\nX-Response-Cinfo: 195.64.118.152\r\nX-Tt-Trace-Tag: id=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3270,"size_decoded":3204,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"148fe86690d5bce7f283fd2246bd78bf","sha1":"b7a3bb747b1934eec29d2f9790e71fe37806535b","sha256":"f0f362bf290362fcd0e4bf797d95e1623311d3ce1afeaafb173f1c2a2e4626ba","sha512":"0544007d882df7c5370a773a927b03ddd6f3497a8755966a1a09e52e0f2f828189d3b29dc374430dbcb8e6b4da5c62bb545299b8243b01e79f2a622af1a50379","ssdeep":"","tlshash":"f6616d14aa19cf23351b29cd3937cbf15df2219b694c20d4ae8a50b5001f677de5431f","first_seen":"2026-09-20T12:39:44.540754Z","last_seen":"2026-09-20T12:39:44.540754Z","times_seen":1,"resource_available":true,"data":null}},"time_used":812,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":812,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"jjjx17.hdrm79.bdcdn.gznsrck.cn/app/videos/getConfig","fqdn":"jjjx17.hdrm79.bdcdn.gznsrck.cn","domain":"gznsrck.cn","tld":"cn"},"ip":{"addr":"219.154.192.101","port":80,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:15.404Z","timestamp":1789907955404,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /app/videos/getConfig HTTP/1.1\r\nHost: jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: text/plain\r\ntoken: f9a3c4da525529ecd4119d9f48052ee3\r\ncode: pzka86\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Byte-nginx\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 214\r\nConnection: keep-alive\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Allow-Methods: *\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\nDate: Sun, 20 Sep 2026 12:39:16 GMT\r\nReferrer-Policy: no-referrer\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nVia: cache79.jswxmp,mixed02.haxuchang-cu133\r\nX-Bdcdn-Cache-Status: TCP_MISS,TCP_MISS\r\nX-Request-Id: dd5a530d4f35ab9b898bf65a27ac656f\r\nX-Request-Ip: 195.64.118.152\r\nX-Response-Cache: miss\r\nX-Response-Cinfo: 195.64.118.152\r\nX-Tt-Trace-Tag: id=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":210,"size_decoded":886,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"f3697a33b8d7132cc75fc65922b39912","sha1":"1abe70daabb31cbe98cd1ff649dcd3a8eb571374","sha256":"4aa83d72eb0ef99bc5dfc03ee785e13c300b862f19a7dc0d6bda6551e380dd6a","sha512":"7485f8a6f12a42103412e4155fc0d23c622ec38131fe681a31c2205134570d5cffc9f12fa5671c124863c581e748eb5020649ecadfb80dea932e344c8e397246","ssdeep":"","tlshash":"57d02315631744073b67c1481c4b5554d7a47cdbabe82741c8c87430b5b0c352141530","first_seen":"2026-09-20T12:39:44.54187Z","last_seen":"2026-09-20T12:39:44.54187Z","times_seen":1,"resource_available":true,"data":null}},"time_used":795,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":795,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.tgd32.com/uploads/20250524/d6a98e666f91309634d29896b8b7cc5d.png","fqdn":"api.tgd32.com","domain":"tgd32.com","tld":"com"},"ip":{"addr":"43.248.103.112","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.610Z","timestamp":1789907956610,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.tgd32.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 28 Aug 2026 11:37:54 GMT","end":"Thu, 26 Nov 2026 11:37:53 GMT"},"fingerprint":{"sha1":"08:3D:30:14:89:D6:EA:DE:E2:15:75:77:09:AF:E6:43:53:CC:59:4C","sha256":"11:AD:37:D0:C8:25:36:08:F9:3B:39:C2:CB:9F:8E:6C:EF:F3:64:2F:21:BE:CD:22:08:C7:4D:62:1A:3B:A7:6A"}}},"request":{"raw":"GET /uploads/20250524/d6a98e666f91309634d29896b8b7cc5d.png HTTP/1.1\r\nHost: api.tgd32.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: image/png\r\ncontent-length: 2922\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 24 May 2025 13:37:28 GMT\r\netag: W/\"6831cb98-dd6\"\r\nexpires: Wed, 14 Oct 2026 15:58:54 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3542,"size_decoded":3290,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"d6a98e666f91309634d29896b8b7cc5d","sha1":"6d1d6259711c8c8860dd79b2a272a7caf18eb2f6","sha256":"6697a980e0b2dc49608d4ead339f86c7d82f7f46573b50e2700a5f8f137d3bd9","sha512":"ccb1d3cf503c5f73903d9ab91e044da23c450160e7fa8326b43b0acb5c808927b5f12340e3fefe2ab6a118af7e32caf01ae7c9631b0ff1a2187d74db9e6a6639","ssdeep":"","tlshash":"22710a8ee4714c114499e4407dea6297493b0bc8d2d0a8d5fddac813a2b01fecd0e5a7","first_seen":"2026-06-10T20:35:05.644442Z","last_seen":"2026-09-20T12:39:44.54338Z","times_seen":8,"resource_available":false,"data":null}},"time_used":1758,"timings":{"blocked":-1,"dns":388,"connect":228,"send":0,"wait":613,"receive":0,"ssl":528},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.tgd32.com/uploads/20250524/dc227e67670b3b68156a300f7f113073.png","fqdn":"api.tgd32.com","domain":"tgd32.com","tld":"com"},"ip":{"addr":"43.248.103.112","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.633Z","timestamp":1789907956633,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.tgd32.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 28 Aug 2026 11:37:54 GMT","end":"Thu, 26 Nov 2026 11:37:53 GMT"},"fingerprint":{"sha1":"08:3D:30:14:89:D6:EA:DE:E2:15:75:77:09:AF:E6:43:53:CC:59:4C","sha256":"11:AD:37:D0:C8:25:36:08:F9:3B:39:C2:CB:9F:8E:6C:EF:F3:64:2F:21:BE:CD:22:08:C7:4D:62:1A:3B:A7:6A"}}},"request":{"raw":"GET /uploads/20250524/dc227e67670b3b68156a300f7f113073.png HTTP/1.1\r\nHost: api.tgd32.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: image/png\r\ncontent-length: 3577\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 24 May 2025 13:42:44 GMT\r\netag: W/\"6831ccd4-1122\"\r\nexpires: Wed, 14 Oct 2026 15:58:55 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4386,"size_decoded":3946,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"dc227e67670b3b68156a300f7f113073","sha1":"4ed0a92488a5b1187cb8af268fde224c7788c644","sha256":"e8346d47985ecff1929b704e29d9a76b93013fd2869a19f42cfe4609b31a5cdd","sha512":"018aa12c0dd7ecb14ad6cdfae18c02b68630b6fbc34a0b1c03f7bbdeb1632db38988d391ebf52baca1925dbbd001a055dcfcf26024d03458066914646cb95f67","ssdeep":"96:DSQknmWp7Ku98HaI+HXHtbvfU6XEqd9NcIxhYLmlt8WJt1FBk:DSQkn6r6x3hnUwZ1I9WJt1I","tlshash":"08911a0fee271834a64dee16b8e91143467797c0c552a0d4bdc6c8625c716b9cdcd7cb","first_seen":"2026-06-10T20:35:05.639204Z","last_seen":"2026-09-20T12:39:44.544443Z","times_seen":8,"resource_available":false,"data":null}},"time_used":1736,"timings":{"blocked":-1,"dns":366,"connect":224,"send":0,"wait":470,"receive":0,"ssl":676},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.tgd32.com/uploads/20250524/055fa77af0fbd51227549125ee3e7ab5.png","fqdn":"api.tgd32.com","domain":"tgd32.com","tld":"com"},"ip":{"addr":"43.248.103.112","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.638Z","timestamp":1789907956638,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.tgd32.