{"report_id":"c2ead891-9b58-4117-9a4c-cfae66298c29","version":0,"status":"done","tags":[],"date":"2026-09-05T04:49:35Z","url":{"schema":"http","addr":"clear-e.com/","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":0,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"final":{"url":{"schema":"http","addr":"clear-e.com/","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"title":"九州官方网站平台（中国）官方网站","dom":{"size":50017,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (6106)","md5":"e2f9fae40e1160f1df2eebe54f7c9850","sha1":"1e4a6c4555072695544442d9966ca6c1b52696b2","sha256":"1868f970cb1fa5ac87c049ba31cc94dcc6a03fe4b4845f627e478951be0a4f33","sha512":"a4e3de19f95c8ef54ce32d95de1afe2e53613295306df70444479b634ac1f65a28a786c50f7a1f5af377576e48f31de8fd2f239ed903dcb2549666ae5fc84d6c","ssdeep":"768:J88RxSYxxSYZxSYFQSuSQPT5IK934Mcp/ETqej45Gtr/v2MBRidcCvZ9Cb:J88XSY3SY/SYFQp7DWMqeGGtKMBRidcL","tlshash":"2523b59588f2a4bb416394fd5f557f68bed280a3ca1a2e01f2fd0d85af45f828c1364d","dom_hash":"domhashfba14eefdf243ed339fe6dc5846a4b61","first_seen":"2026-09-05T04:49:44.935922Z","last_seen":"2026-09-05T04:49:44.935922Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"clear-e.com/","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":0,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-10T04:49:35Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"clear-e.com","ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":51,"request_count":51,"received_data":2477180,"sent_data":22802,"comment":"","tags":null,"fingerprints":[{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft ASP.NET","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}]},{"fqdn":"www.ptfafa.com","ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"domain_registered":"2023-11-25","domain_rank":0,"first_seen":"2023-12-24T17:28:39Z","last_seen":"2026-08-29T21:17:15.09029Z","alert_count":37,"request_count":37,"received_data":1974691,"sent_data":20795,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"collect-v6.51.la","ip":{"addr":"43.159.107.113","port":80,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"domain_registered":"2005-01-17","domain_rank":348646,"first_seen":"2021-03-08T16:03:54Z","last_seen":"2026-09-01T07:14:27.917405Z","alert_count":0,"request_count":3,"received_data":1041,"sent_data":1164,"comment":"","tags":null,"fingerprints":[{"name":"EdgeOne","description":"EdgeOne is an edge-service platform that delivers global content distribution, network acceleration, and integrated security protections for distributed applications.","website":"https://edgeone.ai","common_platform_enumeration":"","icon":"EdgeOne.svg","categories":["CDN"]}]},{"fqdn":"sdk.51.la","ip":{"addr":"112.46.240.47","port":80,"asn":9808,"as":"China Mobile Communications Group Co., Ltd.","country":"China","country_code":"CN"},"domain_registered":"2005-01-17","domain_rank":347679,"first_seen":"2021-03-08T16:03:51Z","last_seen":"2026-09-01T18:28:25.06294Z","alert_count":0,"request_count":3,"received_data":109647,"sent_data":999,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"http","addr":"clear-e.com/","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"introduction_type":"scriptElement","is_inline":false,"md5":"87c8f1138e0799c284516c7ba4d7a003","sha1":"83c23e46661a8e070027cf0efe7146bab5765442","sha256":"8d97c7fbc85322a8c9184a80cb90466a32384f5ea5dd16f266bdd2865837a32b","sha512":"25aa5a54906984490aff124ed5288182b626b865dce6de82d3f9becf25c5de82ebdc4c12fa62096f850a596311d707791c630e1729168fa5d07f62591fdd312d","ssdeep":"","tlshash":"21f097af9c41a1989ac338a8abafd648d1ae0028500ac843a6e5c4cd3c38fd9183134c","size":497,"data":"","first_seen":"2026-06-28T04:17:32.433392Z","last_seen":"2026-09-05T04:49:45.010327Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"112.46.240.47","port":80,"asn":9808,"as":"China Mobile Communications Group Co., Ltd.","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"b8a41c9449b73e8ba0224c6be1f0b7e8","sha1":"33d79319d4110bcf5c44c36f7dd4a291972ac546","sha256":"52079c09a7355f4ce3af750602ebb9aebae8238583601f8a06268eecccf13565","sha512":"472d0395a65a3ade2d215559b196a88ffcdacde3ac0f573eb8663b524f201d72c9339bcacbc198d82452a0ac367c0efd407b12795943cdd2755d95a8cf71b977","ssdeep":"768:swetbD3SkE+a/l1jaKUiQU5eqEh9GMXBOXAA/EXBeJMlbJfuPT:BetbD3SVT/3+KUc5eqEh9GMXBYEXBeJ7","tlshash":"dbf23d9577c0317cc3c783ea362b501ae1a69e910059a8bcf345f6907d34e56a37fba8","size":36114,"data":"","first_seen":"2025-03-10T03:40:31.536734Z","last_seen":"2026-09-05T05:59:13.983489Z","times_seen":99179,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/js/cslink.js?v=0.42477986199661855","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"c63e6a41d6ebb12e197f86a4e498b05a","sha1":"0a5087487d8195b0842095a9d67c1ae3f6b48b33","sha256":"31d72b1ef3bad8353d3a0a7e46264395de7418a93bafc8a8bd5f6d4305b6bc4f","sha512":"7148ca0637dd7b65f9e31c4d48d683c16fc787915c2d1a0466f6d20e7f16abd421a44b54303202afbf93c83215ff252cfe08d62197ebfe3caa8cef9f5529b890","ssdeep":"96:1WIllB2vccKjKkD8ZR/kZy3f8k6O7V0/g7rgj:1WIvB2vcBjKa8//zEk6O7V0/g7rgj","tlshash":"97c1a05b81d41c8506aa21346aaf312db0ffb26de95cce4e9dd1a3e02e35137f9052bd","size":5970,"data":"","first_seen":"2026-09-05T04:49:44.966253Z","last_seen":"2026-09-05T04:49:44.966253Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/ky.html","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"5a14e10a404661762fe3e5d3951ac8d5","sha1":"e4c26c384c63c218380b7522e4237230b120c599","sha256":"52744c343690e4d765f11075bbb80ca31e96f437b563ea57aaf61a6cd69d6173","sha512":"078fcd948807c7d348ce3fb50c5b853d6d45fefc619167447fc8decb8de889dccce6f0df2779e9ab4b9339e9909c009597932d1e6e25d973a447705c0383ec48","ssdeep":"","tlshash":"06c08c017dc7cd28804042e28864e10890a8f52be602ad04b6ee40405f82b480800920","size":152,"data":"","first_seen":"2026-05-25T19:40:09.172559Z","last_seen":"2026-09-05T06:16:43.762389Z","times_seen":422,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/ky.html","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"cfa7ec5c5ecb40a09faa825a36559b73","sha1":"17f9abea157b50e013b48f8af8b4c72f6cf59081","sha256":"b0b2d46568b3a2edc2cf9a7c062693fade8bcb07bf4f29a4cf8a5bb7e4f94962","sha512":"53c51099107a73aca4b6980504f73ef4d92095de65931caf531228d6ec557bdd11a2c62e629e37a3fb08fefdb37f8ec181a0174b4618be3aea890e48dceb5e4c","ssdeep":"","tlshash":"a7016d4a25a2b55312bb35791b9f605079242443c08acf12bdace6c54f449bc927aa6f","size":684,"data":"","first_seen":"2026-05-25T23:00:17.242385Z","last_seen":"2026-09-05T06:16:43.763176Z","times_seen":177,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/ky.html","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"5d961723476165edd8c10d0627906057","sha1":"e305b57c19a02e778a633faccc8c911d714149bc","sha256":"ca63f6fefe0872f3b91eb5e2d7267a716d9926a7840281760c7521a85148cfd2","sha512":"8279655659bd2ae4aa85a3c701cab2e3d1d71e3d8b26a38eb12df1c36d1accd4b2c3a6d8f2181db1c71e113888171390d072952428d9865ffa970ae28fdedd6c","ssdeep":"","tlshash":"a35135ee24564cba0f57648873b0164464a12b6163b2dfdff9061d57b205cf98312def","size":2972,"data":"","first_seen":"2026-05-25T23:00:17.244305Z","last_seen":"2026-09-05T06:16:43.763807Z","times_seen":298,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"introduction_type":"eval","is_inline":false,"md5":"5543c3609a03ac71f45a7ad33a13991f","sha1":"29bc236d9b2021d5f945ac1c51816df497ae8a2e","sha256":"94dc710cfec46ffa56d100105266606aece94d87393c70c76d53cf0bcd518c75","sha512":"893b168f2ba5c1e65f6f06485d5131e57fd2585a0baa5f7e5e7c5da88a3292fbda84edd7eba98d731e9590606b3c366e2f6df49630043790c9089d952c984c10","ssdeep":"","tlshash":"b9b0926a3f09c05c290148c5e9b1ee38e1aab8748940ec9cc08a58782086b885e01610","size":121,"data":"","first_seen":"2023-12-24T18:29:11Z","last_seen":"2026-09-05T04:49:45.012271Z","times_seen":256,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/js/ky3.js","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"f6130eaf56d01aa0757bbe39f39708e9","sha1":"305a8595e44f0a33a240cb5966f6ecb9a7069db1","sha256":"1e2fa1ea7c81f664d1ff4065d5c91691064463185af24a3325235812919a78b0","sha512":"08de57d8998ca7aca8e0aec1f6a09718a59b884063b5cdd0555ee1b28c32e8e007f1b567d74e14b652119404316c262bc7c476fa85375b1f4e1109714e292cca","ssdeep":"","tlshash":"123144d4abd27d2d033153346c36da54d6ba8831ed079d40785ffd909fa45a80eaacec","size":1765,"data":"","first_seen":"2025-10-03T10:01:51.278664Z","last_seen":"2026-09-05T04:49:44.948666Z","times_seen":200,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"introduction_type":"scriptElement","is_inline":false,"md5":"f3c4aa050b2fbe607f4136e41f69bb19","sha1":"0d649d69cc000aa37f56194d3acfaf2f828c852c","sha256":"b25414f4a671a4e55ad375c2504262599061e43275da00ce8b4f01750fe35543","sha512":"f8b99aa92fd4448861d7623183f2f48544f9a937b2a86630cd357c8260b0a3b61424a324fc10dc3f602b1ae43fca5c8287f3bd27ff07d6ac155e9a5573016f91","ssdeep":"","tlshash":"c2f097ae9c52a1585ec335aca7afda48d0ae0026900ae827a4d9c4ce3c38fc8542534c","size":497,"data":"","first_seen":"2025-06-18T09:45:52.654755Z","last_seen":"2026-09-05T04:49:45.012775Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"introduction_type":"scriptElement","is_inline":true,"md5":"2d313be4b5d93e9b681de954aaeb3006","sha1":"1e0508be1026244daf1812f988033612c3945bdb","sha256":"9059d0d74efaf0e229d59a9c05ace7b975b42ccacea21e01aa64c56b2157048c","sha512":"83b5d773d5184b8feefc9c7fa2637098ad1c9ca5839ac5dd68f59372c7b4329b8298f1236c8d9247b3b2fd6afc159b9dc8cabbd6a8bbe8e5e2707dd6a7fbc82b","ssdeep":"","tlshash":"b99002c9f196a475e2b96030551b9205a0164c4d8c3c415c6100347e381559a8857679","size":57,"data":"","first_seen":"2023-03-07T01:19:11Z","last_seen":"2026-09-05T05:35:22.14502Z","times_seen":12359,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"introduction_type":"scriptElement","is_inline":true,"md5":"428ca2e7a6ff46592f25b62169aa8866","sha1":"0f21182d47468826f9b79e4766a76a1f81b7ebf1","sha256":"e9433e2f89d1fbf5d124ccee5b6b82d035073709bfb0ac7f95a94190f2473a72","sha512":"9df6e2bd230622081c6ad48f8f0e1b5f95f7f13334ba865e5cd78c67136ebbbb4101be2b28c99b3d2c94e795887bf55bb8e3358eebf2f21c7ca64df164078b1a","ssdeep":"","tlshash":"e951328d6ae726249517786f0b1f5048b8b889071d0ddd02bc8ce660ef2283994e6adc","size":2443,"data":"","first_seen":"2026-06-12T05:44:54.828675Z","last_seen":"2026-09-05T04:49:45.01384Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"introduction_type":"scriptElement","is_inline":true,"md5":"8a4a375a894ccd3993adeddf41939d88","sha1":"599b9894792c47ead4dca1c7ed1887ea3a4581bc","sha256":"a55a60d64e858567cebe16bf88a4effc853be47841293fbf198382f27d579660","sha512":"ff563ac370b712684e26f518096bff905903d9f1943aa42b53ad65097da4fa025569a55248a8936409a9cc983d662601af6d4b84da28fbd3c90cbd985c871f9b","ssdeep":"","tlshash":"6611aace925402ac56a311585ebb35dce17c4a3bcd546991f832809536f463b43a3ed4","size":1057,"data":"","first_seen":"2026-06-07T04:47:05.330322Z","last_seen":"2026-09-05T04:49:45.014832Z","times_seen":101,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/js/jquery.min.js","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"ed5d820aae73fcec34ea7157cfddddfc","sha1":"42febe5a54f6950910af22d5dad70d9f768b1621","sha256":"00b4b7ac4936e9decea689135a6d4a534a03879b8f48dc14530281b08ea09b6d","sha512":"b6391a0fed92f2c5f37817b7bbb06591044ab10285b10de03e15b961fce9b0334f9f0697ce0eed567a7c996304324eff8e1d8e2e723f8802753483c3cd518ff0","ssdeep":"1536:KxZLrMgzv9HXprbJGLz6sUdj4HR64F7omep/11E97fHWhZPMu0X8+2Hzd0elLTfJ:oFj4MOMt11UHUPu2HzdD0xzqXR","tlshash":"b9f31d8a6ae32031a227b07d4f5fd809b535985f1e88fd103e4c52a59f1c83c57baf99","size":157860,"data":"","first_seen":"2024-05-10T11:06:42Z","last_seen":"2026-09-05T06:16:43.744089Z","times_seen":3452,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/ky.html","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"Function","is_inline":false,"md5":"26421ac860f4dba7f27811712a149502","sha1":"aaf37d59cb4b28ac48ecefa82a2824a8e6210d5b","sha256":"266f482d6e5dd0302fca1871e22db5996e068d1188d1ba9cd96b892552fbcab3","sha512":"919156d81b248a368b0559741a8e0ce24a14178806923d1c1e783b25c3