{"report_id":"c1c5f1c0-c3df-4368-8add-37ffc8f88379","version":0,"status":"done","tags":[],"date":"2026-10-06T22:53:20Z","url":{"schema":"https","addr":"tottattoo.com/","fqdn":"tottattoo.com","domain":"tottattoo.com","tld":"com"},"ip":{"addr":"38.4.92.231","port":0,"asn":54801,"as":"Zillion Network Inc.","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"tottattoo.com/","fqdn":"tottattoo.com","domain":"tottattoo.com","tld":"com"},"title":"老酒馆电视剧全集在线观看免费高清 - 年代大剧独家解析","dom":{"size":73926,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (397)","md5":"8b40afd6ed5fd5dd4685a679e6cfc93a","sha1":"83d27d98105ba512b47b40224d323b79f7d0de98","sha256":"22ec21b9964793589d658b99a1563bbb51c9c99fac47548d7ee01fb630585a0f","sha512":"dfaa3ca070f9fe40b47cf7a417176996d5e73b82687bed2aada509852f7881603061e332c4f921f430277a00d6424c73361ad33130f451c1c9ec862d838cab58","ssdeep":"768:kVi0ngK0Hrp+/5N5RzgLjxPgpBrZ5mT3zXa3/Se+wO:klngjw5N5RWDIO","tlshash":"af7397ab56f3142a2527e1e62fba470636e5e103c08eca143fbc57948fcad859c6374d","dom_hash":"domhash7b86714d96a695a7dbdad051ad150500","first_seen":"2026-10-06T21:28:54.925815Z","last_seen":"2026-10-06T22:53:26.030713Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"tottattoo.com/","fqdn":"tottattoo.com","domain":"tottattoo.com","tld":"com"},"ip":{"addr":"38.4.92.231","port":0,"asn":54801,"as":"Zillion Network Inc.","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-10T22:53:20Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"tottattoo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"tottattoo.com","ip":{"addr":"38.4.92.231","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"domain_registered":"2026-08-30","domain_rank":0,"first_seen":"2026-10-06T21:28:47.843113Z","last_seen":"2026-10-06T21:28:47.843114Z","alert_count":30,"request_count":10,"received_data":423015,"sent_data":5147,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"tottattoo.com/","fqdn":"tottattoo.com","domain":"tottattoo.com","tld":"com"},"ip":{"addr":"38.4.92.231","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"262c17ef6ba0abbca9871aa649a0ce56","sha1":"bea491e4eb6295f76c08cc65e3b2b4a93287d4a7","sha256":"cfead63a6c11e6c13413292edf3a028c9d9964ac8ffa4222a4641324c11cc1e1","sha512":"91a610beb3e3e4bdfe7731e3008ef339b4ceba393242aea887c2d5d1ba617c5a8e1c4d14edfe9f6b0055509614664947f8a5dc1b7735b0f57281e6a468f8f978","ssdeep":"96:v35LrKj0UWUROyXbOfPYSkv12NnWRnI3cefqUwyu9DRk7/86SX1h2wx60yri:PZmjRrRBSc0gno5yUwyYq7/BSbBxhyri","tlshash":"6a1251bfbab724354dab777a5fef8a0472a510074486dd007f6d4a864fe4c8049baed0","size":9728,"data":"","first_seen":"2026-10-06T21:28:54.951246Z","last_seen":"2026-10-06T22:53:26.082825Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"tottattoo.com/","fqdn":"tottattoo.com","domain":"tottattoo.com","tld":"com"},"ip":{"addr":"38.4.92.231","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-06T22:52:43.146Z","timestamp":1791327163146,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tottattoo.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 08:58:57 GMT","end":"Sun, 29 Nov 2026 08:58:56 GMT"},"fingerprint":{"sha1":"EA:16:90:60:CB:70:43:CE:D0:76:19:B0:77:E6:45:C3:DD:39:3F:02","sha256":"BD:1B:EF:4C:56:82:2A:DE:B6:B5:88:7F:3E:D0:50:1E:E5:CB:0B:95:75:26:0B:E4:2A:C1:80:96:D2:21:28:0B"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: tottattoo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 22:52:43 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":75879,"size_decoded":14363,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (397), with CRLF line