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 28 Aug 2026 11:37:54 GMT","end":"Thu, 26 Nov 2026 11:37:53 GMT"},"fingerprint":{"sha1":"08:3D:30:14:89:D6:EA:DE:E2:15:75:77:09:AF:E6:43:53:CC:59:4C","sha256":"11:AD:37:D0:C8:25:36:08:F9:3B:39:C2:CB:9F:8E:6C:EF:F3:64:2F:21:BE:CD:22:08:C7:4D:62:1A:3B:A7:6A"}}},"request":{"raw":"GET /uploads/20250524/055fa77af0fbd51227549125ee3e7ab5.png HTTP/1.1\r\nHost: api.tgd32.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: image/png\r\ncontent-length: 3753\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 24 May 2025 13:33:03 GMT\r\netag: W/\"6831ca8f-112b\"\r\nexpires: Wed, 14 Oct 2026 15:58:57 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4395,"size_decoded":4122,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"055fa77af0fbd51227549125ee3e7ab5","sha1":"83790b55a0eb66a6cec1de6b917b8fd0e4224e16","sha256":"b1582cc2d36b51782d45969107a44a6dd186864b1988914ac6edb1f90552f456","sha512":"4b7460a79d944dcd6520711478cdb6b544d8c3edbf2bc6f55f493f3c89c9aef6a4cb1bf7b7126a49e56ec86d72fbde43fdb0587c2840a206761239f90f4e16d3","ssdeep":"96:DS5qknmWAiQ5Ht43HAXLc2ozyvvn51e7XMok5G0POaGT9:DSokna63JQ51Ojga9","tlshash":"f4915c4cea8318668bdfdd826aad155f1a674884d340e0bcfcd98c93e0740f6840a4ee","first_seen":"2026-06-10T20:35:05.628932Z","last_seen":"2026-09-20T12:39:44.545782Z","times_seen":8,"resource_available":false,"data":null}},"time_used":1731,"timings":{"blocked":-1,"dns":361,"connect":213,"send":0,"wait":298,"receive":0,"ssl":859},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250527/bvv8Hqqt/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.841Z","timestamp":1789907956841,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tp.erlfhc.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:34:08 GMT","end":"Fri, 11 Dec 2026 05:34:07 GMT"},"fingerprint":{"sha1":"D6:A9:75:61:81:9B:D9:C9:D7:B3:29:06:6F:36:61:73:6C:51:C9:7A","sha256":"E0:C6:92:E7:F5:56:CD:8D:6E:8D:05:84:1E:44:FB:B6:41:19:BF:4C:18:1D:1F:8C:09:A1:B3:88:CC:1B:88:49"}}},"request":{"raw":"GET /video/20250527/bvv8Hqqt/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: application/pdf\r\ncontent-length: 311984\r\nlast-modified: Sun, 06 Jul 2025 18:34:53 GMT\r\netag: \"686ac1cd-4c2b0\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":311984,"size_decoded":312316,"mime_type":"application/pdf","magic":"data","md5":"5b102d731e19c2b3da9ae8e2ed0c9be1","sha1":"9eef9d59c0123992e622dd884e486bdc6d4b3d0f","sha256":"1fd4d8993ad9ce6b651b28101825a98f1e76327719dd4681f5f9b80a7ac73fb4","sha512":"591a0e037ce4c72883a0619d21f8a56df30227219cc99f589f74fb01df12308d0625a1a11242e57ffd14ae909c7b6cf74d4fa8e1979414e17b7f7e0bbd755b08","ssdeep":"6144:VMcRSYqVtw8KXxpUUotp7FyciCJE3tga++JGRZe77PuxJLjKYr4nNV:VM4bqVsXxpUUotpQ3a+c/jEnf","tlshash":"7c64237355bca5e89e32c4e2d9da69535964df2cebff581023d8a8948a3f53139330b0","first_seen":"2026-09-20T12:39:44.547136Z","last_seen":"2026-09-20T12:39:44.547136Z","times_seen":1,"resource_available":false,"data":null}},"time_used":5066,"timings":{"blocked":1282,"dns":0,"connect":0,"send":0,"wait":808,"receive":2976,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250528/ZqUMSuNp/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.842Z","timestamp":1789907956842,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tp.erlfhc.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:34:08 GMT","end":"Fri, 11 Dec 2026 05:34:07 GMT"},"fingerprint":{"sha1":"D6:A9:75:61:81:9B:D9:C9:D7:B3:29:06:6F:36:61:73:6C:51:C9:7A","sha256":"E0:C6:92:E7:F5:56:CD:8D:6E:8D:05:84:1E:44:FB:B6:41:19:BF:4C:18:1D:1F:8C:09:A1:B3:88:CC:1B:88:49"}}},"request":{"raw":"GET /video/20250528/ZqUMSuNp/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: application/pdf\r\ncontent-length: 164400\r\nlast-modified: Sun, 06 Jul 2025 18:36:03 GMT\r\netag: \"686ac213-28230\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":164400,"size_decoded":164732,"mime_type":"application/pdf","magic":"data","md5":"06b68f7c7de7ee1d4649b3d80d684a23","sha1":"024acb174938be43f619b76c747f5a093aff9b22","sha256":"d1c4fd4be6a68f061ba1612e4e702051420e1249336bc598b76834819b169872","sha512":"8004a131d9e9ac63eb72f1eb3a436f0b582976d86d2d85ea8f167316a5636037925a17196860291ed8003a370b65f190e07489fce92e8f0ef03212b60cf6d535","ssdeep":"3072:Cb/4OmpYmzyi3WyYsmpJzL/np6zROClaOy3bQl1sRy5k7HnKCwnSq2bh6yD:o/JmamzvBm5/p6zslOy3bQYRUk7HngST","tlshash":"4df3124a926b8d05a4b364141e86dd5b36105e3990717a4b831ba236f70a38bb1cb3ff","first_seen":"2026-09-20T12:39:44.548476Z","last_seen":"2026-09-20T12:39:44.548476Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3727,"timings":{"blocked":1282,"dns":0,"connect":0,"send":0,"wait":808,"receive":1637,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"jjjx17.hdrm79.bdcdn.gznsrck.cn/client/assets/index-DhPicj5T.css","fqdn":"jjjx17.hdrm79.bdcdn.gznsrck.cn","domain":"gznsrck.cn","tld":"cn"},"ip":{"addr":"219.154.192.101","port":80,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:12.866Z","timestamp":1789907952866,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /client/assets/index-DhPicj5T.css HTTP/1.1\r\nHost: jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Byte-nginx\r\nContent-Type: text/css\r\nContent-Length: 110417\r\nConnection: keep-alive\r\nAge: 30243\r\nCache-Control: max-age=43200\r\nContent-Encoding: gzip\r\nEtag: W/\"6a85a090-4709a\"\r\nExpires: Sun, 20 Sep 2026 10:57:10 GMT\r\nLast-Modified: Wed, 19 Aug 2026 12:24:48 GMT\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nX-Bdcdn-Cache-Status: TCP_HIT\r\nX-Request-Id: 41a6bbf9ed24f6631d46305f175805c3\r\nX-Request-Ip: 195.64.118.152\r\nX-Response-Cache: edge_hit\r\nX-Response-Cinfo: 195.64.118.152\r\nX-Tt-Trace-Tag: id=5\r\nDate: Sun, 20 Sep 2026 12:39:13 GMT\r\nvia: mixed02.haxuchang-cu133\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":290970,"size_decoded":111034,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"08734d20764112527ef85ff35579385f","sha1":"640283b87523a19e47e71dc3197e640132d5f40a","sha256":"26a227e34324a23541aa0a3fde17e38b6eab50e4fb9e1dd55a0153acc6a04fd1","sha512":"d56b08f9f4bfca87551dc5827b1927021c4cf024c4c696dbd23d953bfe2d9f596ed395309aa4d5f7f1fe840d90fd121a6af52db4a4f48a0076f69f09cc1beeff","ssdeep":"6144:usaF84nxsaFjfpDfhTwDzfTK2HnO0iyAoP7Gitd1EXkt:2G4n1VfpDfhTwDzfTK2HnO0iyAoP7Gi1","tlshash":"d054d561a694517cbf27f1b5abc796dcb23ca961dd01c7a8f100612c4ecbbf5063362a","first_seen":"2026-08-17T01:06:16.829025Z","last_seen":"2026-09-20T12:39:44.549881Z","times_seen":7,"resource_available":true,"data":null}},"time_used":789,"timings":{"blocked":-1,"dns":0,"connect":237,"send":0,"wait":239,"receive":312,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"jjjx17.hdrm79.bdcdn.gznsrck.cn/app/index/initData","fqdn":"jjjx17.hdrm79.bdcdn.gznsrck.cn","domain":"gznsrck.cn","tld":"cn"},"ip":{"addr":"219.154.192.101","port":80,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:14.881Z","timestamp":1789907954881,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /app/index/initData HTTP/1.1\r\nHost: jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: text/plain\r\ncode: pzka86\r\nContent-Length: 152\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":152,"data":"In5SvHvFuzEEPlygbiT/SSg6RvZ0cucZEwOlhHDo/F1VoHC/YuBnPsYePfO+9FNXur3tCwC6aEJ+BBHvAOe1xpEjX9yWoRJ5JiuqZuSK3MbDLl2BT5sl7jLS2bcRXzivYeWRMvtyXcWI7JCjglh7uQ=="}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Byte-nginx\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 425\r\nConnection: keep-alive\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Allow-Methods: *\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\nDate: Sun, 20 Sep 2026 12:39:15 GMT\r\nReferrer-Policy: no-referrer\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nVia: cache80.jswxmp,mixed01.haxuchang-cu133\r\nX-Bdcdn-Cache-Status: TCP_MISS,TCP_MISS\r\nX-Request-Id: 89ca9ead35a121d06b88cd17931d9caf\r\nX-Request-Ip: 195.64.118.152\r\nX-Response-Cache: miss\r\nX-Response-Cinfo: 195.64.118.152\r\nX-Tt-Trace-Tag: id=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":487,"size_decoded":1097,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"46fbb76d8790b5e985d405217cf0d279","sha1":"dde180ed3ad9cc8865f5510c22095582697f955f","sha256":"d820bfe57d123c1b83d343b8a700eb758668adc6812ff1dc4b08b5d158caca97","sha512":"407a0c6e8f26cebe49de84293e73471dd2f8ad971dde14e02dbcda6126d858a51828695516d35028702fa16d14c56f5347ac94967126233290b01015f524c749","ssdeep":"","tlshash":"39f05405ef3accac664f1f3d530cc5003144b3144b451518ae065873330cd627a9ef14","first_seen":"2026-09-20T12:39:44.550983Z","last_seen":"2026-09-20T12:39:44.550983Z","times_seen":1,"resource_available":true,"data":null}},"time_used":511,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":511,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"jjjx17.hdrm79.bdcdn.gznsrck.cn/app/channels/getAllChannel","fqdn":"jjjx17.hdrm79.bdcdn.gznsrck.cn","domain":"gznsrck.cn","tld":"cn"},"ip":{"addr":"219.154.192.101","port":80,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:15.405Z","timestamp":1789907955405,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /app/channels/getAllChannel HTTP/1.1\r\nHost: jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: text/plain\r\ntoken: f9a3c4da525529ecd4119d9f48052ee3\r\ncode: pzka86\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Byte-nginx\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 2033\r\nConnection: keep-alive\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Allow-Methods: *\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\nDate: Sun, 20 Sep 2026 12:39:16 GMT\r\nReferrer-Policy: no-referrer\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nVia: cache78.jswxmp,mixed01.haxuchang-cu133\r\nX-Bdcdn-Cache-Status: TCP_MISS,TCP_MISS\r\nX-Request-Id: f12a22141ec5b9f9e7e1fc47f43401c6\r\nX-Request-Ip: 195.64.118.152\r\nX-Response-Cache: miss\r\nX-Response-Cinfo: 195.64.118.152\r\nX-Tt-Trace-Tag: id=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2612,"size_decoded":2706,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"7ed03c240204b0dbae2ddc2ee47d2983","sha1":"c79da25cfe055935a6a6a762d3c1873550256e63","sha256":"98f543c7afcb6e882a7ab1f6e6f1f8990c668096dedae6c4fdf7d4b53cf318cc","sha512":"7e73bd522f46878b1e94d5e7bf4218e074d97e90036e081586aa88c9a6f84a29a81b597a71fd33837453dc943aef8662533b4ccee03fab583114960c40ecff01","ssdeep":"","tlshash":"ce5129a4d30247d417fc21a5da40cb1acdecdbf94e6eeb9a140b3544cbc29a05516e60","first_seen":"2026-09-20T12:39:44.551927Z","last_seen":"2026-09-20T12:39:44.551927Z","times_seen":1,"resource_available":true,"data":null}},"time_used":794,"timings":{"blocked":-1,"dns":0,"connect":283,"send":0,"wait":511,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"jjjx17.hdrm79.bdcdn.gznsrck.cn/app/videos/getOnlyCatBySet","fqdn":"jjjx17.hdrm79.bdcdn.gznsrck.cn","domain":"gznsrck.cn","tld":"cn"},"ip":{"addr":"219.154.192.101","port":80,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:15.406Z","timestamp":1789907955406,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /app/videos/getOnlyCatBySet HTTP/1.1\r\nHost: jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: text/plain\r\ntoken: f9a3c4da525529ecd4119d9f48052ee3\r\ncode: pzka86\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Byte-nginx\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 3403\r\nConnection: keep-alive\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Allow-Methods: *\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\nDate: Sun, 20 Sep 2026 12:39:16 GMT\r\nReferrer-Policy: no-referrer\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nVia: cache59.sccdmp,mixed02.haxuchang-cu133\r\nX-Bdcdn-Cache-Status: TCP_MISS,TCP_MISS\r\nX-Request-Id: 21054e37d1897e7b5bfe56b9aa6fcef0\r\nX-Request-Ip: 195.64.118.152\r\nX-Response-Cache: miss\r\nX-Response-Cinfo: 195.64.118.152\r\nX-Tt-Trace-Tag: id=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4431,"size_decoded":4076,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"ebe204c632b437545b828b4cf0086695","sha1":"4e5defcdd78ccc02f39b9b168ee6c729b3d64f1b","sha256":"44a3e8e8177b52187803a5eabe45609f76d03233e9f6b5eee23cc7ff41fb9c31","sha512":"5f94c1c06d2e5f880298f090017c098581a9c030baa9d6251a8072b60ae0e9a3ebe119027687dc97d8120b1f4e58da4e2802197119674aab38d9292b5ce40f80","ssdeep":"96:lNp+Sy4HC6b+f5oSps0CF0naLgmtZxfACghp+sShhsyPn4wFgW:lNpBZF0naLZVfACgz+4yP4wSW","tlshash":"a3919ee9000cc90c983526757c617615edbe32d7beb0c38bae3a48a21f409536095e33","first_seen":"2026-08-28T16:20:52.263966Z","last_seen":"2026-09-20T12:39:44.55288Z","times_seen":4,"resource_available":true,"data":null}},"time_used":1187,"timings":{"blocked":-1,"dns":0,"connect":313,"send":0,"wait":874,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.tgd32.com/uploads/20250524/5058efaa6e3c35fa10131407fe45dea9.png","fqdn":"api.tgd32.com","domain":"tgd32.com","tld":"com"},"ip":{"addr":"43.248.103.112","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.642Z","timestamp":1789907956642,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.tgd32.