e61815727c3b81cf21e8f4ccd6c29c49f43e8a4d3cfe5bf386b43b01913f328d864e4d","ssdeep":"","tlshash":"6e9004d730c350345f53135404571cc5513cc470144c4d44c0c0d4517cd50345115c5c","size":39,"data":"","first_seen":"2023-04-12T04:16:13Z","last_seen":"2026-09-05T04:49:45.015301Z","times_seen":20562,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/httpclient-v3.js","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"introduction_type":"scriptElement","is_inline":false,"md5":"6c1144cdc5057ab4c75e26a4bbcb85fb","sha1":"040513249b19dec596c06f24a768c7de46b31067","sha256":"0a903d6516ef598193442645d654e8aa38fd39718fee3b3e47b6ef1e4506ea4d","sha512":"b92441633aea590c73fb1633de252f4ff0de477166fdef74d94e7aba8a62c20323fe33b2549b57bd25cefca894871b522d17baeae6064e1236e77b81edb8f7ac","ssdeep":"","tlshash":"ea51331fbc55d56457a119352e7bde8cf4be0074401dd40694efd4adac24ff5092674c","size":2861,"data":"","first_seen":"2026-06-30T22:32:35.151074Z","last_seen":"2026-09-05T04:49:44.964797Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"introduction_type":"scriptElement","is_inline":false,"md5":"972cc838b421dccd239c1761fd311f01","sha1":"bb524caa78e74737422fce1f03754fff813aa8a5","sha256":"e171880694ed3d62cf39669d7c496feb36014633bf5ee96d5343f9f1f6fd4b28","sha512":"fa1f15ea3c5d586c20d4d5fa1bf994738d0e7995d01cb3c9922e0897b03a4e92de3b2acd3f2e4f0e3a2f507de6a6275e2520e4ee7a7ed2fbc2e08674b07b1405","ssdeep":"","tlshash":"73f097be9c41a1989ad328bcabefd749d0ae0426900ed853a4d5c8cd7d38fc9043134c","size":497,"data":"","first_seen":"2025-03-05T06:29:13.242117Z","last_seen":"2026-09-05T04:49:45.015648Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"693","filename":"https://www.ptfafa.com/js/ky3.js","line_number":32,"column_number":9}]},"http":[{"url":{"schema":"http","addr":"clear-e.com/pics/build.png","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.268Z","timestamp":1788583747268,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /pics/build.png HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/png\r\nETag: \"8decc589f0681c7\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:09 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":51872,"size_decoded":52064,"mime_type":"image/png","magic":"PNG image data, 230 x 230, 8-bit/color RGBA, non-interlaced","md5":"227864d62b3504ef5232f8d4e08a57cd","sha1":"bbaf7e2e41e1dfc09e607961d924d41d14e108d5","sha256":"f8197b045bf0a7746d57e3435dcfa6822f1ec9f3ad71223eb1448e9f920dfbaa","sha512":"96bda5c24edda18a07e449e2d1257255fe29f3ad8bc78b861c2778c509b8a2f70d94781f38a44c96a23cb9ccae1a550c034d4b67b269ca53e62dc25a4e48af5d","ssdeep":"1536:5AUlowCkzB/eh36wEmwaTIL0Ys9/2GEef/uE58CHiLDa:nNWt6wE4j355EK/u+nCLu","tlshash":"dd3302cebf610b330052c6383a6aef46ef6b69d05bfaec1c914b6246eb045974972744","first_seen":"2026-06-12T05:44:54.748491Z","last_seen":"2026-09-05T04:49:44.937365Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2557,"timings":{"blocked":2049,"dns":0,"connect":0,"send":0,"wait":240,"receive":268,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/image/milanlogo.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:12.565Z","timestamp":1788583752565,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/image/milanlogo.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 261865\r\nLast-Modified: Thu, 03 Sep 2026 08:54:28 GMT\r\nConnection: keep-alive\r\nETag: \"6a9935c4-3fee9\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":261865,"size_decoded":262101,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced","md5":"653170f130c48a691b70d23562e4c087","sha1":"1c9835581e97e86500c4b07060cec2379c8ce592","sha256":"e57fe10de66383e647ee13491a9361417b4493ee1150c95794eb8972b27f5741","sha512":"e6a4873138540ced22996ef709b8bb8c273d254576c293646d04c42e4f4af2dda214d14817be2fc5212647ac7092cfba4715e4b86e68d278f99589b8adc5e9da","ssdeep":"6144:xVrxb4rxy9UbRsIDaXafcBhoFwBlKwSvdsptcE:nxb4Ny9WG4fPwmE/","tlshash":"1b4412933828dd84f2d5e031ba641fc8ee552b10b43d71c8db9eab50744a8fe5f86e64","first_seen":"2025-12-19T00:49:12.430387Z","last_seen":"2026-09-05T06:16:43.748268Z","times_seen":20,"resource_available":false,"data":null}},"time_used":4296,"timings":{"blocked":1727,"dns":0,"connect":0,"send":0,"wait":222,"receive":2347,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/image/htylogo.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:12.567Z","timestamp":1788583752567,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/image/htylogo.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 9364\r\nLast-Modified: Thu, 03 Sep 2026 08:58:41 GMT\r\nConnection: keep-alive\r\nETag: \"6a9936c1-2494\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9364,"size_decoded":9597,"mime_type":"image/png","magic":"PNG image data, 443 x 200, 8-bit colormap, non-interlaced","md5":"940657198c47298a61944bd9c93f7b29","sha1":"44a26eacc507f7ae6a02879e18b231eb4b110587","sha256":"a49787a14b6e4290a6c785704651e3f36976ebef00aa2c492e970a23983f651d","sha512":"aa7c761fec656ce507c083c952423b80c75f632a4b9a440928416212bb5602c7ee6ec4fed48b85bc40c56ea188c0c4658c152ae11bb2c4779d82d662ec591b6e","ssdeep":"192:eddDxM//qac1TSnMqYKFmttqRanPJJcnpaVlX/rW5ivcSF9+lu/:enxM//qXdNKkttwaBCnpoX/WEcc9+lu/","tlshash":"0912ae5f104ac17c09ec20a356a519c62b7c5ffac60bb2068a9d347e6338cb4e344fda","first_seen":"2024-08-19T20:37:01.61435Z","last_seen":"2026-09-05T06:16:43.730738Z","times_seen":136,"resource_available":false,"data":null}},"time_used":2771,"timings":{"blocked":1741,"dns":0,"connect":0,"send":0,"wait":1030,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/font/montserrat-regular.949efd65.ttf","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:12.600Z","timestamp":1788583752600,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/font/montserrat-regular.949efd65.ttf HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:13 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T04:49:44.940618Z","times_seen":1335,"resource_available":false,"data":null}},"time_used":818,"timings":{"blocked":595,"dns":0,"connect":0,"send":0,"wait":223,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"collect-v6.51.la/v6/collect?dt=4","fqdn":"collect-v6.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"43.159.107.113","port":80,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:11.440Z","timestamp":1788583751440,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /v6/collect?dt=4 HTTP/1.1\r\nHost: collect-v6.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 341\r\nOrigin: http://clear-e.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":499,"data":"\u001f‹\b\u0000GŸ›j\u0000\u0003‘ÏJ\u00031\u0010Æ_¥ìQŒM²ÉnÒ«—Jñ¢\bâ-›UºÝ-ÝÝö ‚ÇŠàŸ‹(U¯\u001eD\u0011\u0014t¥}\u001a›öØW°I+ˆÇކï7ó1ó͑ӡëIs#t*¥8¢Õ’shjÇ­*³–\u0026Qm«\u001eïUw\u0019ig3‚|Æ(s}ŠˆëÎÄ̈Ψ¸×\u001f\u000fúåf|]L†W“§[]¼é‹×é 7ú|Öýátpú—\u001a»FwÙÉ0]fR÷úúñlôuŽ!ôtñŽðø®÷}r‰¡ñLçw#\u0015r,\u0005\u0006P†\u0014PO\nÀ!\u0011\u0000K¥\u003cÄDàSÏ´ËÜt\u001fdY«R.ËH‰6Pk2i–\rlYh#‹¬)fp\u0005ALŒ\u0014‰¸nD\u0015ƒmke\u0013ÌãFœtí\u0026\u001d³\t2Dý\u0016FÁÄ@›74!´\u0017EÞIå¢/Ÿ\u001fA\u0010¢\u001c2\u0005\u0014\t|@!\u000e\u0000s%\u0002\u003cà˜³@\u0010îÛUòýÿ\u001fõŽ\u0000¿\u0015\tš\u0012\u0002\u0000\u0000"}},"response":{"raw":"HTTP/1.1 200 OK\r\nVary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nAccess-Control-Allow-Origin: http://clear-e.com\r\nAccess-Control-Allow-Credentials: true\r\nServer: TencentEdgeOne\r\nContent-Length: 0\r\nConnection: keep-alive\r\nDate: Sat, 05 Sep 2026 04:49:11 GMT\r\nEO-LOG-UUID: 14136967654986105621\r\nEO-Cache-Status: MISS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"EdgeOne","description":"EdgeOne is an edge-service platform that delivers global content distribution, network acceleration, and integrated security protections for distributed applications.","website":"https://edgeone.ai","common_platform_enumeration":"","icon":"EdgeOne.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":1076,"mime_type":"text/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T05:58:36.054699Z","times_seen":18287339,"resource_available":true,"data":null}},"time_used":310,"timings":{"blocked":0,"dns":21,"connect":19,"send":0,"wait":269,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"collect-v6.51.la/v6/collect?dt=4","fqdn":"collect-v6.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"43.159.107.113","port":80,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:11.676Z","timestamp":1788583751676,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /v6/collect?dt=4 HTTP/1.1\r\nHost: collect-v6.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 342\r\nOrigin: http://clear-e.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":505,"data":"\u001f‹\b\u0000GŸ›j\u0000\u0003‘ÏJÃ@\u0010Æ_¥ä(®Ýd7I¯z±\u0007\u0005ŊÇ$›ª4MJ›4\u0007\u0011\u003cV\u0004ÿ\\D©zõ Š  ‘öiì¶Ç¾‚™´‚xìíãûÍÌÎ|{¤uùjÔ\\—Z¥\u0014\u0026A°\\Ò\u000eQkzuk-J77jÞÞnZ«\u0006ZNÚqN˜iYÜÒM΄Is3FS\u001be÷êãA½ÜŒ¯³Éðjòt«²7uñ:\u001dôFŸÏª?œ\u000eNÿR\u001c×H\u0017픝E:U¯¯\u001eÏF_ç@©PÙ;ƒñ]ïûä\u0012(ÎìÌî®3jºT\u001aD\bÝ Üvtâ\u0018\u001c\b\u0005¨siKð…Är/Áêƒ8nUÊe/ð6ñW¼¨YFØ*`\u0011Y€ŠE—\u0018\u0005\u0003­À\t÷ÑôC²³]Œ*\u0012LÂF\u0018¥Å\u0026]܄!ñ\u0005:` ,òÆàe{.’nǛ×%³#\\ÝtÁ19\u0011ԕ„\u0003“Äö„KtÁ}fHC¸`ãKIýÿÂñ\u000fŒ\u00009á\u0012\u0002\u0000\u0000"}},"response":{"raw":"HTTP/1.1 200 OK\r\nVary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nAccess-Control-Allow-Origin: http://clear-e.com\r\nAccess-Control-Allow-Credentials: true\r\nServer: TencentEdgeOne\r\nContent-Length: 0\r\nConnection: keep-alive\r\nDate: Sat, 05 Sep 2026 04:49:11 GMT\r\nEO-LOG-UUID: 16861434682629293704\r\nEO-Cache-Status: MISS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"EdgeOne","description":"EdgeOne is an edge-service platform that delivers global content distribution, network acceleration, and integrated security protections for distributed applications.","website":"https://edgeone.ai","common_platform_enumeration":"","icon":"EdgeOne.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":1077,"mime_type":"text/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T05:58:36.054699Z","times_seen":18287339,"resource_available":true,"data":null}},"time_used":386,"timings":{"blocked":0,"dns":0,"connect":20,"send":0,"wait":366,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/font/iconfont.e7187704.woff2","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:13.983Z","timestamp":1788583753983,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/font/iconfont.e7187704.woff2 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:14 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T04:49:44.940618Z","times_seen":1335,"resource_available":false,"data":null}},"time_used":313,"timings":{"blocked":92,"dns":0,"connect":0,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/UploadFiles/%E9%A9%AC%E7%89%8C%E6%B0%B4%E5%8F%A3%E9%92%B3.JPG","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.281Z","timestamp":1788583747281,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /UploadFiles/%E9%A9%AC%E7%89%8C%E6%B0%B4%E5%8F%A3%E9%92%B3.JPG HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589fc079a1\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:11 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":46131,"size_decoded":46324,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=16, height=3456, bps=206, PhotometricInterpretation=RGB, manufacturer=Canon, model=Canon EOS 1300D, orientation=upper-left, width=5184], progressive, precision 8, 311x225, components 3","md5":"b669072e70cba92b3299c8b44587ffe8","sha1":"232b84b6d468de27001679733bc0a5a65855f497","sha256":"0890bfbf34ef46ff88d0b2af0a466b613121f0ad6c93321bea3189457181046c","sha512":"a409a61ce51e27b8688f387eec56828285be6034a4597f7c3d4f6e0e2b5bd7f4e069461ab06bb4ca656983ec651358f6e474eca760a032be73f9d1a4c0366d66","ssdeep":"768:YjYyWxxrP2YyWxx0WBIQdYyv1dHkQwv3VlTScBjN22vfwjvyLcj:YjyLKyL0EIQdpmbVL9vfwrMy","tlshash":"7e23cf34ff954f23f9e0e33459f4c786a363363997632246741ca5163ba61c19e8c29a","first_seen":"2026-06-12T05:44:54.710446Z","last_seen":"2026-09-05T04:49:44.941761Z","times_seen":2,"resource_available":false,"data":null}},"time_used":4467,"timings":{"blocked":3935,"dns":0,"connect":0,"send":0,"wait":265,"receive":267,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/css/main.css","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:10.351Z","timestamp":1788583750351,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/css/main.css HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/ky.html\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:11 GMT\r\nContent-Type: text/css\r\nLast-Modified: Tue, 01 Sep 2026 07:29:11 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a967ec7-19b65\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":105317,"size_decoded":54231,"mime_type":"text/css","magic":"ASCII text, with very long lines (20820)","md5":"acb789f7a4174695a05ef76bde633311","sha1":"0efd13230e3d9b2fcc114c3b77bba0f15439dc75","sha256":"e07dd1ce15ead2b8b7effd544a94981423cf486608e6cd3e097fa972c5354561","sha512":"ba0508c6871220e6d59f761520933cc0129485a4fa41e2c099071e2602a456b9946dd5b0ff23a8c0df33c03a09ae5614402208d206cdb638c8c9d66d807c3a2b","ssdeep":"1536:TZyed1/Pbyez/S0sGvVHlaLE4STizU0X4qrriMnWf9Z1l41u:NVpzPbfaLE38pS71","tlshash":"95a35c6126f27415b12f89bf71df7b183b3c80434809f9197ef859acef893a541a2b45","first_seen":"2026-09-05T04:49:44.942887Z","last_seen":"2026-09-05T04:49:44.942887Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1362,"timings":{"blocked":-1,"dns":0,"connect":232,"send":0,"wait":228,"receive":443,"ssl":458},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/picture/rbsmgwmigyqad1n-aaa_2muwpem57.webp","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:10.357Z","timestamp":1788583750357,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/picture/rbsmgwmigyqad1n-aaa_2muwpem57.webp HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/ky.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:13 GMT\r\nContent-Type: image/webp\r\nContent-Length: 16344\r\nLast-Modified: Mon, 25 Dec 2023 15:21:01 GMT\r\nConnection: keep-alive\r\nETag: \"65899ddd-3fd8\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16344,"size_decoded":16579,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"be49e8277eb92cafb253fa49edb79022","sha1":"5cc65c308aa4f315b27936fc4647b37f58efdeae","sha256":"1b8cb8ad18ad2b3e0738be463ac16ec39c2bab4d56afe06cfcc5b0fa59c45391","sha512":"bfcca34c67fd47b4119ba484b0d670d5be6ef1b07d3029ea97330338252045ebec536cf90ca48ec649cd50afc4428f412237137b9d4261214715873eedaf8093","ssdeep":"384:CVlYgoa1xatkPb5WHRKY+z3eppmsOfwH/s6j:IYg575E4Y+Hj4H/s6j","tlshash":"df72cf0b455b902138cd7a9311463a50538fde107f8ab4fd6e63baa551281931fb733e","first_seen":"2023-05-18T07:54:03Z","last_seen":"2026-09-05T06:16:43.759993Z","times_seen":3591,"resource_available":false,"data":null}},"time_used":3167,"timings":{"blocked":1701,"dns":0,"connect":225,"send":0,"wait":463,"receive":0,"ssl":778},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/image/xingkonglogo.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:12.568Z","timestamp":1788583752568,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/image/xingkonglogo.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 223768\r\nLast-Modified: Thu, 03 Sep 2026 08:57:01 GMT\r\nConnection: keep-alive\r\nETag: \"6a99365d-36a18\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":223768,"size_decoded":224004,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced","md5":"edd9be4994e7d947ac7a97beed79d344","sha1":"0842ce3ecd6d7ef707f9905070eabcd767d2c186","sha256":"7126721e848b63c0ab1b306c33cf5876cd20f1cce6afd280f20ab5a58b3af2b2","sha512":"933946932099af2518c55b52166b70df4f4bbe25714438c4a8c4e9e1349e55baf582ab794036b89cb3c41835eadeb081efafa44500a1c0b6a422f63f4a21aa97","ssdeep":"3072:sF38TGkMvaq5tdTktJHXbylZ+r94B4E3F5Z9MIjU37NHPiMqB7OGrRA3JrGOMyai:sIcbdIL3biVrg5viMqBZAZqhyaOxR","tlshash":"8624128b1011ff5ae3c47d7513650174ea86e0b5b0920b7aa7bfc67fc86a4bf08956c1","first_seen":"2025-12-19T00:49:12.438961Z","last_seen":"2026-09-05T06:16:43.744654Z","times_seen":21,"resource_available":false,"data":null}},"time_used":8554,"timings":{"blocked":1752,"dns":0,"connect":0,"send":0,"wait":641,"receive":6161,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/favicon.ico","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:12.328Z","timestamp":1788583752328,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nCookie: __vtins__3He6gkvYRqxh6SLX=%7B%22sid%22%3A%20%22e05f8676-1cb1-5bc5-8fba-f7020cb74f39%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201788585551419%2C%20%22ct%22%3A%201788583751419%7D; __51uvsct__3He6gkvYRqxh6SLX=1; __51vcke__3He6gkvYRqxh6SLX=d73e10bc-d05d-553c-8d02-8fa4eeeb6506; __51vuft__3He6gkvYRqxh6SLX=1788583751424; __vtins__3He7MKsolKRgnZHX=%7B%22sid%22%3A%20%221ed92ca2-0cd5-56ca-904a-2cee618ab756%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201788585551433%2C%20%22ct%22%3A%201788583751433%7D; __51uvsct__3He7MKsolKRgnZHX=1; __51vcke__3He7MKsolKRgnZHX=4115908e-e4b7-502b-83c1-9b9298ba4974; __51vuft__3He7MKsolKRgnZHX=1788583751436; __vtins__3JRDowONVcYWwVJl=%7B%22sid%22%3A%20%22f107b0d4-6634-59a3-a452-022f5d9d2e6d%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201788585551670%2C%20%22ct%22%3A%201788583751670%7D; __51uvsct__3JRDowONVcYWwVJl=1; __51vcke__3JRDowONVcYWwVJl=b37b2a75-60bd-521d-9c6b-365e14d46b29; __51vuft__3JRDowONVcYWwVJl=1788583751672\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nTransfer-Encoding: chunked\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:12 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":149,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T05:58:36.054699Z","times_seen":18287339,"resource_available":true,"data":null}},"time_used":218,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":218,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-05T04:49:06.693Z","timestamp":1788583746693,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=utf-8\r\nContent-Encoding: gzip\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:07 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Microsoft ASP.NET","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}],"data":{"size":48231,"size_decoded":11431,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5661), with CRLF, LF line terminators","md5":"84a7c014df303d3ff00347e7c0d67146","sha1":"45300d7694208b67884e40c106f750f47b623d88","sha256":"8e803ef66e81dc1010c0654ff353fecc2b5979bdac4373d9df2d51108e3f08ec","sha512":"0ea79bcd5320aaa8acdb65f95174ff63a181f39f6c93da486e85fd73ab33244de83b073320af43a6c7984b854dbba57b74b032cf79a7230a7d389677e30ad23c","ssdeep":"768:6PQWbSQPT5IK934UcNniToJco7tuHKtPmi58ctb1Y7r:6PQU7DWaoR7ttPmi58cu","tlshash":"8823726595c568bb423391fd4f557fe8fee28183860a2e00f2fe2a879fb5e418c13549","first_seen":"2026-09-05T04:49:44.945978Z","last_seen":"2026-09-05T04:49:44.945978Z","times_seen":1,"resource_available":false,"data":null}},"time_used":898,"timings":{"blocked":-1,"dns":2,"connect":223,"send":0,"wait":225,"receive":448,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/h_serverbg.png","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:10.108Z","timestamp":1788583750108,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/h_serverbg.png HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/css/base.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Encoding: gzip\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:10 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37,"size_decoded":266,"mime_type":"text/html; charset=UTF-8","magic":"Unicode text, UTF-8 text, with no line terminators","md5":"3ac76cf9a312986d5d5edf75b8074f61","sha1":"884b196cbdddd437eff7f9d33275600f971a5fc2","sha256":"8fc2c50d888591a7d78336b58fe2167cbbdd6866a2a896f3195f3fcbf4700c7c","sha512":"2722e07bceb26a26578b816174311bebd83d9962e02a29fbb064516113f5315129c16183c9d8c9153bb833f43fe873e23630514c55c3e9308f867ce021c658c9","ssdeep":"","tlshash":"b880003c208cbbc0830000b238228880a38b8c2f22e2cc3c8220c28a88300a802e2880","first_seen":"2023-11-16T09:12:53Z","last_seen":"2026-09-05T04:49:44.947077Z","times_seen":21,"resource_available":false,"data":null}},"time_used":324,"timings":{"blocked":107,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"collect-v6.51.la/v6/collect?dt=4","fqdn":"collect-v6.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"43.159.107.113","port":80,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:11.428Z","timestamp":1788583751428,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /v6/collect?dt=4 HTTP/1.1\r\nHost: collect-v6.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 342\r\nOrigin: http://clear-e.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":498,"data":"\u001f‹\b\u0000GŸ›j\u0000\u0003‘ÍJÃ@\u0014…_¥d)Ž™d’i·n\u0014\\Y\u0004]\u0026“I+MÓÚ\u0026© ‚ËŠàÏF”ª[\u0017¢\b\n\u001aiŸÆL»ì+˜;­ .»;œïÎý9sd¤l½ÝÚôj)JÂpµdìƒ6Ì\riכéÞöÁaîmí\u001a\u0005éÆ\u0005!\u000e猛\u000e#\u0016©\u0014f\f¦‘g÷êãA½ÜL®³éøjút«²7uñ:\u001b\ròÏg5\u001cÏF§)´kö—}é÷–y©\u0006Cõx–SŒm•½\u0013:¹\u001b|Ÿ\\R\f={ó»%f\u0001·\u001d\u001b\u0011á\u0011Ä\u003cÁ\u0010\u000f\u003c\u0017\u0005\u000e¦XxŽ\u0015˜\u0015(\u0017\tT7â¸S-—E(Ý.’k¢Ý*\u0003ìh¨#\u000bA\u0011Êñ\nÁÔ\u0002+t£ºž\u0014¡šn¥\u0013L¢fÔîëMR؄\u0000‘¿\u0002\u001cj\u0001Ôyc\b¡»\u0010IÚ\u0013‹ºd~„`O \u001f3\u001f1f\nÄ}L‹K\\KJéÙ\fÛ0)\tþý(µŽ\u0000œ\u0016µä\u0012\u0002\u0000\u0000"}},"response":{"raw":"HTTP/1.1 200 OK\r\nVary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nAccess-Control-Allow-Origin: http://clear-e.com\r\nAccess-Control-Allow-Credentials: true\r\nServer: TencentEdgeOne\r\nContent-Length: 0\r\nConnection: keep-alive\r\nDate: Sat, 05 Sep 2026 04:49:11 GMT\r\nEO-LOG-UUID: 15514647441870555095\r\nEO-Cache-Status: MISS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"EdgeOne","description":"EdgeOne is an edge-service platform that delivers global content distribution, network acceleration, and integrated security protections for distributed applications.","website":"https://edgeone.ai","common_platform_enumeration":"","icon":"EdgeOne.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":1077,"mime_type":"text/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T05:58:36.054699Z","times_seen":18287339,"resource_available":true,"data":null}},"time_used":335,"timings":{"blocked":0,"dns":33,"connect":20,"send":0,"wait":282,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/hover.png","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:10.114Z","timestamp":1788583750114,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/hover.png HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/css/zhenganjx.