terminators","md5":"0a1b1d613de0289347038557737fed13","sha1":"46da12d2b8cdded5178f80bb75879b5aea0285bf","sha256":"3950a5ab36949a7579b6710ca0575c8fa555f847457fe0618905e0cc59db6aa3","sha512":"c60a00a30d86949efee709ea918c7b653977b3aa70a4bdab68c05d1779c59167824856c169e051ecdf784c5aeb25fccb4f881e004eebc0c4226a53ddf9d9aa2a","ssdeep":"768:fwHo2Gk8B+mCv33FqqTU1zsgM4notwc1Z7Wv8ljX:fwbc+mCWqGuX","tlshash":"b273832ae6d2242a2537e3f59bb64746fae65103c18642143fbc57934ffac049d23e8d","first_seen":"2026-10-06T21:28:54.944426Z","last_seen":"2026-10-06T22:53:26.042862Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1003,"timings":{"blocked":-1,"dns":80,"connect":151,"send":0,"wait":307,"receive":0,"ssl":465},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"tottattoo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tottattoo.com/upload/vod/012-tv.webp","fqdn":"tottattoo.com","domain":"tottattoo.com","tld":"com"},"ip":{"addr":"38.4.92.231","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://tottattoo.com/","date":"2026-10-06T22:52:44.459Z","timestamp":1791327164459,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tottattoo.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 08:58:57 GMT","end":"Sun, 29 Nov 2026 08:58:56 GMT"},"fingerprint":{"sha1":"EA:16:90:60:CB:70:43:CE:D0:76:19:B0:77:E6:45:C3:DD:39:3F:02","sha256":"BD:1B:EF:4C:56:82:2A:DE:B6:B5:88:7F:3E:D0:50:1E:E5:CB:0B:95:75:26:0B:E4:2A:C1:80:96:D2:21:28:0B"}}},"request":{"raw":"GET /upload/vod/012-tv.webp HTTP/1.1\r\nHost: tottattoo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tottattoo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 22:52:44 GMT\r\ncontent-type: image/webp\r\ncontent-length: 31650\r\nlast-modified: Wed, 03 Jun 2026 14:05:56 GMT\r\netag: \"6a2034c4-7ba2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31650,"size_decoded":32090,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 272x382, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"537c6dc9a2023da46136493737f62ab6","sha1":"f4aa77b3ec67d25d3e5255f8788f1200cb6c0bf7","sha256":"2a9258035cd56b192a805feb7ab8dea95bd988396e6a1b149cda4ddce2e823de","sha512":"bb05cf8e8dba3ba989c3e0575a6e3d8b4859621abbac7c78823e5b865f57e3020e4b226043508436bf6dfbe5bc4307ea62666bf75640e3158e503529cc48ae4e","ssdeep":"768:04+xcOxkppsctRfX1YHdx2k21XtZkOcyNwS1pK55yPlUjXXPm:0RL0Dl1u21Vc4teyNUjPm","tlshash":"20e2e109703791e8aa4678db68d4238c97c7a5b35959d3c7f2249c4be02117bafc2fd2","first_seen":"2026-06-08T22:57:17.409999Z","last_seen":"2026-10-06T22:53:26.044638Z","times_seen":10,"resource_available":false,"data":null}},"time_used":1661,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1360,"receive":301,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"tottattoo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tottattoo.com/upload/vod/045-movie.webp","fqdn":"tottattoo.com","domain":"tottattoo.com","tld":"com"},"ip":{"addr":"38.4.92.231","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://tottattoo.com/","date":"2026-10-06T22:52:44.460Z","timestamp":1791327164460,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tottattoo.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 08:58:57 GMT","end":"Sun, 29 Nov 2026 08:58:56 GMT"},"fingerprint":{"sha1":"EA:16:90:60:CB:70:43:CE:D0:76:19:B0:77:E6:45:C3:DD:39:3F:02","sha256":"BD:1B:EF:4C:56:82:2A:DE:B6:B5:88:7F:3E:D0:50:1E:E5:CB:0B:95:75:26:0B:E4:2A:C1:80:96:D2:21:28:0B"}}},"request":{"raw":"GET /upload/vod/045-movie.webp HTTP/1.1\r\nHost: tottattoo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tottattoo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 22:52:44 GMT\r\ncontent-type: image/webp\r\ncontent-length: 35206\r\nlast-modified: Wed, 03 Jun 2026 14:06:44 GMT\r\netag: \"6a2034f4-8986\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":35206,"size_decoded":35646,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 