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 28 Aug 2026 11:37:54 GMT","end":"Thu, 26 Nov 2026 11:37:53 GMT"},"fingerprint":{"sha1":"08:3D:30:14:89:D6:EA:DE:E2:15:75:77:09:AF:E6:43:53:CC:59:4C","sha256":"11:AD:37:D0:C8:25:36:08:F9:3B:39:C2:CB:9F:8E:6C:EF:F3:64:2F:21:BE:CD:22:08:C7:4D:62:1A:3B:A7:6A"}}},"request":{"raw":"GET /uploads/20250524/5058efaa6e3c35fa10131407fe45dea9.png HTTP/1.1\r\nHost: api.tgd32.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: image/png\r\ncontent-length: 2904\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 24 May 2025 13:36:18 GMT\r\netag: W/\"6831cb52-dc0\"\r\nexpires: Wed, 14 Oct 2026 15:58:54 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3520,"size_decoded":3272,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"5058efaa6e3c35fa10131407fe45dea9","sha1":"f42955044734859c1e52f02b47e00212ed95f7e8","sha256":"f94d2a213a8108826eff4365ef2e4964b47a135067a3424e98a0868e1318a141","sha512":"25318532f256201e0a844f0a94e6187a13b4d499b342be6506d26ab5d22502638a2cfa9edaba23b7dd2e8da2486be679428a74dc34ecb385299b71bc1d82c22d","ssdeep":"","tlshash":"76710a4df9922c134856ee578ed615666a5a088045d5ecb1fcdacc137c702fec80d2db","first_seen":"2026-06-10T20:35:05.636951Z","last_seen":"2026-09-20T12:39:44.554162Z","times_seen":8,"resource_available":false,"data":null}},"time_used":1517,"timings":{"blocked":1034,"dns":0,"connect":0,"send":0,"wait":483,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250527/Tgx2CpYp/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.835Z","timestamp":1789907956835,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tp.erlfhc.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:34:08 GMT","end":"Fri, 11 Dec 2026 05:34:07 GMT"},"fingerprint":{"sha1":"D6:A9:75:61:81:9B:D9:C9:D7:B3:29:06:6F:36:61:73:6C:51:C9:7A","sha256":"E0:C6:92:E7:F5:56:CD:8D:6E:8D:05:84:1E:44:FB:B6:41:19:BF:4C:18:1D:1F:8C:09:A1:B3:88:CC:1B:88:49"}}},"request":{"raw":"GET /video/20250527/Tgx2CpYp/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:21 GMT\r\ncontent-type: application/pdf\r\ncontent-length: 146720\r\nlast-modified: Sun, 06 Jul 2025 18:35:44 GMT\r\netag: \"686ac200-23d20\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146720,"size_decoded":147052,"mime_type":"application/pdf","magic":"data","md5":"d143accc0ae5a08489c10bff95a99edf","sha1":"9c0e955a0507801a108cded699ccf69b527e637f","sha256":"22ad2853ed41922b38ee8f85d06c0f17f8584f9c95513acb932e8ae19ed9f9dd","sha512":"51eb4f648451d0119aca1381e9b0bf5231a0347f76cf8265eb492e7dbb208c13f68aeb605b1c1a51d75232f3e2e7c3344838792e5846ded0da5f5bb58f650b66","ssdeep":"3072:8B2LkYglTdLAoL/1HO11fg/05cOsJB0h2cfbUIjy3VPjkhCmY8z+vIVe/Yxriib:8B2L5KAoLpOo/ScOsJkNoh3VohuvnOWe","tlshash":"43e313f96b299d2493dd9c8311c6fbe8ce0cc6905ae3cf3850b5b2156d10e6656fe0b2","first_seen":"2026-09-20T12:39:44.55515Z","last_seen":"2026-09-20T12:39:44.55515Z","times_seen":1,"resource_available":false,"data":null}},"time_used":5343,"timings":{"blocked":-1,"dns":493,"connect":214,"send":0,"wait":2828,"receive":86,"ssl":1722},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250211/t0xx1EtR/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.837Z","timestamp":1789907956837,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tp.erlfhc.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:34:08 GMT","end":"Fri, 11 Dec 2026 05:34:07 GMT"},"fingerprint":{"sha1":"D6:A9:75:61:81:9B:D9:C9:D7:B3:29:06:6F:36:61:73:6C:51:C9:7A","sha256":"E0:C6:92:E7:F5:56:CD:8D:6E:8D:05:84:1E:44:FB:B6:41:19:BF:4C:18:1D:1F:8C:09:A1:B3:88:CC:1B:88:49"}}},"request":{"raw":"GET /video/20250211/t0xx1EtR/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: application/pdf\r\ncontent-length: 241824\r\nlast-modified: Sun, 06 Jul 2025 18:25:23 GMT\r\netag: \"686abf93-3b0a0\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":241824,"size_decoded":242156,"mime_type":"application/pdf","magic":"data","md5":"fd67a98619f213f02ec0b613f3f6ba09","sha1":"2dbcb592e269ac31bf731ef65ee4ae96b73740a0","sha256":"db423282e64b3f699b9f3081b07870f37882debec38f55e79401560453a1b3b2","sha512":"542ce877419013c4efd05f8ac575388f0f8abc0d19a00fabe55e6b1fbca95e28d5d600825855caabe382eb540540d0244d2c02231d3774c42653837703b75473","ssdeep":"6144:Kl9OxOXDBHu54QKe/8nKbGews/hNrn0eXNzJ3fUhF:QOxmDBHC4QKeDbXNLZXfPUhF","tlshash":"1334231e4370f7d4227fb5c9cd22cad6113f563a46ce376ba4ba8532acd458214a8f4b","first_seen":"2026-09-20T12:39:44.556213Z","last_seen":"2026-09-20T12:39:44.556213Z","times_seen":1,"resource_available":false,"data":null}},"time_used":5070,"timings":{"blocked":-1,"dns":491,"connect":257,"send":0,"wait":621,"receive":2436,"ssl":1264},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250526/G2aEA7j2/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:17.529Z","timestamp":1789907957529,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tp.erlfhc.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:34:08 GMT","end":"Fri, 11 Dec 2026 05:34:07 GMT"},"fingerprint":{"sha1":"D6:A9:75:61:81:9B:D9:C9:D7:B3:29:06:6F:36:61:73:6C:51:C9:7A","sha256":"E0:C6:92:E7:F5:56:CD:8D:6E:8D:05:84:1E:44:FB:B6:41:19:BF:4C:18:1D:1F:8C:09:A1:B3:88:CC:1B:88:49"}}},"request":{"raw":"GET /video/20250526/G2aEA7j2/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: application/pdf\r\ncontent-length: 130032\r\nlast-modified: Sun, 06 Jul 2025 18:34:32 GMT\r\netag: \"686ac1b8-1fbf0\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":130032,"size_decoded":130364,"mime_type":"application/pdf","magic":"data","md5":"3eda31494d970c49347ce04756f5794b","sha1":"2350c36e39338485faa877ce7a64f244fba6d1fd","sha256":"06139290462deb82c42ae67daf6b9635f2cf941fded100139ac93293eef1a7c6","sha512":"cfffb54ace2a2c6f31513eb184c6317184bb148595623a22fb45bb910d5dc95766161db90230a5b8f28f2b755496e54e9ae1f6fa0f8c64adda993e82bf187ee7","ssdeep":"3072:lnf77EeSwLi0K9X27gcMtxCVNwA9CzfFM2yw8Gs6Mr:BU9iglxCgAgmPwxy","tlshash":"5cd312ec1ee7596dde5ba80646c9418b1bf11bebcf66fb342d70568603155f4e002392","first_seen":"2026-09-20T12:39:44.557249Z","last_seen":"2026-09-20T12:39:44.557249Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3037,"timings":{"blocked":595,"dns":0,"connect":0,"send":0,"wait":808,"receive":1634,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"23.145.136.185/2.js","fqdn":"23.145.136.185","domain":"23.145.136.185","tld":""},"ip":{"addr":"23.145.136.185","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://v9191.cc/","date":"2026-09-20T12:39:04.524Z","timestamp":1789907944524,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /2.js