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/png\r\nETag: \"8decc58a0439ba3\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:11 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":10434,"size_decoded":10626,"mime_type":"image/png","magic":"PNG image data, 395 x 296, 8-bit/color RGBA, non-interlaced","md5":"d5fb0d09b01921d180e35dd2acf636c9","sha1":"4019e224ebcac54ad42a78879cef20da5e80d5de","sha256":"25f52604cd336878fe8d045749a739b8ec50ca10a8a4d30ca3748e6ba47773a3","sha512":"210e062090553caaace04b20f136397d444f44b6d857c6af95f95f87ab3333cb78bac330b05092a2f82b24be139ed7b717847d18f45073312de179f3fbff1c99","ssdeep":"192:/SHIIHUCD4waKbK9/3ac8HkhAfQENHjbUJ9Oe2KXM9rji6D:q50wPbK9/OHkOFBUTD2Bv","tlshash":"ad226c0ebaf081be301c357a2213ad4f8c18c74a02ad6f66fa57467fcd34e0065a7d98","first_seen":"2026-06-12T05:44:54.790717Z","last_seen":"2026-09-05T04:49:44.947649Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2105,"timings":{"blocked":1643,"dns":0,"connect":0,"send":0,"wait":238,"receive":224,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/font/iconfont.e7187704.woff2","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:13.758Z","timestamp":1788583753758,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/font/iconfont.e7187704.woff2 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:13 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T04:49:44.940618Z","times_seen":1335,"resource_available":false,"data":null}},"time_used":331,"timings":{"blocked":108,"dns":0,"connect":0,"send":0,"wait":223,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/js/ky3.js","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.696Z","timestamp":1788583747696,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /js/ky3.js HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:09 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Wed, 01 Oct 2025 11:04:54 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"68dd0ad6-6e5\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1765,"size_decoded":1183,"mime_type":"application/javascript","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"f6130eaf56d01aa0757bbe39f39708e9","sha1":"305a8595e44f0a33a240cb5966f6ecb9a7069db1","sha256":"1e2fa1ea7c81f664d1ff4065d5c91691064463185af24a3325235812919a78b0","sha512":"08de57d8998ca7aca8e0aec1f6a09718a59b884063b5cdd0555ee1b28c32e8e007f1b567d74e14b652119404316c262bc7c476fa85375b1f4e1109714e292cca","ssdeep":"","tlshash":"123144d4abd27d2d033153346c36da54d6ba8831ed079d40785ffd909fa45a80eaacec","first_seen":"2025-10-03T10:01:51.278664Z","last_seen":"2026-09-05T04:49:44.948666Z","times_seen":200,"resource_available":true,"data":null}},"time_used":2270,"timings":{"blocked":-1,"dns":96,"connect":213,"send":0,"wait":217,"receive":0,"ssl":1745},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/js/jquery.min.js","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:10.348Z","timestamp":1788583750348,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/js/jquery.min.js HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/ky.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:10 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Wed, 18 Sep 2024 07:04:28 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"66ea7b7c-268a4\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":157860,"size_decoded":44977,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"ed5d820aae73fcec34ea7157cfddddfc","sha1":"42febe5a54f6950910af22d5dad70d9f768b1621","sha256":"00b4b7ac4936e9decea689135a6d4a534a03879b8f48dc14530281b08ea09b6d","sha512":"b6391a0fed92f2c5f37817b7bbb06591044ab10285b10de03e15b961fce9b0334f9f0697ce0eed567a7c996304324eff8e1d8e2e723f8802753483c3cd518ff0","ssdeep":"1536:KxZLrMgzv9HXprbJGLz6sUdj4HR64F7omep/11E97fHWhZPMu0X8+2Hzd0elLTfJ:oFj4MOMt11UHUPu2HzdD0xzqXR","tlshash":"b9f31d8a6ae32031a227b07d4f5fd809b535985f1e88fd103e4c52a59f1c83c57baf99","first_seen":"2024-05-10T11:06:42Z","last_seen":"2026-09-05T06:16:43.744089Z","times_seen":3452,"resource_available":true,"data":null}},"time_used":1714,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":644,"receive":1070,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/font/iconfont.599951c1.woff2","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:12.604Z","timestamp":1788583752604,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/font/iconfont.599951c1.woff2 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:13 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T04:49:44.940618Z","times_seen":1335,"resource_available":false,"data":null}},"time_used":1260,"timings":{"blocked":1037,"dns":0,"connect":0,"send":0,"wait":223,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"112.46.240.47","port":80,"asn":9808,"as":"China Mobile Communications Group Co., Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:10.082Z","timestamp":1788583750082,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /js-sdk-pro.min.js HTTP/1.1\r\nHost: sdk.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 05 Sep 2026 04:49:10 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: openresty\r\nCache-Control: no-store\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Credentials: true\r\nvia: CHN-SNxianyang-CMCC6-CACHE27[43],CHN-SNxianyang-CMCC6-CACHE27[ovl,40],CHN-HElangfang-GLOBAL6-CACHE91[ovl,20]\r\nX-CCDN-REQ-ID-46B1: 7af4b1cd7af9c4645daa982677b0b569\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36115,"size_decoded":36549,"mime_type":"text/plain; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (35899)","md5":"b8a41c9449b73e8ba0224c6be1f0b7e8","sha1":"33d79319d4110bcf5c44c36f7dd4a291972ac546","sha256":"52079c09a7355f4ce3af750602ebb9aebae8238583601f8a06268eecccf13565","sha512":"472d0395a65a3ade2d215559b196a88ffcdacde3ac0f573eb8663b524f201d72c9339bcacbc198d82452a0ac367c0efd407b12795943cdd2755d95a8cf71b977","ssdeep":"768:swetbD3SkE+a/l1jaKUiQU5eqEh9GMXBOXAA/EXBeJMlbJfuPT:BetbD3SVT/3+KUc5eqEh9GMXBYEXBeJ7","tlshash":"dbf23d9577c0317cc3c783ea362b501ae1a69e910059a8bcf345f6907d34e56a37fba8","first_seen":"2025-03-10T03:40:31.536734Z","last_seen":"2026-09-05T05:59:13.983489Z","times_seen":99179,"resource_available":true,"data":null}},"time_used":1316,"timings":{"blocked":0,"dns":0,"connect":274,"send":0,"wait":516,"receive":526,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/image/zunlong.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:12.572Z","timestamp":1788583752572,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/image/zunlong.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 30411\r\nLast-Modified: Tue, 01 Sep 2026 07:23:51 GMT\r\nConnection: keep-alive\r\nETag: \"6a967d87-76cb\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":30411,"size_decoded":30645,"mime_type":"image/png","magic":"PNG image data, 362 x 142, 8-bit/color RGBA, non-interlaced","md5":"fe574209a10230d9806195b3adeead9c","sha1":"510f09112e4b4b28ee5e71a26095c2a1a28088c5","sha256":"aa2ee01bf5edd3ff4a53fa210e58e8fadf72daedead7e925ed663cbeafdeac84","sha512":"99abcb21eeb3b818265487debd982f28bef9fc3e14d7fac186ced19f25935ef07bb54584956e29924b0ee75bee27c9ae66bd5228f23bebcc87b9f08b642c1567","ssdeep":"768:Mpx02jSf8TaJ7+KhNV4U36qx5ZS5JpLG/Uu2dDYdARVaXSw:A0eC8Tad+0/FnE5JpLG/S/Pw","tlshash":"3fd2f18b7f5520838c098214fe3715ddcc6c096eb43bb1dae7185b4242bb99355eaab4","first_seen":"2026-09-02T01:42:04.22348Z","last_seen":"2026-09-05T04:49:44.95041Z","times_seen":7,"resource_available":false,"data":null}},"time_used":2601,"timings":{"blocked":2359,"dns":0,"connect":0,"send":0,"wait":236,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/UploadFiles/2018122607284849.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.271Z","timestamp":1788583747271,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /UploadFiles/2018122607284849.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589f552fb9\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:09 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":52426,"size_decoded":52619,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=12, height=800, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=600], progressive, precision 8, 400x300, components 3","md5":"22a49354db1ef681188d8da5d50e4eaa","sha1":"cb28045861438f6637bea4b074b49c40d2e594cf","sha256":"083d3c86acff74978d97ece1ab8987b8fb7bf64a1fd67650cac077b167050cf8","sha512":"05569a03673719ac7b48221e458d3ff5ff2b9480b7676d1b0bd92909cd0b756009385558c34fe7720d7a608ece87c0573631d5e192086a60c5e757dbe2af20a0","ssdeep":"768:tYyABPkYyA0U5pY7Dz3Dsd+W+9aHHuFKMxwHGNb/AzdQwmmjbfQKSN2NK2JFzjZ9:tbnU5pY7Ls7RKwHGtABQrSO4Fzb","tlshash":"ce33d03aefa8ee62f4e49230d4e2d7d69331fd5467632882344c72163ba56b30c9d196","first_seen":"2026-06-12T05:44:54.685934Z","last_seen":"2026-09-05T04:49:44.950953Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2690,"timings":{"blocked":2227,"dns":0,"connect":0,"send":0,"wait":244,"receive":219,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/UploadFiles/2019083112582362.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.276Z","timestamp":1788583747276,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /UploadFiles/2019083112582362.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589fc2dc4e\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:09 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":437762,"size_decoded":437955,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=2, orientation=upper-left], baseline, precision 8, 1080x1920, components 3","md5":"ac292e41375419e7f6eb53fc81c692cc","sha1":"d1d88d87d64492c70435e3dae942bd2aeb1412cc","sha256":"4d28cd1c172f77eab95b810340819b7af14539a302596dbf25b5c90358e05d43","sha512":"75389b6fc62d90835d3abc779174d32de1688b39068b1d9488207a27f02ebf9ef06c31b423cee2c649a95ece8a4f6e5bcc4e1a2becf7e7997aa2e00cd12cd7c5","ssdeep":"12288:AIx9GEmhRbzgUzDAarF5R1WxB5oauCH1z:TNaRbzjzDJFFuuatH1z","tlshash":"8c94232a7141155d7abbd339b1561a64c3edb0b0ef6aa0d6901302cf38fee2586f5c6c","first_seen":"2026-06-12T05:44:54.817356Z","last_seen":"2026-09-05T04:49:44.952875Z","times_seen":2,"resource_available":false,"data":null}},"time_used":4322,"timings":{"blocked":2691,"dns":0,"connect":0,"send":0,"wait":243,"receive":1388,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/homenew05.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.380Z","timestamp":1788583747380,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/homenew05.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc58a00f27b0\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:08 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":44710,"size_decoded":44903,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=12, height=132, bps=158, PhotometricInterpretation=RGB, orientation=upper-left, width=262], progressive, precision 8, 262x132, components 3","md5":"27c8eeb6630b2ee1de76f1f810b58917","sha1":"e31a8cb131da3c09e276ad584f9023d4b88139d8","sha256":"d748a3eb47864dee89fe1b90613b9bd4e9cff07add065022d3130b7ffef207b8","sha512":"00910b46370a6846bf4bfd38aac5a4a1fa0ce282e72885b8756681745e109fdd1c1dfa5154bc6f05889891fd4eae6734e56e28695a97cce83b06c43aedbb7df4","ssdeep":"768:CLYyd0wFRvPYYyd0wFRBqB5UTo+4WBQqI7aQyYOCNGMoTzmES8btjE:cHoHBqByq5qIOncGMX8xA","tlshash":"de13c029eb67cf12d8d55a3890d2e3c3b222892493b379d57c0d3a14bf782c19d8c187","first_seen":"2026-06-12T05:44:54.782417Z","last_seen":"2026-09-05T04:49:44.954456Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1666,"timings":{"blocked":767,"dns":0,"connect":0,"send":0,"wait":249,"receive":650,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"112.46.240.47","port":80,"asn":9808,"as":"China Mobile Communications Group Co., Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:10.079Z","timestamp":1788583750079,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /js-sdk-pro.min.js HTTP/1.1\r\nHost: sdk.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 05 Sep 2026 04:49:10 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: openresty\r\nCache-Control: no-store\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Credentials: true\r\nvia: CHN-SNxianyang-CMCC6-CACHE25[42],CHN-SNxianyang-CMCC6-CACHE25[ovl,41],CHN-HElangfang-GLOBAL6-CACHE55[ovl,19]\r\nX-CCDN-REQ-ID-46B1: 283ceec21a36a37a2aea206d3fbcd646\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":36115,"size_decoded":36549,"mime_type":"text/plain; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (35899)","md5":"b8a41c9449b73e8ba0224c6be1f0b7e8","sha1":"33d79319d4110bcf5c44c36f7dd4a291972ac546","sha256":"52079c09a7355f4ce3af750602ebb9aebae8238583601f8a06268eecccf13565","sha512":"472d0395a65a3ade2d215559b196a88ffcdacde3ac0f573eb8663b524f201d72c9339bcacbc198d82452a0ac367c0efd407b12795943cdd2755d95a8cf71b977","ssdeep":"768:swetbD3SkE+a/l1jaKUiQU5eqEh9GMXBOXAA/EXBeJMlbJfuPT:BetbD3SVT/3+KUc5eqEh9GMXBYEXBeJ7","tlshash":"dbf23d9577c0317cc3c783ea362b501ae1a69e910059a8bcf345f6907d34e56a37fba8","first_seen":"2025-03-10T03:40:31.536734Z","last_seen":"2026-09-05T05:59:13.983489Z","times_seen":99179,"resource_available":true,"data":null}},"time_used":1579,"timings":{"blocked":-1,"dns":2,"connect":260,"send":0,"wait":530,"receive":786,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/h_teambg.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:10.113Z","timestamp":1788583750113,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/h_teambg.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/css/base.