272x400, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"299248e0853a1d48375a84a9e684ff0d","sha1":"ad43c2b2c578245a47366fcd066dc0f071e85677","sha256":"22d6ed1ce8b101fc88a89302a5eb96a7c483b47aa9fa742c7df0a77fe5d7b2a0","sha512":"381e65ba41209a9c86834a1b6f7372bd9795a5f97ef656439ffec0df32397a44b8271a771c6d52327bff0d695df3a19fffa3afbbc92ee6108651a2aeddd77a6d","ssdeep":"768:6O8aKdB0J51CqR6XNcrANJvubfu+7sH9tdDoOWQmHsh:R8aKdB0z1Cb9sbfD7sH9jeQt","tlshash":"e5f2f1e08a2e9cc097eda675a2922278e4413d7c3df9d55a718f0ca7311bb040d19f9f","first_seen":"2026-06-26T05:59:31.653029Z","last_seen":"2026-10-06T22:53:26.046291Z","times_seen":6,"resource_available":false,"data":null}},"time_used":2112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1359,"receive":753,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"tottattoo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tottattoo.com/upload/vod/078-variety.webp","fqdn":"tottattoo.com","domain":"tottattoo.com","tld":"com"},"ip":{"addr":"38.4.92.231","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://tottattoo.com/","date":"2026-10-06T22:52:44.466Z","timestamp":1791327164466,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tottattoo.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 08:58:57 GMT","end":"Sun, 29 Nov 2026 08:58:56 GMT"},"fingerprint":{"sha1":"EA:16:90:60:CB:70:43:CE:D0:76:19:B0:77:E6:45:C3:DD:39:3F:02","sha256":"BD:1B:EF:4C:56:82:2A:DE:B6:B5:88:7F:3E:D0:50:1E:E5:CB:0B:95:75:26:0B:E4:2A:C1:80:96:D2:21:28:0B"}}},"request":{"raw":"GET /upload/vod/078-variety.webp HTTP/1.1\r\nHost: tottattoo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tottattoo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 22:52:44 GMT\r\ncontent-type: image/webp\r\ncontent-length: 14307\r\nlast-modified: Fri, 29 May 2026 03:46:48 GMT\r\netag: \"6a190c28-37e3\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14307,"size_decoded":14747,"mime_type":"image/webp","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 180x240, components 3","md5":"2406e1790fb8997f85288f7f58786ff4","sha1":"f48118fc25d3b27091dbb9a11a2fb3051b237ba1","sha256":"5f329f5765c780b32db9efc84636f54c3be5cd5d93912113b2fb7f31179b9b0b","sha512":"898418e7857975d810e330738cf5d14b404a80ac4642fc1ecd96aa7cd1f7c52e9d2887a789cc88d350e70679e97bb29c40bf239e5633c44a932f0f306779898a","ssdeep":"384:q7LFkf49Wu2rvT2nxib4fjgm8SeYxo39g7nXXWLYs1KL5oT:q2Q9UrbqxiEjgm7CgKgGT","tlshash":"a952bf310f90f5a578b02638ca625d0eaad54b0bfc3d167fa3c185644ae76f1e936f08","first_seen":"2026-06-08T02:52:45.493269Z","last_seen":"2026-10-06T22:53:26.054342Z","times_seen":6,"resource_available":false,"data":null}},"time_used":2107,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1354,"receive":753,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"tottattoo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tottattoo.com/upload/vod/023-anime.webp","fqdn":"tottattoo.com","domain":"tottattoo.com","tld":"com"},"ip":{"addr":"38.4.92.231","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://tottattoo.com/","date":"2026-10-06T22:52:44.467Z","timestamp":1791327164467,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tottattoo.