HTTP/1.1\r\nHost: 23.145.136.185\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://v9191.cc/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 666 status code 666\r\nContent-Length: 7365\r\nContent-Type: text/html; charset=utf-8\r\nDate: Sun, 20 Sep 2026 12:39:04 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"666","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-20T15:41:53.976884Z","times_seen":18570563,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250510/N7fwGFcw/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.828Z","timestamp":1789907956828,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /video/20250510/N7fwGFcw/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-20T15:41:53.976884Z","times_seen":18570563,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250223/8DQEJGU2/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.838Z","timestamp":1789907956838,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tp.erlfhc.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:34:08 GMT","end":"Fri, 11 Dec 2026 05:34:07 GMT"},"fingerprint":{"sha1":"D6:A9:75:61:81:9B:D9:C9:D7:B3:29:06:6F:36:61:73:6C:51:C9:7A","sha256":"E0:C6:92:E7:F5:56:CD:8D:6E:8D:05:84:1E:44:FB:B6:41:19:BF:4C:18:1D:1F:8C:09:A1:B3:88:CC:1B:88:49"}}},"request":{"raw":"GET /video/20250223/8DQEJGU2/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: application/pdf\r\ncontent-length: 61520\r\nlast-modified: Sun, 06 Jul 2025 18:27:56 GMT\r\netag: \"686ac02c-f050\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61520,"size_decoded":61850,"mime_type":"application/pdf","magic":"data","md5":"4fbb90cb7e037bd7da0b39965a2c5d96","sha1":"4a8bf65eec47e355c5791bbf6b3a91b0e9c2258f","sha256":"fc336dfc33e7e375f16dc6fb2890515579d22af1f71ee96078c57a407cb05a80","sha512":"914ae9cfe5f4f97fc04208ae3675aa39f895b5a4960a1e781db9a9ceebddf60216b486c5d298f0d4cd1d92abe5e346690f15772fa0f80eaff9f298b442950ea1","ssdeep":"1536:e/iOGGUtg82t+9WnRB70AR7BA0NSXmM0VOsoOH:e6ZLtg82t+9hAR7BNEA","tlshash":"1f530286797111a5df715c8297c75443df02c60e2e24f12fa2e5b1af99291c63bb92f0","first_seen":"2026-09-20T12:39:44.558191Z","last_seen":"2026-09-20T12:39:44.558191Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2093,"timings":{"blocked":1284,"dns":0,"connect":0,"send":0,"wait":538,"receive":271,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250220/DQfKDuga/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:17.531Z","timestamp":1789907957531,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tp.erlfhc.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:34:08 GMT","end":"Fri, 11 Dec 2026 05:34:07 GMT"},"fingerprint":{"sha1":"D6:A9:75:61:81:9B:D9:C9:D7:B3:29:06:6F:36:61:73:6C:51:C9:7A","sha256":"E0:C6:92:E7:F5:56:CD:8D:6E:8D:05:84:1E:44:FB:B6:41:19:BF:4C:18:1D:1F:8C:09:A1:B3:88:CC:1B:88:49"}}},"request":{"raw":"GET /video/20250220/DQfKDuga/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: application/pdf\r\ncontent-length: 112384\r\nlast-modified: Sun, 06 Jul 2025 18:26:21 GMT\r\netag: \"686abfcd-1b700\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":112384,"size_decoded":112716,"mime_type":"application/pdf","magic":"data","md5":"c37e7f44b3251823f2dcd4e2beca97be","sha1":"d278aac9dcc5d22876f335869588621379a4434f","sha256":"ed24ca27798c603136d3c089cfd2a49b51c62634df35a70e7e7ecb0ceb7e93ce","sha512":"d5d280487b258f6796f593a1bbee3fca16a8e474dfa6bf070c35a13dceec053dde7d52afca15b37c74ca3d4478a232a667db35a02527c5343513746c540238cc","ssdeep":"1536:mwzCdtV4VW8LVr+WmtzLEzPSU8+9lBqRzAnfwYdTgMiA1Xj/RzzJnzlHrTSsvv6T:ZkVxxAzPq+9wA4YljpPvuiv6wD8","tlshash":"05b3127426e172b988f0a2f6913c2ed711f342d452fe55843508eb6b44d0cea1e5fcb4","first_seen":"2026-09-20T12:39:44.559443Z","last_seen":"2026-09-20T12:39:44.559443Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3034,"timings":{"blocked":592,"dns":0,"connect":0,"send":0,"wait":808,"receive":1634,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250510/QvsQNJs1/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:17.532Z","timestamp":1789907957532,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tp.erlfhc.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:34:08 GMT","end":"Fri, 11 Dec 2026 05:34:07 GMT"},"fingerprint":{"sha1":"D6:A9:75:61:81:9B:D9:C9:D7:B3:29:06:6F:36:61:73:6C:51:C9:7A","sha256":"E0:C6:92:E7:F5:56:CD:8D:6E:8D:05:84:1E:44:FB:B6:41:19:BF:4C:18:1D:1F:8C:09:A1:B3:88:CC:1B:88:49"}}},"request":{"raw":"GET /video/20250510/QvsQNJs1/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: application/pdf\r\ncontent-length: 73328\r\nlast-modified: Wed, 16 Jul 2025 19:09:16 GMT\r\netag: \"6877f8dc-11e70\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":73328,"size_decoded":73659,"mime_type":"application/pdf","magic":"data","md5":"801709c6a75e2c157754dd5af24ba0bd","sha1":"d0b5ad735b02f96d715db54303698a021a1d00e6","sha256":"e8fb529e47e226d2bc86ffa9cfa2a292805a66b3430f6a73bfb5edf738f258e9","sha512":"b831eadcbfa476ac05841f95e85438508f262561a957c32eae1a16015f2b200e3a26b1934408547dd7cc7d030e53112819e8063f3a4fadceadd0dee0ef6ad997","ssdeep":"1536:AM/lvW7ZnItW5HePT7qXAo1WxN+G6ZkQK30kNmFu3SCY9:Am47yt++sAwFeT3uBCi","tlshash":"27631223804853f6cc756d4a4f3dc3ae3b8a631c51a15cbd8bab1f4218e1de57129a4f","first_seen":"2026-09-20T12:39:44.560633Z","last_seen":"2026-09-20T12:39:44.560633Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3033,"timings":{"blocked":591,"dns":0,"connect":0,"send":0,"wait":808,"receive":1634,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250510/9gS1dd3t/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:17.535Z","timestamp":1789907957535,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tp.erlfhc.