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc58a04f8790\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:11 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":71712,"size_decoded":71905,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x550, components 3","md5":"802c1af1c8f86daa91546fff91399bd1","sha1":"7df519ccb62b3317deb42b2d18be154ed18e574b","sha256":"e9e9799f5765f2a233f511549f5e448a5d7397a7d834084ff748e18af5546043","sha512":"10bf1440981c4794a316bc738f5155bcd3307937e7804594ce505900f01392d211c8cba440dcdafb9762282ed9ab66fb7c6bc002a3da18e78e2a47615eb8a273","ssdeep":"768:Z/t6yiIJ7cpNR1WQjYmd0sdhWDXPBYmRkC8kgWx8UKCIiAQZFG/fDmVbi9ZvGOkE:pJ+NRc0H+j+jN/E8UKidiDmVbq6Q0YzB","tlshash":"77636d3b5c4b85e815cf0178b242618ae7b8e72bc1757c67bd28dee16c25a358163cce","first_seen":"2026-06-12T05:44:54.751427Z","last_seen":"2026-09-05T04:49:44.955545Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2078,"timings":{"blocked":1619,"dns":0,"connect":0,"send":0,"wait":235,"receive":224,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/picture/sj.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:10.361Z","timestamp":1788583750361,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/picture/sj.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/ky.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 18810\r\nLast-Modified: Wed, 18 Sep 2024 07:08:50 GMT\r\nConnection: keep-alive\r\nETag: \"66ea7c82-497a\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18810,"size_decoded":19044,"mime_type":"image/png","magic":"RIFF (little-endian) data, Web/P image","md5":"cdb0153d8cc3dbec5e43d569a03ab2c4","sha1":"0a7c9c3952a48a331a76089f57db3e1b618b0821","sha256":"11d707bf46d3e44e7057580208377df9b8839b00403b94495d3a9f85db23842c","sha512":"159222b548ccfbacd31fd37e9b52bdde0ff662f6b2f21b06c51a0e97022d7d8200b15ca365fb96b9063c76853ec883ebd3caf571816016639e0f953e7541238a","ssdeep":"384:a/5XGHoNGqbcToc+gL5KqF94ombm0PgVT5nlDGXIgVC28hJSb/:oXGHqPQTj+gF7oPgVTYIgU28ha/","tlshash":"9882e11861446beec0430d68fce676fbcaa059cf3a60d5251eb637237b72260abf9055","first_seen":"2023-09-17T16:12:24Z","last_seen":"2026-09-05T06:16:43.750629Z","times_seen":3693,"resource_available":false,"data":null}},"time_used":2181,"timings":{"blocked":1701,"dns":0,"connect":0,"send":0,"wait":236,"receive":244,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/pics/serve.png","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.269Z","timestamp":1788583747269,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /pics/serve.png HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/png\r\nETag: \"8decc589f2ca8af\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:09 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":27178,"size_decoded":27370,"mime_type":"image/png","magic":"PNG image data, 230 x 230, 8-bit/color RGBA, non-interlaced","md5":"a6bd4534f0b9e38b8c09fb6519b4d4b7","sha1":"c54fa79bde073af7a9e687e3f76f23c1c4ccc8ed","sha256":"f4969bd1ed9aee3a637e59a84a063f344df075ff7599f0f13cfb12e0489c7009","sha512":"13bf79455f09fbce3142013e65812148d2d7495ffc025ab3b86df7b2db53ed939d3a88321dadb22a36f24ecb34fcffab521b3c820d79534b41c981f38ab6d161","ssdeep":"768:9KGS2CGr9XySO+2+ii/JB9y37xD6+4y/fp9K9:9Kgnb3axJpW","tlshash":"99c2e1c0cc13d0f0676192ad42ee5196853e70f63ea3ef546898b90deedc2f1259a9e4","first_seen":"2026-06-12T05:44:54.77469Z","last_seen":"2026-09-05T04:49:44.95734Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2475,"timings":{"blocked":2011,"dns":0,"connect":0,"send":0,"wait":243,"receive":221,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/homenew02.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.287Z","timestamp":1788583747287,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/homenew02.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589feb6462\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:10 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":55043,"size_decoded":55236,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=12, height=132, bps=158, PhotometricInterpretation=RGB, orientation=upper-left, width=262], progressive, precision 8, 262x132, components 3","md5":"ade0d7df1c7ee000fe78f6de08486cf3","sha1":"1dc6b15335a82ad43c466dd6648a6c690705bfd1","sha256":"523b2d9ed8248e5cc73d9799d23d1bae077b9cc4018fc4bba6f5a36453cba90b","sha512":"40d7f8ad15e6bd75c08e6ec16d90606dfe533e577eeaa066e096f95181957346e42ea7e7a0801e47ef026fa65e4a13b538200048a12f4ed5aa1eb460762dd33a","ssdeep":"768:GvYycRrklPMYycRrkBqTK64+yBWp79lv3cY3zrkL4r0nazOemUIexlVSt5xqHUe+:0wRr3wRrEqTK6mK7UYS7KceTVNBquEb3","tlshash":"fd33e176af41fe33f7d0f93c8698e367624266a9932332527c0c2a2577602d36d4d187","first_seen":"2026-06-12T05:44:54.798204Z","last_seen":"2026-09-05T04:49:44.958437Z","times_seen":2,"resource_available":false,"data":null}},"time_used":3649,"timings":{"blocked":3144,"dns":0,"connect":0,"send":0,"wait":234,"receive":271,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/homenew04.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.373Z","timestamp":1788583747373,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/homenew04.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589feb6462\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:10 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":44177,"size_decoded":44370,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=12, height=132, bps=158, PhotometricInterpretation=RGB, orientation=upper-left, width=262], progressive, precision 8, 262x132, components 3","md5":"b2e6ddfc93892638b6c3307285f36f01","sha1":"b3eff4e0fe76bb4e244f38fc0262d02236e5b65c","sha256":"6a751ed87e0334afe8467e0eeee81f078d232ee7d0bb662a6de38074ee550cc9","sha512":"5703364050aa64894c59e978f76d71f605640271f17eba7560a88d4979d60f59af2759cefed45076eb7ba52cc4c1ceab00e96c064d5123da4ed678c79bd21f97","ssdeep":"768:TdYyRj/PqYyRjTq4/zjgQXU+JhcE9mlJTPoXMEfZMIFxxoWXIrh:h9u9Hq4bnXU+8emlxoXMEfZMs7oWYh","tlshash":"3013cf29ff93ce52f9e0623458f5eb4663127e5c97633b86742c34167bda2908c9c1c2","first_seen":"2026-06-12T05:44:54.697579Z","last_seen":"2026-09-05T04:49:44.959447Z","times_seen":2,"resource_available":false,"data":null}},"time_used":3824,"timings":{"blocked":3317,"dns":0,"connect":0,"send":0,"wait":243,"receive":264,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/image/sport-item-bg.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:12.573Z","timestamp":1788583752573,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/image/sport-item-bg.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 12434\r\nLast-Modified: Wed, 18 Sep 2024 07:04:18 GMT\r\nConnection: keep-alive\r\nETag: \"66ea7b72-3092\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12434,"size_decoded":12668,"mime_type":"image/png","magic":"PNG image data, 624 x 400, 2-bit colormap, non-interlaced","md5":"ac76c6c7dd993b8bba750449be70d3ea","sha1":"2c1111bcdfa2b3549c8e440c472b866553a270d8","sha256":"b909239d687e0c2dea7608a984bd4a8ad8fe589ec72079a9305f836971c9667c","sha512":"39a33c45472eb07f3d7bd89c60e91a13ad15d94ab4a965b3ff5bdc836383b7bbb5a1a3e03ffcddd14e600583f1f38adb8066347e14f88c51dcab40a8bf0de6cf","ssdeep":"192:YYjq+N9vUOkM3NQeisvtvRdy1/VsBlArzT89SaSkqxUSriFlKtq9RcIyMMwEGI6V:Y2N9vUPpeDvn8WoX8saqxULlb9gMMwVV","tlshash":"d042c0abffcb072865968497030f71a0ea0915ee98298bcd164c7b7b161c054b16caee","first_seen":"2023-09-17T16:12:24Z","last_seen":"2026-09-05T04:49:44.960723Z","times_seen":4234,"resource_available":false,"data":null}},"time_used":3578,"timings":{"blocked":2771,"dns":0,"connect":0,"send":0,"wait":807,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/homenew08.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.382Z","timestamp":1788583747382,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/homenew08.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc58a03a122d\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:08 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":49166,"size_decoded":49359,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=12, height=132, bps=158, PhotometricInterpretation=RGB, orientation=upper-left, width=262], progressive, precision 8, 262x132, components 3","md5":"2221755b84e40a22b82f65ab35887479","sha1":"3f2f72c14480765e5def085e10a8ad180e426248","sha256":"d4a6ee324d72ff1064946dd6b6aff280b5b8d38cac08ad1a930349841a65a8fa","sha512":"1e92cccab9ce3186089ac3f218b43baa036e6a4e4d381af235c402635d5692c912ba50965dd099daaa7830f95785dfdf489d8cc54348b140102156fa872d468e","ssdeep":"768:CTYyxWFPdJYyxWZqMLW7CoM7Th8TSQ8zA8QV7+UKQ90TDv3bmulc:4VSJVIqML4GThqSQ4Bbmh","tlshash":"a623bf557b935c16f8f4d73880e6cb81b3207b28cb633b03bd8d2409377b6996ea5146","first_seen":"2026-06-12T05:44:54.705589Z","last_seen":"2026-09-05T04:49:44.961314Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1909,"timings":{"blocked":1453,"dns":0,"connect":0,"send":0,"wait":236,"receive":220,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/footer_logo.png","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.383Z","timestamp":1788583747383,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/footer_logo.png HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/png\r\nETag: \"8decc58a02961a6\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:08 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5321,"size_decoded":5513,"mime_type":"image/png","magic":"PNG image data, 379 x 50, 8-bit/color RGBA, non-interlaced","md5":"dbddf9627c496ba61cd6c9eea66d6c70","sha1":"d05b6aa09fe2c54ff345a5042efcf0a11b2e1483","sha256":"850c9f6901f3dade1ee162e680ac15cc24879db6e4fe1229508b0f6794ee89d1","sha512":"a82d1b216e0bc000e74bf0e5e2181cb43da127e7c1116b2f7da643ce2635b57e7017468118d5a2d165d02988658915cf4c066bb62457bc7ac12e49a4c9a4b492","ssdeep":"96:MSP6KNN6pZlMrr9GsmXzucvoXYNx27bW1fdz1V31JwQEbtIdP8QJQntQY/5D31mT:MSJ8ZaizRoXYi3WrxJ12QEbtIdlKtQYc","tlshash":"94b1aec55e77de5cff4b1f1470e4298860bf9108d746b26200aa21ab09f32b31a33716","first_seen":"2026-06-12T05:44:54.76467Z","last_seen":"2026-09-05T04:49:44.962571Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1953,"timings":{"blocked":1456,"dns":0,"connect":0,"send":0,"wait":236,"receive":261,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/h_servericon1.png","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:10.112Z","timestamp":1788583750112,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/h_servericon1.png HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/css/zhenganjx.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/png\r\nETag: \"8decc58a045fe0c\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:10 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":19513,"size_decoded":19705,"mime_type":"image/png","magic":"PNG image data, 200 x 300, 8-bit/color RGBA, non-interlaced","md5":"9f25feed3a19fb6da2a07ca37ff33517","sha1":"04253872fa895a10f9a4be04a809d027d5dd57ba","sha256":"f7ad46e4d3faebb1912252fbd3d9a2084f5839bf16452af00fdcb7abfa6f64ce","sha512":"b8d2f0a9f0dc599f8fa5f3b3cf5f76a9936cab8a0327b8da4cf4344273bd9d08ba5408e553e819415d062168a8b23701a2ce6e27e9175cfc1467c7630157ba6b","ssdeep":"384:R50wVpWY+f2nIcXiOpyR6MG0X8dbUYPykh/8OIa:T8PaIbRw0X8dpPZZIa","tlshash":"2192d0c08500ffbf5c9946ebeecca510427da2942e561e46b144073b6e0a9705e76b7b","first_seen":"2026-06-12T05:44:54.769141Z","last_seen":"2026-09-05T04:49:44.96361Z","times_seen":2,"resource_available":false,"data":null}},"time_used":637,"timings":{"blocked":168,"dns":0,"connect":0,"send":0,"wait":245,"receive":224,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/httpclient-v3.js","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.246Z","timestamp":1788583747246,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /httpclient-v3.js HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: no-cache, no-store, must-revalidate\r\nTransfer-Encoding: chunked\r\nContent-Type: application/javascript; charset=utf-8\r\nContent-Encoding: gzip\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:07 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":2864,"size_decoded":1065,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (554)","md5":"6c1144cdc5057ab4c75e26a4bbcb85fb","sha1":"040513249b19dec596c06f24a768c7de46b31067","sha256":"0a903d6516ef598193442645d654e8aa38fd39718fee3b3e47b6ef1e4506ea4d","sha512":"b92441633aea590c73fb1633de252f4ff0de477166fdef74d94e7aba8a62c20323fe33b2549b57bd25cefca894871b522d17baeae6064e1236e77b81edb8f7ac","ssdeep":"","tlshash":"ea51331fbc55d56457a119352e7bde8cf4be0074401dd40694efd4adac24ff5092674c","first_seen":"2026-06-30T22:32:35.151074Z","last_seen":"2026-09-05T04:49:44.964797Z","times_seen":10,"resource_available":true,"data":null}},"time_used":434,"timings":{"blocked":-1,"dns":0,"connect":217,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/UploadFiles/20181227084202743.