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 08:58:57 GMT","end":"Sun, 29 Nov 2026 08:58:56 GMT"},"fingerprint":{"sha1":"EA:16:90:60:CB:70:43:CE:D0:76:19:B0:77:E6:45:C3:DD:39:3F:02","sha256":"BD:1B:EF:4C:56:82:2A:DE:B6:B5:88:7F:3E:D0:50:1E:E5:CB:0B:95:75:26:0B:E4:2A:C1:80:96:D2:21:28:0B"}}},"request":{"raw":"GET /upload/vod/023-anime.webp HTTP/1.1\r\nHost: tottattoo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tottattoo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 22:52:44 GMT\r\ncontent-type: image/webp\r\ncontent-length: 37656\r\nlast-modified: Wed, 03 Jun 2026 14:06:12 GMT\r\netag: \"6a2034d4-9318\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":37656,"size_decoded":38096,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 272x406, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"92d6a946ffaaaade5f7525963d742e9a","sha1":"ce96696390a13252a9691bb4489e88779ae80386","sha256":"64fd6fd7ad14e2e33f9cc3b549df81f31cea597ac04b37d703bee307fad64af0","sha512":"f22f914df27a1d6ee17568e4b96d299338163515b6ca998383285dab7ea474ac326eac6d2a7ae9b9889d1b3558c32d1877fa3290a4594bdefc704025c5c18193","ssdeep":"768:9gBog/nggkOxKkzydsp6hXlyqmaczBiLfLes3Xy4apen9xsK3x4WCG:9gCg/B5zyk8vJnSpczz3++","tlshash":"85f2f1fbd55c64a73c62bc047a2b2af194195bd602fd21eb810cc6027b1dba51c262f6","first_seen":"2026-07-05T12:39:49.604369Z","last_seen":"2026-10-06T22:53:26.056018Z","times_seen":4,"resource_available":false,"data":null}},"time_used":2407,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1353,"receive":1054,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"tottattoo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tottattoo.com/upload/vod/041-movie.webp","fqdn":"tottattoo.com","domain":"tottattoo.com","tld":"com"},"ip":{"addr":"38.4.92.231","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://tottattoo.com/","date":"2026-10-06T22:52:44.470Z","timestamp":1791327164470,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tottattoo.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 08:58:57 GMT","end":"Sun, 29 Nov 2026 08:58:56 GMT"},"fingerprint":{"sha1":"EA:16:90:60:CB:70:43:CE:D0:76:19:B0:77:E6:45:C3:DD:39:3F:02","sha256":"BD:1B:EF:4C:56:82:2A:DE:B6:B5:88:7F:3E:D0:50:1E:E5:CB:0B:95:75:26:0B:E4:2A:C1:80:96:D2:21:28:0B"}}},"request":{"raw":"GET /upload/vod/041-movie.webp HTTP/1.1\r\nHost: tottattoo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tottattoo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 22:52:44 GMT\r\ncontent-type: image/webp\r\ncontent-length: 24590\r\nlast-modified: Fri, 29 May 2026 03:43:10 GMT\r\netag: \"6a190b4e-600e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24590,"size_decoded":25030,"mime_type":"image/webp","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 270x401, components 3","md5":"fb978515a9dbfb26989566328da9f929","sha1":"2b220d3f8cb38fbbeedd74270d267bb7c222d4d5","sha256":"80296032c7fb652d993e0f2f7357b5ffebeaed21b69e2ba14fe4b831b8139d0a","sha512":"4927e4f0e5d49ca4b3096e4ea8800bc0479cd2a3b51852953e57ff48044f9f8b6332d1b8bc7d69903c6ee4613739abc6b5d0253d639bdd0009fd0b09269b8281","ssdeep":"384:pR2lGzHmOP/7nJG0hS1Cp/aEpJRKUbERiWdLJsKqGppUVqNk9aWV22zxUwubvxQQ:pR2DgQ0haCQEpJIXdLjq2y6A4BJZQOD","tlshash":"d1b2e18dfa1784e08b134f3b8b033519c76416d9cacb6673e61e985d9141fbe0b5712e","first_seen":"2026-06-08T02:52:45.482938Z","last_seen":"2026-10-06T22:53:26.058894Z","times_seen":6,"resource_available":false,"data":null}},"time_used":3007,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1350,"receive":1657,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"tottattoo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tottattoo.com/upload/vod/034-banner.webp","fqdn":"tottattoo.com","domain":"tottattoo.com","tld":"com"},"ip":{"addr":"38.4.92.231","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://tottattoo.com/","date":"2026-10-06T22:52:44.458Z","timestamp":1791327164458,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tottattoo.