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:34:08 GMT","end":"Fri, 11 Dec 2026 05:34:07 GMT"},"fingerprint":{"sha1":"D6:A9:75:61:81:9B:D9:C9:D7:B3:29:06:6F:36:61:73:6C:51:C9:7A","sha256":"E0:C6:92:E7:F5:56:CD:8D:6E:8D:05:84:1E:44:FB:B6:41:19:BF:4C:18:1D:1F:8C:09:A1:B3:88:CC:1B:88:49"}}},"request":{"raw":"GET /video/20250510/9gS1dd3t/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: application/pdf\r\ncontent-length: 3680\r\nlast-modified: Wed, 16 Jul 2025 19:09:16 GMT\r\netag: \"6877f8dc-e60\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3680,"size_decoded":4008,"mime_type":"application/pdf","magic":"data","md5":"08aae855e907208b168a7994ea1f773c","sha1":"365605926d1ac84e0434c5383e5b9f3c37967260","sha256":"156d50f36574071b72400f9d3ef6f255a2ec0728c8039f84cf94e53dd0658706","sha512":"f38ba2c11b88017d2714bb189b2b63185fc2b0019eec28efefbfefdb4bbb5391e9bf5accff56a4ab96f9d7aa824ac0fb157e04f1baed1ee4603151905c847929","ssdeep":"","tlshash":"ad716ebb314ec81dc274426f494a8750765239a259c94cc2f0b68516cb1e3cb33f5dbe","first_seen":"2026-09-20T12:39:44.561761Z","last_seen":"2026-09-20T12:39:44.561761Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2208,"timings":{"blocked":587,"dns":0,"connect":0,"send":0,"wait":808,"receive":813,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250527/SDyvzCmF/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:17.537Z","timestamp":1789907957537,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tp.erlfhc.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:34:08 GMT","end":"Fri, 11 Dec 2026 05:34:07 GMT"},"fingerprint":{"sha1":"D6:A9:75:61:81:9B:D9:C9:D7:B3:29:06:6F:36:61:73:6C:51:C9:7A","sha256":"E0:C6:92:E7:F5:56:CD:8D:6E:8D:05:84:1E:44:FB:B6:41:19:BF:4C:18:1D:1F:8C:09:A1:B3:88:CC:1B:88:49"}}},"request":{"raw":"GET /video/20250527/SDyvzCmF/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: application/pdf\r\ncontent-length: 273840\r\nlast-modified: Sun, 06 Jul 2025 18:34:51 GMT\r\netag: \"686ac1cb-42db0\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":273840,"size_decoded":274172,"mime_type":"application/pdf","magic":"data","md5":"49c6b65b9bf07c3553ff3513bf7b6eb4","sha1":"495c0a5e913e51724d8c0cfa1266061bcf6f309d","sha256":"8edd929eedb9a92e5a03d62a95ea8801c20db69883934d673328556a6c8b78b1","sha512":"8cb6955f3d1e762fbc008c0469aba1cccd962710a7570eb132184453f3a284d148e1619b5cb8a713306495fd3de5f08426a74610924c2938b973e0abed6b89c0","ssdeep":"6144:0KYoF85jNWbabgY1ghckuLmkTO+1F4r//HZUQBZ:Bat4abgYgnu6kTa/xUa","tlshash":"c34423a6ff36978493b60ec815121f0498b683b23de14ea4961fe0c1656d7007edfb7a","first_seen":"2026-09-20T12:39:44.562752Z","last_seen":"2026-09-20T12:39:44.562752Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3031,"timings":{"blocked":586,"dns":0,"connect":0,"send":0,"wait":808,"receive":1637,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250527/CLt2dbJ6/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:17.538Z","timestamp":1789907957538,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tp.erlfhc.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:34:08 GMT","end":"Fri, 11 Dec 2026 05:34:07 GMT"},"fingerprint":{"sha1":"D6:A9:75:61:81:9B:D9:C9:D7:B3:29:06:6F:36:61:73:6C:51:C9:7A","sha256":"E0:C6:92:E7:F5:56:CD:8D:6E:8D:05:84:1E:44:FB:B6:41:19:BF:4C:18:1D:1F:8C:09:A1:B3:88:CC:1B:88:49"}}},"request":{"raw":"GET /video/20250527/CLt2dbJ6/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: application/pdf\r\ncontent-length: 287104\r\nlast-modified: Sun, 06 Jul 2025 18:34:56 GMT\r\netag: \"686ac1d0-46180\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":287104,"size_decoded":287436,"mime_type":"application/pdf","magic":"data","md5":"6a390fcfa05a018c177421f4dbfe4683","sha1":"34f48032ba7de033a9f59a6e62536072a54ef0ac","sha256":"111fa9fd31a968028aa969e843c80b1ae930df538990dd15a9b6fc6409f2ac09","sha512":"fdd30fb69116b6fe7748eaf0c17634bd59374b9ae43bb76a2f1f17ea73fbddd84873f33d58c5f0aebc25b2a4b88fb0b8fea80174f566de59843a1cfe69ca2150","ssdeep":"6144:UaXSC2izjVA9QqBpzmM9+PkdrBmfynv0JtDlsmWruMjC0:UaHeSqucRrBmqnMTDlsFuMjC0","tlshash":"595423139c8727b27659db560cd720503fff9ef799d3593123b78e023605b82a246ab2","first_seen":"2026-09-20T12:39:44.564038Z","last_seen":"2026-09-20T12:39:44.564038Z","times_seen":1,"resource_available":false,"data":null}},"time_used":4366,"timings":{"blocked":585,"dns":0,"connect":0,"send":0,"wait":808,"receive":2973,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"23.145.136.185/2.js","fqdn":"23.145.136.185","domain":"23.145.136.185","tld":""},"ip":{"addr":"23.145.136.185","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://v9191.cc/","date":"2026-09-20T12:39:02.315Z","timestamp":1789907942315,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /2.js HTTP/1.1\r\nHost: 23.145.136.185\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://v9191.cc/\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 666 status code 666\r\nContent-Length: 7365\r\nContent-Type: text/html; charset=utf-8\r\nDate: Sun, 20 Sep 2026 12:39:02 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"666","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-20T15:41:53.976884Z","times_seen":18570563,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"jjjx17.hdrm79.bdcdn.gznsrck.cn/client/assets/index-Bb9T-Y5G.js","fqdn":"jjjx17.hdrm79.bdcdn.gznsrck.cn","domain":"gznsrck.cn","tld":"cn"},"ip":{"addr":"219.154.192.101","port":80,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:12.865Z","timestamp":1789907952865,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /client/assets/index-Bb9T-Y5G.js HTTP/1.1\r\nHost: jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Byte-nginx\r\nContent-Type: application/javascript\r\nContent-Length: 567040\r\nConnection: keep-alive\r\nAge: 30242\r\nCache-Control: max-age=43200\r\nContent-Encoding: gzip\r\nEtag: W/\"6a85a090-174c12\"\r\nExpires: Sun, 20 Sep 2026 08:36:03 GMT\r\nLast-Modified: Wed, 19 Aug 2026 12:24:48 GMT\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nX-Bdcdn-Cache-Status: TCP_HIT\r\nX-Request-Id: e46e152b8ff1ab0a01cb9de83b61ec22\r\nX-Request-Ip: 195.64.118.152\r\nX-Response-Cache: edge_hit\r\nX-Response-Cinfo: 195.64.118.152\r\nX-Tt-Trace-Tag: id=5\r\nDate: Sun, 20 Sep 2026 12:39:12 GMT\r\nvia: mixed01.haxuchang-cu133\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1526802,"size_decoded":567672,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (45342)","md5":"715605eee6c53a5963273e5d567a66a2","sha1":"e2ce63e0eb0054bdc5a8719ab85a38b701f63338","sha256":"52879604f3e2da583ec3c6857d12a0c0586e7abde1bd7f1d13f8667497bfc393","sha512":"fbe287bce5a353d64ea2b5f8e622956116603f9521fd9fc2667cb1573abf67cc608f0260f1fac0ab25841a78eb826dc504b705405c2b73e257e1c438dd452cfe","ssdeep":"24576:KXlI7SZVY/63Dprq/xwPDbtvDaQ02wBiEFbMA+YsAVvF70pamq5AUoXvnym2X/Zz:KXlI7SZVY/63Dprq/xwPntvDaQ02wBi+","tlshash":"a7254ad932d6646287d169d9503b0202723a7d093448c19cfa3efceb2e6ad45a47bf7c","first_seen":"2026-08-21T06:15:04.164626Z","last_seen":"2026-09-20T12:39:44.565106Z","times_seen":6,"resource_available":true,"data":null}},"time_used":1230,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":238,"receive":992,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"jjjx17.hdrm79.bdcdn.gznsrck.cn/client/assets/555-D8ZUro3o.png","fqdn":"jjjx17.hdrm79.bdcdn.gznsrck.cn","domain":"gznsrck.cn","tld":"cn"},"ip":{"addr":"219.154.192.101","port":80,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.286Z","timestamp":1789907956286,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /client/assets/555-D8ZUro3o.png HTTP/1.1\r\nHost: jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/assets/index-DhPicj5T.