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.278Z","timestamp":1788583747278,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /UploadFiles/20181227084202743.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589f827c33\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:10 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":68677,"size_decoded":68870,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=12, height=1440, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=1080], progressive, precision 8, 300x225, components 3","md5":"a76746808caa087a769decf671695a69","sha1":"d7a0fca54f70fff6c201249188223fa94a3d9d01","sha256":"19978916f1da75daec8ec383cdd0ce114d098597de5f2e9616eb50ff859a0264","sha512":"d6c7d234857a4fb967aaefdcaaec78a9907015f3973009a64a0be505da4fd6eec564f4b5e29e1deb42ea5860a754e9dbab19374c22186c377736a5acddab43b8","ssdeep":"1536:DBti1ABti1iUGplzuNsWENQXShcmypFeC9gGdeJm+:DB3BJplyd5X0cmg79gGdeJm+","tlshash":"5463f1367b80ef11fed0e7b480d2c31217235e6897632b4d70adb20a7f943816e2e256","first_seen":"2026-06-12T05:44:54.716946Z","last_seen":"2026-09-05T04:49:44.965318Z","times_seen":2,"resource_available":false,"data":null}},"time_used":3954,"timings":{"blocked":3486,"dns":0,"connect":0,"send":0,"wait":243,"receive":225,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"clear-e.com/","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-05T04:49:03.496Z","timestamp":1788583743496,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T05:58:36.054699Z","times_seen":18287339,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/js/cslink.js?v=0.42477986199661855","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:10.349Z","timestamp":1788583750349,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/js/cslink.js?v=0.42477986199661855 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/ky.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:11 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Fri, 04 Sep 2026 09:29:49 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a9a8f8d-1752\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5970,"size_decoded":1687,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text","md5":"c63e6a41d6ebb12e197f86a4e498b05a","sha1":"0a5087487d8195b0842095a9d67c1ae3f6b48b33","sha256":"31d72b1ef3bad8353d3a0a7e46264395de7418a93bafc8a8bd5f6d4305b6bc4f","sha512":"7148ca0637dd7b65f9e31c4d48d683c16fc787915c2d1a0466f6d20e7f16abd421a44b54303202afbf93c83215ff252cfe08d62197ebfe3caa8cef9f5529b890","ssdeep":"96:1WIllB2vccKjKkD8ZR/kZy3f8k6O7V0/g7rgj:1WIvB2vcBjKa8//zEk6O7V0/g7rgj","tlshash":"97c1a05b81d41c8506aa21346aaf312db0ffb26de95cce4e9dd1a3e02e35137f9052bd","first_seen":"2026-09-05T04:49:44.966253Z","last_seen":"2026-09-05T04:49:44.966253Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1677,"timings":{"blocked":-1,"dns":0,"connect":232,"send":0,"wait":252,"receive":0,"ssl":1194},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/cslink/cslink.js?v=0.015566997320695108","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:12.093Z","timestamp":1788583752093,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /cslink/cslink.js?v=0.015566997320695108 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/ky.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:12 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T04:49:44.940618Z","times_seen":1335,"resource_available":false,"data":null}},"time_used":437,"timings":{"blocked":199,"dns":0,"connect":0,"send":0,"wait":238,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/UploadFiles/20181226053114488.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.283Z","timestamp":1788583747283,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /UploadFiles/20181226053114488.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589fb6f035\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:11 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":37643,"size_decoded":37836,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=12, height=331, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=795], progressive, precision 8, 300x225, components 3","md5":"806cb06c6e82becf0e8abdd25a90d9ce","sha1":"1fbb6b16370449485c540d98b414064b958f5731","sha256":"e0d8cd884f1e4a09590b8cfcafbe3832cd9f8543d969e9dfc5ca4d77d3e4c4ad","sha512":"c4fa96195a2d5c5362f2c23aeccde567df3cfaaf9d22e68137b94903cb3d6b76b52ef0d006ddfb1d0bf7f52a2827d53fa444ce1695db688bab4fd75aa602b9b3","ssdeep":"768:2Yyf27OMPgYyf27OBUmbCAk5/BakOcss8Yj8ivY0pSHC4fd:2TppTpBUjv4KV/D4V","tlshash":"23f2c020fb80ddb2f9f1c37851e1c749a6226a64e7b33f42b99d791777203825e0e182","first_seen":"2026-06-12T05:44:54.734048Z","last_seen":"2026-09-05T04:49:44.967279Z","times_seen":2,"resource_available":false,"data":null}},"time_used":4572,"timings":{"blocked":4113,"dns":0,"connect":0,"send":0,"wait":240,"receive":219,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"112.46.240.47","port":80,"asn":9808,"as":"China Mobile Communications Group Co., Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:10.078Z","timestamp":1788583750078,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /js-sdk-pro.min.js HTTP/1.1\r\nHost: sdk.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 05 Sep 2026 04:49:10 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: openresty\r\nCache-Control: no-store\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Credentials: true\r\nvia: CHN-SNxianyang-CMCC6-CACHE10[42],CHN-SNxianyang-CMCC6-CACHE10[ovl,36],CHN-HElangfang-GLOBAL6-CACHE38[ovl,15]\r\nX-CCDN-REQ-ID-46B1: 2b0c46422dbe3a55671ef08c77d88f40\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36115,"size_decoded":36549,"mime_type":"text/plain; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (35899)","md5":"b8a41c9449b73e8ba0224c6be1f0b7e8","sha1":"33d79319d4110bcf5c44c36f7dd4a291972ac546","sha256":"52079c09a7355f4ce3af750602ebb9aebae8238583601f8a06268eecccf13565","sha512":"472d0395a65a3ade2d215559b196a88ffcdacde3ac0f573eb8663b524f201d72c9339bcacbc198d82452a0ac367c0efd407b12795943cdd2755d95a8cf71b977","ssdeep":"768:swetbD3SkE+a/l1jaKUiQU5eqEh9GMXBOXAA/EXBeJMlbJfuPT:BetbD3SVT/3+KUc5eqEh9GMXBYEXBeJ7","tlshash":"dbf23d9577c0317cc3c783ea362b501ae1a69e910059a8bcf345f6907d34e56a37fba8","first_seen":"2025-03-10T03:40:31.536734Z","last_seen":"2026-09-05T05:59:13.983489Z","times_seen":99179,"resource_available":true,"data":null}},"time_used":1324,"timings":{"blocked":-1,"dns":3,"connect":214,"send":0,"wait":468,"receive":639,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/picture/rbsmgwmig0oaqpqmaabq2kzlptk31.webp","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:10.356Z","timestamp":1788583750356,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/picture/rbsmgwmig0oaqpqmaabq2kzlptk31.webp HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/ky.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:12 GMT\r\nContent-Type: image/webp\r\nContent-Length: 40503\r\nLast-Modified: Mon, 25 Dec 2023 15:21:00 GMT\r\nConnection: keep-alive\r\nETag: \"65899ddc-9e37\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40503,"size_decoded":40738,"mime_type":"image/webp","magic":"PNG image data, 206 x 173, 8-bit/color RGBA, non-interlaced","md5":"b6e859bef31336d0a03ad2ed18cd4e31","sha1":"db8b7b1e320d7e115254a646d97ab5780c52e0ae","sha256":"170ec291fd15ea3d6ff4112026d4cda5a52127fbb9afdec2360c067bc69c4047","sha512":"f6fdd16d6544a3d267d355429af12d61d17a45740b9575a9372e4f65b33908baa09be698f83584c11544830a2b5b860e7a46a1bbde718e42facae789a771ca5f","ssdeep":"768:A22vHjG0B15BZjNKTprKdweaFRo5grne0rg3RUCifsX:Ar1XZjNKThlZY5grZs33ifsX","tlshash":"1803f1d2e5605c47d171371e820e2e834c3e4b927bd8de6af95e9df5e2418fb85021a3","first_seen":"2023-05-18T07:54:04Z","last_seen":"2026-09-05T06:16:43.723049Z","times_seen":3535,"resource_available":false,"data":null}},"time_used":2837,"timings":{"blocked":1701,"dns":0,"connect":217,"send":0,"wait":230,"receive":220,"ssl":469},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/font/latin.fab57614.woff2","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:12.602Z","timestamp":1788583752602,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/font/latin.fab57614.woff2 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:13 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T04:49:44.940618Z","times_seen":1335,"resource_available":false,"data":null}},"time_used":1038,"timings":{"blocked":818,"dns":0,"connect":0,"send":0,"wait":220,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/pics/team.png","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.265Z","timestamp":1788583747265,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /pics/team.png HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/png\r\nETag: \"8decc589edb981d\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:09 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":48639,"size_decoded":48831,"mime_type":"image/png","magic":"PNG image data, 230 x 230, 8-bit/color RGBA, non-interlaced","md5":"31d92f8ba7ce4092d0764011ee9e7f35","sha1":"39ebd84784db6ff9b62fb7a737858a84236e0376","sha256":"ec7f850b5dfa16dbcaa6b0fd00ef9118c3aae0ba2efb8f97f04275beae4edac1","sha512":"28453f590a97d0b2c14ee27faa72fa438b34c278db224e1a2d1b588f708bdb6809987fd368fbe6f7079635a511df616366aa1273da765ba5a57fd3ee63084f1a","ssdeep":"768:cbnrXataZ7M3eVu2ylHHz+QzomofAToPbKeVZYsD6iWWtlI3QFFKw9+TX8n7J:wnrKt8MDPlnPxqgsKeVZBpjIgFoHyV","tlshash":"ac23f145e6290c0a2918dce12e6e34a8bf1f55d3fbd89e05008ec2172fb74d4571b78b","first_seen":"2026-06-12T05:44:54.714916Z","last_seen":"2026-09-05T04:49:44.96886Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2228,"timings":{"blocked":1762,"dns":0,"connect":0,"send":0,"wait":245,"receive":221,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/homenew10.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.376Z","timestamp":1788583747376,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/homenew10.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc58a013ec65\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:08 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":31039,"size_decoded":31232,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=12, height=132, bps=158, PhotometricInterpretation=RGB, orientation=upper-left, width=262], progressive, precision 8, 262x132, components 3","md5":"333b0cfb18cc03efb3b40c3d99eb93b7","sha1":"a8397de6fd24cc68252451aac33d5d151dee59e8","sha256":"5107200849a52480dee47a094283adeb9dbbd09a020c1c1ee80dc44e41474f88","sha512":"134017a4242c49da30079a0342ef456f2e7c7075b8bbb2bfff6978d9210cadb3ef1a9f326d1698ea691960bcf13b5f339605b12deafab722eb416c293889e26d","ssdeep":"768:1bYyu/f8P+Yyu/fxqZeqak8PcX+Oq7HtHG4:xG3GxqZXP9yjtHn","tlshash":"f2d2ae14eb16dd92fde4e33490f5cb56f3937f449b632682784c69167bb4ac09d4c282","first_seen":"2026-06-12T05:44:54.68859Z","last_seen":"2026-09-05T04:49:44.969976Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1461,"timings":{"blocked":772,"dns":0,"connect":0,"send":0,"wait":250,"receive":439,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/image/1.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:10.355Z","timestamp":1788583750355,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/image/1.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/ky.