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 08:58:57 GMT","end":"Sun, 29 Nov 2026 08:58:56 GMT"},"fingerprint":{"sha1":"EA:16:90:60:CB:70:43:CE:D0:76:19:B0:77:E6:45:C3:DD:39:3F:02","sha256":"BD:1B:EF:4C:56:82:2A:DE:B6:B5:88:7F:3E:D0:50:1E:E5:CB:0B:95:75:26:0B:E4:2A:C1:80:96:D2:21:28:0B"}}},"request":{"raw":"GET /upload/vod/034-banner.webp HTTP/1.1\r\nHost: tottattoo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tottattoo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 22:52:44 GMT\r\ncontent-type: image/webp\r\ncontent-length: 112178\r\nlast-modified: Wed, 03 Jun 2026 14:06:30 GMT\r\netag: \"6a2034e6-1b632\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":112178,"size_decoded":112620,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 843x503, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"8864bee2f5e8b2b1c88e79f0ccdabbba","sha1":"00673d49a4f4585ce447ae8f84b2275cd15eb635","sha256":"64aade5eb6c7ecd8b1fe23b8d81937ea914f1d44ac4edeccf40a4787981710f6","sha512":"07b022554b8963800ced46fb48c8f119b1f7a1dfc11bc682d7dbf92062e7f99bf189b6f628b0da0bfcb3fb363c6c629107c04540cdca73eed6f8eac178486235","ssdeep":"3072:WurlthcvQlUAJ3KhEky0xMVGAInR8Ae4ZG:WuCIUUKhEOWRIxZG","tlshash":"1bb312cdda37693af478319d48b9c2e7e554455a221b06f82e13738833d6d2c1d32e9a","first_seen":"2026-10-06T21:28:54.930217Z","last_seen":"2026-10-06T22:53:26.061405Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1361,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":302,"receive":1059,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"tottattoo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tottattoo.com/upload/vod/056-manga.webp","fqdn":"tottattoo.com","domain":"tottattoo.com","tld":"com"},"ip":{"addr":"38.4.92.231","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://tottattoo.com/","date":"2026-10-06T22:52:44.468Z","timestamp":1791327164468,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tottattoo.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 08:58:57 GMT","end":"Sun, 29 Nov 2026 08:58:56 GMT"},"fingerprint":{"sha1":"EA:16:90:60:CB:70:43:CE:D0:76:19:B0:77:E6:45:C3:DD:39:3F:02","sha256":"BD:1B:EF:4C:56:82:2A:DE:B6:B5:88:7F:3E:D0:50:1E:E5:CB:0B:95:75:26:0B:E4:2A:C1:80:96:D2:21:28:0B"}}},"request":{"raw":"GET /upload/vod/056-manga.webp HTTP/1.1\r\nHost: tottattoo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tottattoo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 22:52:44 GMT\r\ncontent-type: image/webp\r\ncontent-length: 20590\r\nlast-modified: Fri, 29 May 2026 03:44:35 GMT\r\netag: \"6a190ba3-506e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20590,"size_decoded":21030,"mime_type":"image/webp","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 180x240, components 3","md5":"f24e70dc325c390c0e471509f2718aba","sha1":"2f80bc2c150531ec31fbe197244cda3d00f316fd","sha256":"cfcfbef374b722c10eeadab703baa961e846991512c657937a17bec51a83349c","sha512":"b12282cf0970e5e463606d76de413f3a1446dc88f7b5b54af2be67bf22ac0502d41247c1c3b9da0e36d40ea4870549c3ed3d89c88b9a6d1676944a8c30c8d2cb","ssdeep":"384:0dU6qlFSGz3ptk7fKfk7/ysLmMq9Rcq6c1wZr01eKbMH40DFw:0elFXkjI0KsnmRcVMir/KbMY0DK","tlshash":"2492d04d2694f0ac9a7df1fc56140b7664e20a8ef6cf64713f329a1e9c935a70214ce9","first_seen":"2026-07-07T01:38:31.337588Z","last_seen":"2026-10-06T22:53:26.063064Z","times_seen":3,"resource_available":false,"data":null}},"time_used":2557,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1352,"receive":1205,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"tottattoo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tottattoo.com/upload/vod/089-tv.webp","fqdn":"tottattoo.com","domain":"tottattoo.com","tld":"com"},"ip":{"addr":"38.4.92.231","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://tottattoo.com/","date":"2026-10-06T22:52:44.469Z","timestamp":1791327164469,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tottattoo.