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Byte-nginx\r\nContent-Type: image/png\r\nContent-Length: 50666\r\nConnection: keep-alive\r\nAge: 30243\r\nCache-Control: max-age=2592000\r\nContent-Encoding: gzip\r\nEtag: W/\"6a85a090-c993\"\r\nExpires: Sun, 27 Sep 2026 18:12:07 GMT\r\nLast-Modified: Wed, 19 Aug 2026 12:24:48 GMT\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nVia: cache79.sdqdmp,mixed01.haxuchang-cu133\r\nX-Bdcdn-Cache-Status: TCP_MISS,TCP_HIT\r\nX-Request-Id: 0dafe125e08b296e1363f87258444b9a\r\nX-Request-Ip: 195.64.118.152\r\nX-Response-Cache: parent_hit\r\nX-Response-Cinfo: 195.64.118.152\r\nX-Tt-Trace-Tag: id=5\r\nDate: Sun, 20 Sep 2026 12:39:16 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":51603,"size_decoded":51310,"mime_type":"image/png","magic":"PNG image data, 800 x 113, 8-bit/color RGBA, non-interlaced","md5":"3f857fb1cec111f99da2030946c1f63b","sha1":"16ba29d4a5ec4ea5f9e6e8cea4b301321dec687f","sha256":"56b3ada8b3e5aa62d1af92d77d93c4eeb11c3e77ca7ad016f62baa34f5f395b6","sha512":"8f49a49366873cfffd18b269182a6a5fda25c4c9549e9004bc247503ad1f50255979a27efdc375a249a1dfef9fb2ff361419c2c3461dd394b202bddc04453ae3","ssdeep":"1536:oDC5J9gg358xmAf/+A6e6lv1JY1BkJj/tJ:BsxnWvphY1BkN","tlshash":"3533021ef93dac44c8a19405e9593177ff72c2801f5e3034bce98c3b682a5e79e47896","first_seen":"2025-06-17T15:30:36.877728Z","last_seen":"2026-09-20T12:39:44.566378Z","times_seen":9,"resource_available":false,"data":null}},"time_used":277,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":261,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"forapi.jbbxck.com/index/index/getCodeByUrl","fqdn":"forapi.jbbxck.com","domain":"jbbxck.com","tld":"com"},"ip":{"addr":"43.248.133.130","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://v9191.cc/","date":"2026-09-20T12:39:04.522Z","timestamp":1789907944522,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"forapi.jbbxck.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 13 Sep 2026 09:53:20 GMT","end":"Sat, 12 Dec 2026 09:53:19 GMT"},"fingerprint":{"sha1":"03:FA:6E:60:C8:9E:09:F3:CC:5C:D6:FA:C5:90:79:A7:EE:A6:E8:DD","sha256":"EE:C6:A1:96:25:31:74:99:41:86:AF:AA:82:98:C7:08:CE:D1:EA:47:1A:0D:AD:BA:01:3C:4D:6B:7F:8A:E3:C0"}}},"request":{"raw":"OPTIONS /index/index/getCodeByUrl HTTP/1.1\r\nHost: forapi.jbbxck.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: http://v9191.cc/\r\nOrigin: http://v9191.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:05 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":204,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-20T15:41:53.976884Z","times_seen":18570563,"resource_available":true,"data":null}},"time_used":1159,"timings":{"blocked":-1,"dns":196,"connect":505,"send":0,"wait":225,"receive":0,"ssl":233},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cayr53.hpth91.bdcdn.zjyxqb.cn/zz/pzka86?FrJh","fqdn":"cayr53.hpth91.bdcdn.zjyxqb.cn","domain":"zjyxqb.cn","tld":"cn"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-20T12:39:07.946Z","timestamp":1789907947946,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /zz/pzka86?FrJh HTTP/1.1\r\nHost: cayr53.hpth91.bdcdn.zjyxqb.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://v9191.cc/\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-20T15:41:53.976884Z","times_seen":18570563,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","fqdn":"jjjx17.hdrm79.bdcdn.gznsrck.cn","domain":"gznsrck.cn","tld":"cn"},"ip":{"addr":"219.154.192.101","port":80,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-20T12:39:11.041Z","timestamp":1789907951041,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /client/index.html HTTP/1.1\r\nHost: jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Byte-nginx\r\nContent-Type: text/html\r\nContent-Length: 326\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nContent-Encoding: gzip\r\nDate: Sun, 20 Sep 2026 12:39:12 GMT\r\nEtag: \"6a85a090-1ef\"\r\nLast-Modified: Wed, 19 Aug 2026 12:24:48 GMT\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nVia: cache59.sccdmp,mixed01.haxuchang-cu133\r\nX-Bdcdn-Cache-Status: TCP_MISS,TCP_MISS\r\nX-Request-Id: 65f286cdcefd788b10db6d936135f8aa\r\nX-Request-Ip: 195.64.118.152\r\nX-Response-Cache: miss\r\nX-Response-Cinfo: 195.64.118.152\r\nX-Tt-Trace-Tag: id=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":495,"size_decoded":898,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"1fbf036873920977ecf5e652609cc06a","sha1":"662af582abca927bd9c1457056d88885e329c4b2","sha256":"fc473d3d99214ee95b6b255167e484c050907dfc0df4b8f948baaf7cc1a6b161","sha512":"bd304a037a66668249980e99355eac9a7286705f3c93d3b0e24d3e2e14b614f897ed38f3beca7c0067f790df37879ef0fbc87e65e7a0df1c35e435b716011d1a","ssdeep":"","tlshash":"75f0598354b1885983404a085dd0f5046e8ad7464a4a9d5828eb10bddfc4b89cddf468","first_seen":"2026-08-21T06:15:04.162118Z","last_seen":"2026-09-20T12:39:44.56747Z","times_seen":6,"resource_available":true,"data":null}},"time_used":1742,"timings":{"blocked":0,"dns":13,"connect":243,"send":0,"wait":1485,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"jjjx17.hdrm79.bdcdn.gznsrck.cn/client/icon.ico","fqdn":"jjjx17.hdrm79.bdcdn.gznsrck.cn","domain":"gznsrck.cn","tld":"cn"},"ip":{"addr":"219.154.192.101","port":80,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:14.494Z","timestamp":1789907954494,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /client/icon.ico HTTP/1.1\r\nHost: jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Byte-nginx\r\nContent-Type: image/x-icon\r\nContent-Length: 7380\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nContent-Encoding: gzip\r\nDate: Sun, 20 Sep 2026 12:39:14 GMT\r\nEtag: \"6a69fef1-423e\"\r\nLast-Modified: Wed, 29 Jul 2026 13:24:01 GMT\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nVia: cache61.sccdmp,mixed02.haxuchang-cu133\r\nX-Bdcdn-Cache-Status: TCP_MISS,TCP_MISS\r\nX-Request-Id: 73dedfb9c5d6801cf207824fc349a249\r\nX-Request-Ip: 