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 375671\r\nLast-Modified: Wed, 18 Sep 2024 07:03:21 GMT\r\nConnection: keep-alive\r\nETag: \"66ea7b39-5bb77\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":375671,"size_decoded":375907,"mime_type":"image/png","magic":"PNG image data, 700 x 480, 8-bit/color RGBA, non-interlaced","md5":"16b85bfb3c5900c9a2ae11265b83c9f3","sha1":"7e3fbaddfd99d9f0da4dec4054aeeb9bce19cea4","sha256":"23f2fee730f4a41090ee7fb54df6cd6535458f25c97a53d2d5297b2076d2256e","sha512":"ddb3943583367df200cfad1c48a0393158b90ea3dea7b31ffef2cef3962cd9b0519e86337d0a48ecc20103d6bd3f6297e951b3e4c312254d2e497988574a613a","ssdeep":"6144:aBgTqju9DrGF8Jbd12thIECEu0VRDAfqTFutvzc7nPx:13Ds8JJwmE5+GIZzcTZ","tlshash":"218423f9521a3ce33b81a63929389da4fc5bf4da33d1ce757a0574ec4e31682b859c08","first_seen":"2024-02-29T22:08:49Z","last_seen":"2026-09-05T04:49:44.971165Z","times_seen":3763,"resource_available":false,"data":null}},"time_used":6039,"timings":{"blocked":1702,"dns":0,"connect":213,"send":0,"wait":225,"receive":3439,"ssl":459},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/homenew11.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.378Z","timestamp":1788583747378,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/homenew11.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc58a00cc5f5\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:08 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":32688,"size_decoded":32881,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=12, height=132, bps=158, PhotometricInterpretation=RGB, orientation=upper-left, width=262], progressive, precision 8, 262x132, components 3","md5":"638e18afcd1ff38a032d5e0d0da1b9ea","sha1":"cf413d05135b20ff01462e9d072abaedca0eb785","sha256":"f51bc243e0c994b1d66698ee1de1886c8c01d01fa6d674e442c2f48b9ee9ba33","sha512":"96b96fba2c43db7b9443ecfeb543570709098a2318c1b38409408d72fd408d090bc29f48fc3f227df1a2174f6a27f65f7926dd37ae8895e9303f66bc7301ecf8","ssdeep":"384:bkYNg7fEQAcPicYNg7fEQ+qnIAj0EiNwfG7m68ctseQFfzm8qzmshTU34qtX:bkYynxPfYyn+qI/Hq6tjQFH0TUIK","tlshash":"c5e29d28bb17cf23f5d2d23484f4d741a3a36f68bba33142ba9c59127b762804d4e187","first_seen":"2026-06-12T05:44:54.7802Z","last_seen":"2026-09-05T04:49:44.971668Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1469,"timings":{"blocked":770,"dns":0,"connect":0,"send":0,"wait":253,"receive":446,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/font/iconfont.e7187704.ttf","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:14.111Z","timestamp":1788583754111,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/font/iconfont.e7187704.ttf HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:14 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T04:49:44.940618Z","times_seen":1335,"resource_available":false,"data":null}},"time_used":345,"timings":{"blocked":118,"dns":0,"connect":0,"send":0,"wait":227,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/font/iconfont.407a95e9.woff2","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:14.469Z","timestamp":1788583754469,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/font/iconfont.407a95e9.woff2 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:14 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T04:49:44.940618Z","times_seen":1335,"resource_available":false,"data":null}},"time_used":462,"timings":{"blocked":240,"dns":0,"connect":0,"send":0,"wait":222,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/css/base.css","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.248Z","timestamp":1788583747248,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /css/base.css HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: text/css\r\nETag: \"8decc589e91ad96\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:07 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":13864,"size_decoded":14055,"mime_type":"text/css","magic":"assembler source, Unicode text, UTF-8 text, with very long lines (343), with CRLF line terminators","md5":"6d427d8f09f4296f1ffad0f412986e42","sha1":"96f8eff352e3a7e417a20990403a04b852ace8b0","sha256":"f30d21131ca4944af5e801896977271aaa1184115608efaa0103cd55f753c610","sha512":"598d5cb1fc5ec4f5f8fda530f48b8f0e9f09de4238ff1b686f8ddcb30623c69ad115b6ce16f605752e92cecdd8d70ce229fd14c915970ce559e322e9ad5c2028","ssdeep":"192:q/0EISoXKfnbj7idsFq+1QX5iuB0Nn9W/MR+1DM68nK7cLAQvya7yYOZhlWViUVQ:aPISVqaqAW5iuB0Nn9dGaNy0Dg","tlshash":"80522121ea03111aa13f96ab7767ea46ef1f5053660307fcbef03955cacf0671272689","first_seen":"2026-06-12T05:44:54.800764Z","last_seen":"2026-09-05T04:49:44.972639Z","times_seen":2,"resource_available":false,"data":null}},"time_used":903,"timings":{"blocked":-1,"dns":0,"connect":218,"send":0,"wait":249,"receive":436,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/UploadFiles/20181226053031212.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.284Z","timestamp":1788583747284,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /UploadFiles/20181226053031212.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589fc079a1\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:11 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":72605,"size_decoded":72798,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=22, height=3456, bps=0, PhotometricInterpretation=RGB, manufacturer=Canon, model=Canon EOS 1300D, orientation=upper-left, width=5184], progressive, precision 8, 300x225, components 3","md5":"440b13a498d0adfec4394ef560fcdef7","sha1":"e754a3d780979a48231f44ac74eb11af8e3c9d81","sha256":"1dbc9007dee171c26bfc716238418b8148c7024cbda2c4172e503c1cfe5ed164","sha512":"9d81c93d97193afd6a3895cf80c9e838bbcf5082ac31b3ece2038f9434b7ea08a9ab090bc723d335c3524cd7848604f7d35e60adf42e232ff72c85a20b5f3f5c","ssdeep":"1536:jgR6Ea6E4QfyiV9mxt0vOIYb9+q9ak5jR7DQ6GygqJ:qCl9mqO/9F9aGRG1+","tlshash":"c163e004fb2aed92f8c1d53990e4d3527373fa1457a36b86b46d2a113752bd04e0e1af","first_seen":"2026-06-12T05:44:54.792825Z","last_seen":"2026-09-05T04:49:44.973658Z","times_seen":2,"resource_available":false,"data":null}},"time_used":4829,"timings":{"blocked":4322,"dns":0,"connect":0,"send":0,"wait":242,"receive":265,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/image/ldlogo.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:12.558Z","timestamp":1788583752558,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/image/ldlogo.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 220743\r\nLast-Modified: Thu, 29 Feb 2024 07:27:24 GMT\r\nConnection: keep-alive\r\nETag: \"65e031dc-35e47\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":220743,"size_decoded":220979,"mime_type":"image/png","magic":"PNG image data, 3600 x 2000, 8-bit colormap, non-interlaced","md5":"492093dcf4b1ba9c13b19de1903d974a","sha1":"5e4a03772362bf9c43bc9a5ad75682564f5d0f76","sha256":"009a0d5c28b46ef15643b4f1b90f4af852846bce2b65a443d231d41cd21e24f5","sha512":"a1caaa66263ed8ce703221060978c9f5985ac72533b50127e272ddfc2090dbbaa00ae2f9c460b8937d3fa92397457b2b0dee538cedbf023b2d414d7a9b281c34","ssdeep":"6144:Wx8WwUNUfdl+GUc6QOkWF2zuwJKf3yeEOjEEBF:Wx83U5GUsOkNzuwkf3XEOdBF","tlshash":"d42402b5b322429fc13e5b265ac73df595f58eb106f4e77ac4653a0a033980fce91898","first_seen":"2024-05-09T23:18:45Z","last_seen":"2026-09-05T06:16:43.723657Z","times_seen":3024,"resource_available":false,"data":null}},"time_used":4593,"timings":{"blocked":1419,"dns":0,"connect":0,"send":0,"wait":458,"receive":2716,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/font/latin.fab57614.woff2","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:12.603Z","timestamp":1788583752603,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/font/latin.fab57614.woff2 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:13 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T04:49:44.940618Z","times_seen":1335,"resource_available":false,"data":null}},"time_used":1149,"timings":{"blocked":925,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/UploadFiles/%E4%B8%87%E8%83%BD%E9%98%B2%E9%94%88%E5%89%82WD40.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.277Z","timestamp":1788583747277,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /UploadFiles/%E4%B8%87%E8%83%BD%E9%98%B2%E9%94%88%E5%89%82WD40.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589f90ca76\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:09 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":83073,"size_decoded":83266,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=1080, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=1440], progressive, precision 8, 300x225, components 3","md5":"244a0d1631ec5a0a311ffe04fc4e5ef7","sha1":"492cbfa977ecb479d654c47ffaa9fdede0d3e407","sha256":"6e97fafd05c6c2789e2adbb6ce1c080f134f8af7a57ec79c1da2c75dce2ecf9a","sha512":"6d41399189dc91f0c51f39695fb02f2a8cf010339ddcfaa0b04cfd73a918e6462fa67aa4afc251f35291fd49208475c8a413fd25c49972552438a896d1edd305","ssdeep":"1536:xtMeSuatMeSuhzVaMJIJiHnHQ2Dy1ttNtpuqgCQ4tHU0zQ2:xtMe0tMeRwh1ttNtpuxa00zB","tlshash":"3683f1366fc2af61f9e3c67981f7b7a672503e9067632112365c3a097b643c318c9167","first_seen":"2026-06-12T05:44:54.719337Z","last_seen":"2026-09-05T04:49:44.975293Z","times_seen":2,"resource_available":false,"data":null}},"time_used":3026,"timings":{"blocked":2556,"dns":0,"connect":0,"send":0,"wait":245,"receive":225,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/top_tel.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.264Z","timestamp":1788583747264,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/top_tel.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589e9b370d\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:09 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":19043,"size_decoded":19236,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS6 (Windows), datetime=2018:12:04 18:23:03], baseline, precision 8, 218x40, components 3","md5":"bfa52500710b67cf380979d2015f027c","sha1":"7e805d55bca6736539a139d9b124ac001430dff6","sha256":"b7c8c8b36fb1609c824e4fb3a683e64b65e165fecc3e1bbf5ae1e80aa7f91677","sha512":"a170c668f78059e6ffd2a460a50df820811c2425338b828e01329ccca29e9411ad4d5ee4f307c065d411edaa7530dc73b16e4f17e91815a35981be26b01104b6","ssdeep":"384:G36Uxl3vPC76Uxl3ZbnZ2HYNg7flHK9jQeEhVrEBtv:G36Ub3vPq6Ub3ZbyYyblHKdQDhFEBh","tlshash":"43826c25bfa1cf51f6e0b2b584a6d3a323229b55ab6327893c9c35017bb13d14c5f187","first_seen":"2026-06-12T05:44:54.772294Z","last_seen":"2026-09-05T04:49:44.976364Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2263,"timings":{"blocked":1760,"dns":0,"connect":0,"send":0,"wait":243,"receive":260,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/pics/plant.png","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.266Z","timestamp":1788583747266,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /pics/plant.png HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/png\r\nETag: \"8decc589ed6d227\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:09 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55234,"size_decoded":55426,"mime_type":"image/png","magic":"PNG image data, 230 x 230, 8-bit/color RGBA, non-interlaced","md5":"d0ec1759d20a3d6546b2900cc8210868","sha1":"69e897dd480feb09c626cce1c7fadfefccf41414","sha256":"1e5d2def56d95deee374dc45e92f68fb580a0b8166f6f444374013493e6d988b","sha512":"6ea44fd2bdcecbd79867ea39c2788973d5545e54029840437b2e8d34dae69895c18ea2ab0a2f630f0d8d3bc48dd51268579ab491b3c1d0c8316f7a6e321fac81","ssdeep":"768:xmukp6bvp60+bNq4STojjwytCxqoTAeKBdCxgDpfLhni37azNlyaTqd7ePvUnErh:1bCtdvFtCxA/BdtpLtiWqzWUGOY","tlshash":"3143028b48887367f14bd0fe3cea8616a6e361e1e6de90f9b40ec6c9226153121547de","first_seen":"2026-06-12T05:44:54.712224Z","last_seen":"2026-09-05T04:49:44.977468Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2467,"timings":{"blocked":2005,"dns":0,"connect":0,"send":0,"wait":242,"receive":220,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/homenew06.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.381Z","timestamp":1788583747381,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/homenew06.