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 08:58:57 GMT","end":"Sun, 29 Nov 2026 08:58:56 GMT"},"fingerprint":{"sha1":"EA:16:90:60:CB:70:43:CE:D0:76:19:B0:77:E6:45:C3:DD:39:3F:02","sha256":"BD:1B:EF:4C:56:82:2A:DE:B6:B5:88:7F:3E:D0:50:1E:E5:CB:0B:95:75:26:0B:E4:2A:C1:80:96:D2:21:28:0B"}}},"request":{"raw":"GET /upload/vod/089-tv.webp HTTP/1.1\r\nHost: tottattoo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tottattoo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 22:52:44 GMT\r\ncontent-type: image/webp\r\ncontent-length: 37798\r\nlast-modified: Wed, 03 Jun 2026 14:07:36 GMT\r\netag: \"6a203528-93a6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37798,"size_decoded":38238,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 300x426, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"010590b05a613ddb3e284f1b27f0a8b1","sha1":"608dd5ed7f23ebf5c1d0a0863b10826d07cabb62","sha256":"5a07a304652ef0c8af3578f97bab4cbce0c7eb226f0af5d46ccb759ba6473b58","sha512":"2faa37bdc49dc07116e385bae3b39668e0ce99f508f0c8b2bd692e7435bf52e463ec25a16c8fd376797c2413edd63f10f4de437067d79f3ecaf2a16684ecdb88","ssdeep":"768:TVycW69s8uewWNAuA8M+Qe7cIE2nDGiuy6atPFPtcW:wcX9q/WNAuA8oaDGYHWW","tlshash":"0a03f13907dbc5ffbe80ca17c2e70670ac8446bd66cd2a4395167ca4baadb1241161be","first_seen":"2026-08-18T23:54:11.468992Z","last_seen":"2026-10-06T22:53:26.067826Z","times_seen":3,"resource_available":false,"data":null}},"time_used":2857,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1351,"receive":1506,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"tottattoo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tottattoo.com/upload/vod/016-tv.webp","fqdn":"tottattoo.com","domain":"tottattoo.com","tld":"com"},"ip":{"addr":"38.4.92.231","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://tottattoo.com/","date":"2026-10-06T22:52:44.471Z","timestamp":1791327164471,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tottattoo.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 08:58:57 GMT","end":"Sun, 29 Nov 2026 08:58:56 GMT"},"fingerprint":{"sha1":"EA:16:90:60:CB:70:43:CE:D0:76:19:B0:77:E6:45:C3:DD:39:3F:02","sha256":"BD:1B:EF:4C:56:82:2A:DE:B6:B5:88:7F:3E:D0:50:1E:E5:CB:0B:95:75:26:0B:E4:2A:C1:80:96:D2:21:28:0B"}}},"request":{"raw":"GET /upload/vod/016-tv.webp HTTP/1.1\r\nHost: tottattoo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tottattoo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 22:52:44 GMT\r\ncontent-type: image/webp\r\ncontent-length: 28812\r\nlast-modified: Wed, 03 Jun 2026 14:06:02 GMT\r\netag: \"6a2034ca-708c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28812,"size_decoded":29252,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 272x361, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f28e4bcd63e9cc245117d7292a4e2e5b","sha1":"058442fc67cc40ddbc52dccc3dbea779578b1991","sha256":"9e1fcaa1449267ba7eee100033f749f5869e93614b46c9ac3d6f9e098033dd65","sha512":"5446be1067a43046c347a81be1c1bdd5ff2d3e7e8fff2537bffedaa551ed1c7e27276f9213342da4bceb4b738a13b4563b2826e57e032d2c2be735ae755b0df2","ssdeep":"768:aIdTJXtQRNhDyiakf+NlJ53aOUAsoMx8KlAAHQcaj+/7cC49:FmDvfSlJBZsoxKlHmjEcx","tlshash":"e8d2e1b8daa338f98072181147889791fcbada1004dff165adcd172a1e84d9ffc8799d","first_seen":"2026-06-10T09:53:28.519176Z","last_seen":"2026-10-06T22:53:26.080334Z","times_seen":5,"resource_available":false,"data":null}},"time_used":3090,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1349,"receive":1741,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"tottattoo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"tottattoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}