195.64.118.152\r\nX-Response-Cache: miss\r\nX-Response-Cinfo: 195.64.118.152\r\nX-Tt-Trace-Tag: id=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16958,"size_decoded":7957,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel","md5":"85857bea6a99a6ef66cca9f1c35c96b1","sha1":"9dc33df79978ed3ca42cbb55db501b5240e0c4a2","sha256":"f121ca07698e9612e549b3d48015c776c72b53ffc78b00ca3800813d8a912730","sha512":"c3f1ecac1adc74fc9f859b3be0b9b67f64502c802aaf72b60eaac16d457ca6d4ad067feaa98cd1355e335d45e7370f13d362c7eeac7931c684a4c0c0bc8b7157","ssdeep":"384:NRC751U5xa7hfBSLFRrxo5QVtowpZSERtU/dyW/UoUIveoc5b65B9OAVxMgM5G6u:NRC751U5xaNfBSLFRto5Q/oMdRtU/dy2","tlshash":"38720fca573489afdb1d487c68e83f8d36588bbe6548fb81e139a7353b6734d2c90484","first_seen":"2025-10-12T06:43:46.957876Z","last_seen":"2026-09-20T12:39:44.568482Z","times_seen":69,"resource_available":false,"data":null}},"time_used":489,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":482,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250220/W7ffJDgd/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:16.833Z","timestamp":1789907956833,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tp.erlfhc.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:34:08 GMT","end":"Fri, 11 Dec 2026 05:34:07 GMT"},"fingerprint":{"sha1":"D6:A9:75:61:81:9B:D9:C9:D7:B3:29:06:6F:36:61:73:6C:51:C9:7A","sha256":"E0:C6:92:E7:F5:56:CD:8D:6E:8D:05:84:1E:44:FB:B6:41:19:BF:4C:18:1D:1F:8C:09:A1:B3:88:CC:1B:88:49"}}},"request":{"raw":"GET /video/20250220/W7ffJDgd/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: application/pdf\r\ncontent-length: 447264\r\nlast-modified: Sun, 06 Jul 2025 18:26:23 GMT\r\netag: \"686abfcf-6d320\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":447264,"size_decoded":447596,"mime_type":"application/pdf","magic":"data","md5":"596ff971300b09f5479cf088471d573f","sha1":"476e61bb606adb95cda0fec11a31cb9abb8da0d6","sha256":"8686ffac37ca3755d5e322220612724a8fc9bbd3ebb30b0a7f313c268ebf0e04","sha512":"851e98b286cb4342dfc1822f354f0a9d16e4fd770a21440bcc8d1e9f4e106a0c04557f00eda2bd93814bd71d41fb82439af3e119b6dafb0e9ec1cd58b9bff3dd","ssdeep":"6144:tfE8MTJqKweKInAgversrX8CwWDqyPgUAP3uV5iu2/H+RDiYD+mLWe7tS2qrjact:K8MsL62QrX8CwWernP3K5S/cH97G/t","tlshash":"239423c76f98fa083e14cef04cc5915c08277b359967364f98fa79fdb1a0f2608952a6","first_seen":"2026-09-20T12:39:44.569682Z","last_seen":"2026-09-20T12:39:44.569682Z","times_seen":1,"resource_available":false,"data":null}},"time_used":5074,"timings":{"blocked":-1,"dns":495,"connect":218,"send":0,"wait":719,"receive":2975,"ssl":667},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tp.sqxzhv.cn/video/20250219/JFheE686/1.pdf","fqdn":"tp.sqxzhv.cn","domain":"sqxzhv.cn","tld":"cn"},"ip":{"addr":"43.248.103.103","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://jjjx17.hdrm79.bdcdn.gznsrck.cn/client/index.html#/?tt=R20Ndm4NAzlaA1d80XbPMyrNbQfvDWIIvr4f%2BZpFGR4%3D","date":"2026-09-20T12:39:17.540Z","timestamp":1789907957540,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tp.erlfhc.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:34:08 GMT","end":"Fri, 11 Dec 2026 05:34:07 GMT"},"fingerprint":{"sha1":"D6:A9:75:61:81:9B:D9:C9:D7:B3:29:06:6F:36:61:73:6C:51:C9:7A","sha256":"E0:C6:92:E7:F5:56:CD:8D:6E:8D:05:84:1E:44:FB:B6:41:19:BF:4C:18:1D:1F:8C:09:A1:B3:88:CC:1B:88:49"}}},"request":{"raw":"GET /video/20250219/JFheE686/1.pdf HTTP/1.1\r\nHost: tp.sqxzhv.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://jjjx17.hdrm79.bdcdn.gznsrck.cn/\r\nOrigin: http://jjjx17.hdrm79.bdcdn.gznsrck.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:18 GMT\r\ncontent-type: application/pdf\r\ncontent-length: 164432\r\nlast-modified: Sun, 06 Jul 2025 18:26:05 GMT\r\netag: \"686abfbd-28250\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":164432,"size_decoded":164764,"mime_type":"application/pdf","magic":"data","md5":"06d1063e8ceb204327971401b8a723e7","sha1":"13375946063fcb6b190f6c8a7c26951dd57204e1","sha256":"97d26d1a78938d7549d9c83d20637c20c1e9835c852771c0f62c9b1ad2003759","sha512":"3cdfae6e3124efbdb1f6b2334fdb369bc34e717dfdb86a9769b75accab4e23e7773760026b9f3ca3571c26571c5695711bda75b1cae1b980ab7f5481bef4002c","ssdeep":"3072:fYSY4UNZbRntqli1w1ioWgBCVfbAHJyQH3jFcORN/W2VDKUVCqKEV0YM:d5IVtP5oWm4bAh3ZcORNOnAoEV0YM","tlshash":"04f31253046288e667f2f6294cbce1cf39dd7e295b091c7e59a58837fa0413cb6a83d4","first_seen":"2026-09-20T12:39:44.570749Z","last_seen":"2026-09-20T12:39:44.570749Z","times_seen":1,"resource_available":false,"data":null}},"time_used":4366,"timings":{"blocked":584,"dns":0,"connect":0,"send":0,"wait":809,"receive":2973,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mid.jbbxck.com/js/2.js","fqdn":"mid.jbbxck.com","domain":"jbbxck.com","tld":"com"},"ip":{"addr":"43.248.133.130","port":443,"asn":23650,"as":"AS Number for CHINANET jiangsu province backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://v9191.cc/","date":"2026-09-20T12:39:02.313Z","timestamp":1789907942313,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mid.jbbxck.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 13 Sep 2026 09:52:43 GMT","end":"Sat, 12 Dec 2026 09:52:42 GMT"},"fingerprint":{"sha1":"04:01:84:CA:91:98:7C:7E:8B:54:0D:F2:FE:ED:04:1F:AB:35:98:CD","sha256":"A2:B8:CD:FF:EF:84:1B:5F:98:44:30:C3:6D:5D:01:F1:DC:59:EE:D4:74:50:D4:AE:DA:ED:4E:A9:EB:41:65:54"}}},"request":{"raw":"GET /js/2.js HTTP/1.1\r\nHost: mid.jbbxck.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://v9191.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 20 Sep 2026 12:39:04 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 532\r\nlast-modified: Mon, 15 Jun 2026 11:11:18 GMT\r\netag: \"6a2fddd6-214\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":532,"size_decoded":866,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"eca76f876c96752cc9a8f091589b8c1b","sha1":"ccc26a79989d0a228771874a0776eae827faecfa","sha256":"9b0c8c363260be1e6f81659893e817c881be2fd4eee46f52b800d6b042bbd2c7","sha512":"56ad1b20f43a73b8327191cbde83b1c3588f9aea7941d542c329ac18b2cd09b9baf79dd577159ac6332c07c1d0f1dad4ec6fb9d3ed1da00d6d6a40eb84847910","ssdeep":"","tlshash":"14f0c08a10bf1331d7ab604e4b4b25123033c5cf3405ed58769d43040f9e55ec429698","first_seen":"2026-09-20T12:39:44.572012Z","last_seen":"2026-09-20T12:39:44.572012Z","times_seen":1,"resource_available":true,"data":null}},"time_used":2092,"timings":{"blocked":-1,"dns":385,"connect":216,"send":0,"wait":216,"receive":0,"ssl":1275},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}