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc58a013ec65\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:08 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":39279,"size_decoded":39472,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=12, height=132, bps=158, PhotometricInterpretation=RGB, orientation=upper-left, width=262], progressive, precision 8, 262x132, components 3","md5":"3398e9aee5602af0cf64a136ea80f807","sha1":"831e774c61e5ee4cf3dfbc7f8be63cb6490800ea","sha256":"33670172a01509edd82838851ea6159ce6a1e5165e2e1f52ec7b3b4ba3d8fc3d","sha512":"00260b3e792533323f5da76d32587394d6cc75f3902c54cbff6c3641c0667ad4d1b75632d2d661ea1c6593e971ca78f665a42d68959a2746d821be9b542e2c42","ssdeep":"768:8sYy5/6BPZYy5/6XqDcFXXUKZhDe/ya/MhwjNDQhzOqFok88:VwfwXqGU4e/CwhMhzOqFv88","tlshash":"5803cf74efa7de92f4d1e47464e8c78aa6937f0867636502388c795237a13819e4c0e3","first_seen":"2026-06-12T05:44:54.72719Z","last_seen":"2026-09-05T04:49:44.978517Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1664,"timings":{"blocked":767,"dns":0,"connect":218,"send":0,"wait":243,"receive":436,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/pics/footer_eweima.png","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.384Z","timestamp":1788583747384,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /pics/footer_eweima.png HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/png\r\nETag: \"8decc58a026ff51\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:08 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9587,"size_decoded":9779,"mime_type":"image/png","magic":"PNG image data, 140 x 140, 8-bit/color RGB, non-interlaced","md5":"e60bb5ffaff77f22b45eccad712d49da","sha1":"12a09071257907a65022cbafb67d676594a6ca8c","sha256":"920230257f4c50ba9fa9c8ba0cd2ccfbc3cc545c30af6fc9fc08d4195f45b6c4","sha512":"de7189035eab5f522ba7b5cab6a5d689e0604f89a9b49a6365c00756804d700bfbfab6cd2438cef5d6ed2ee56b218e0a1d8db16a5afd7d6d33afcbeb17f7cb54","ssdeep":"192:zSHIIHUCD4waFFvWxMvbYmiE0DAWxAk31YQnXqqxD6gdmT0D1DH:m50wi1WSTYY0D/ek3itiG0F","tlshash":"ce12bff4eaa9000b449ca3bfa9b558c649e57bc1135d0d5ca47ca70fc3a18913c4c7be","first_seen":"2026-06-12T05:44:54.766872Z","last_seen":"2026-09-05T04:49:44.980169Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1915,"timings":{"blocked":1460,"dns":0,"connect":0,"send":0,"wait":236,"receive":219,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/UploadFiles/%E6%95%A3%E7%83%AD%E9%A3%8E%E6%89%87.JPG","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.273Z","timestamp":1788583747273,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /UploadFiles/%E6%95%A3%E7%83%AD%E9%A3%8E%E6%89%87.JPG HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589f65dffb\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:09 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":48306,"size_decoded":48499,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=16, height=3456, bps=206, PhotometricInterpretation=RGB, manufacturer=Canon, model=Canon EOS 1300D, orientation=upper-left, width=5184], progressive, precision 8, 300x225, components 3","md5":"b499fbe733047eea9efc270e3807b6cd","sha1":"e270a358cf02f2b3ab6661a4551bd49a5e2a2b4c","sha256":"be3594ef2bfd021e0d8b984a0e33a026047a2d14928dd38a1d3e3f51db02b259","sha512":"4db82733d5992fdb34a5950ae2f92dac1e41e5a3bf2f5f4571b00c24b9a9f491d6c4fc1e0343de1d25799b2fd592d564f83896fc368e168a7e56c1b5331fe505","ssdeep":"768:3cYyTovjOPmYyTovjjWBOhYyZuLHjGmo1SVAB1YNxOEQS8WqC44ulc:3cAvjtAvjjEOh0LHjGamqE7H4uW","tlshash":"af23c025eb68fd72fac196b440f1cbc1b283b72cc763a686705c69093f9a6c05d4e14b","first_seen":"2026-06-12T05:44:54.788308Z","last_seen":"2026-09-05T04:49:44.981344Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2941,"timings":{"blocked":2475,"dns":0,"connect":0,"send":0,"wait":244,"receive":222,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/UploadFiles/20181227083759512.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.279Z","timestamp":1788583747279,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /UploadFiles/20181227083759512.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589f8e6818\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:10 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":68973,"size_decoded":69166,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=12, height=1080, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=1440], progressive, precision 8, 300x225, components 3","md5":"2b4d26c15f9d004657627c58877da5c6","sha1":"bf59ef7f92df9a1203470297b3295a50bc3100c5","sha256":"b2b5932a3e4a2c48cca1f74f66b2e0a8495b467148e3350384087a021d43ca87","sha512":"0a84bb6579df4e7a59cb2dc80b9e11c18114df4c063ec3c2c3e01149d085bfd0d248a23161f3ec18ac227fe0097dbd193771db5f579c4e053cacdf496e574eec","ssdeep":"1536:WJdK/+JdK/vUKARQC4RUUUW0pRw0RL7wzTPm+:WSmSdMx4RUQeRw0VIPv","tlshash":"8363f1325b84ec39eee5cb3101e0abca5240f9eae6734b82b16c744537767c41bbb146","first_seen":"2026-06-12T05:44:54.69514Z","last_seen":"2026-09-05T04:49:44.982462Z","times_seen":2,"resource_available":false,"data":null}},"time_used":4120,"timings":{"blocked":3654,"dns":0,"connect":0,"send":0,"wait":243,"receive":223,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/UploadFiles/2018122605305323.JPG","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.284Z","timestamp":1788583747284,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /UploadFiles/2018122605305323.JPG HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589fb952f6\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:11 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":44398,"size_decoded":44591,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=22, height=3456, bps=0, PhotometricInterpretation=RGB, manufacturer=Canon, model=Canon EOS 1300D, orientation=upper-left, width=5184], progressive, precision 8, 300x225, components 3","md5":"cbc1794ea0b5c17ce2b87967a6749aee","sha1":"e4441f58b2762f6ddad24a6a755c1e75f4a6ba4f","sha256":"792d22a246140eafaef2a59d318ff770dd8ebec3f50619bb2bd1facbbe285abf","sha512":"3367f21e21ac2a4a261812c1236b604042f8d5d8522d7f8a4f246c0a61016e474619cb076b845c8db5ad4ba6a0335ef5440232f269a17886894896bd60ef18e5","ssdeep":"768:Rg0YyZLPMYyZl9BRWYybPLq8o7FRX84mP4i5dDJMQSrUF:Rg0qznRWXPLq8o7FRZaDJMQSrUF","tlshash":"8213bf74fba1dd12f8d0a23888f2ebe3e3d2592552e36342305c391537a63c06e8e19d","first_seen":"2026-06-12T05:44:54.821099Z","last_seen":"2026-09-05T04:49:44.983542Z","times_seen":2,"resource_available":false,"data":null}},"time_used":4626,"timings":{"blocked":4120,"dns":0,"connect":0,"send":0,"wait":238,"receive":268,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/homenew09.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.375Z","timestamp":1788583747375,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/homenew09.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589fedc680\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:11 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":27200,"size_decoded":27393,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=12, height=132, bps=158, PhotometricInterpretation=RGB, orientation=upper-left, width=262], progressive, precision 8, 262x132, components 3","md5":"9973fdeb0c9106d65fbcfd844546e710","sha1":"c2a7a521aefd8a5660ed3506e1ed2f3c3997fcc8","sha256":"2e24abc96495d0e7c228c347d889a2a03e33e051b3c443d2efe4f914c3ed3738","sha512":"1e064c688ef4f7712476c9645f5d707f3327c1273de046b33450412c512a0b9f39628633db85ad93d9ea4a28f6aae80afdd2397dae319b2c6b72079494a098d9","ssdeep":"384:aRYNg7zoJcPibYNg7zovqnTjgi6H89bIIdBWyV4cG1L+EATQEkIWo:aRYy/oaPUYy/ovqN9bIfa4cGhPATQho","tlshash":"c6c28e38ea138f12f4e0973cd4fadb86a3232b15d3633686799c7511bb729819c8d187","first_seen":"2026-06-12T05:44:54.699387Z","last_seen":"2026-09-05T04:49:44.984557Z","times_seen":2,"resource_available":false,"data":null}},"time_used":4990,"timings":{"blocked":4539,"dns":0,"connect":0,"send":0,"wait":232,"receive":219,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/image/ag-66-4.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:12.554Z","timestamp":1788583752554,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/image/ag-66-4.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 189185\r\nLast-Modified: Wed, 18 Sep 2024 07:03:31 GMT\r\nConnection: keep-alive\r\nETag: \"66ea7b43-2e301\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":189185,"size_decoded":189421,"mime_type":"image/png","magic":"PNG image data, 750 x 694, 8-bit colormap, non-interlaced","md5":"93c0060e234caf0bf804261f3cfd574c","sha1":"284959e512593ed4a2d9163b5bb604df7ca860d0","sha256":"3b3517b2a149662c9083c8307dc28e5c514a2f5e726e5ce9ce14ea931fcb304c","sha512":"0e6221c046dbc56c41dbaf7766d58605662ae7abdbf4666491433e9fc5b268f5fda3b8436034f6ba9a899e6316ebb22ab85f1a5fefd6cd301e4bd81d764b15f5","ssdeep":"3072:9djIZfl0x1w6OMDXDpTp8U0IRfFMpfxHI5c7AEtqSCOQhjArSO/G0+W//R5zx:9dUFdMTDpTp84JIpHI5c7z4+QSrzG0+u","tlshash":"8b0423f1f20c558fd9f45270bdecd62734305aa30b7a16b1c4a677c21eba21f4198d9a","first_seen":"2024-09-19T08:05:07Z","last_seen":"2026-09-05T06:16:43.73986Z","times_seen":3144,"resource_available":false,"data":null}},"time_used":1675,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":514,"receive":1161,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/font/montserrat-black.be2a4b98.ttf","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:12.606Z","timestamp":1788583752606,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/font/montserrat-black.be2a4b98.ttf HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:13 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T04:49:44.940618Z","times_seen":1335,"resource_available":false,"data":null}},"time_used":1253,"timings":{"blocked":1037,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/UploadFiles/%E7%94%B5%E6%BA%90%E7%9B%92.JPG","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.274Z","timestamp":1788583747274,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /UploadFiles/%E7%94%B5%E6%BA%90%E7%9B%92.JPG HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589f552fb9\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:09 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":41735,"size_decoded":41928,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=16, height=3456, bps=206, PhotometricInterpretation=RGB, manufacturer=Canon, model=Canon EOS 1300D, orientation=upper-left, width=5184], progressive, precision 8, 300x225, components 3","md5":"1db3b6549f79af2c7d287cfe4501f6f2","sha1":"79b00938e875e5dcd6261bc7e33b46562f456483","sha256":"e28ad422bd8b7e49e88d8951f592b3fe73f081b409031c4cf3fc1f6ab7685d1a","sha512":"cc8dbd4d90525b037044a4852e41505293ac7e1db1c5b72dafb8b4c02bfd796e3af58a39f2576ebe2f2c400ce9720bcd919aae9e1cf8fad980d252d200372d52","ssdeep":"768:2QYy7PExPdYy7PEyWKiSYyaZzzSZkdc5PtYPcTfxaJLzz:2Q/O/LhiSmZzWkSYPcjxEf","tlshash":"2313ad39ef15de63f9d4e63860f1d7417362664de793a206749caa107fa23c18e0d28b","first_seen":"2026-06-12T05:44:54.70193Z","last_seen":"2026-09-05T04:49:44.985997Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2927,"timings":{"blocked":2467,"dns":0,"connect":0,"send":0,"wait":241,"receive":219,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/UploadFiles/20181226072819226.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.272Z","timestamp":1788583747272,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /UploadFiles/20181226072819226.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589f5c5684\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:09 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":61323,"size_decoded":61516,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=12, height=1440, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=1080], progressive, precision 8, 300x225, components 3","md5":"76367b45e8a93290322a3085a25c15d5","sha1":"242cf92565abf113d10f1412b0c3e0a3ea4303ec","sha256":"f123aec37b37940a4724cfa08e41ad42c36e94acce022d37418a61ba5146c55b","sha512":"968f0531b6cd0b03a9dfc71b1fa1b742f7e898638b5789cffff180d997bfc9edb656aee597c9398c8fc1ab8ca9c2b70eee2827879ff4b41f74d73182e06529c6","ssdeep":"768:4Yy4grRd7C4P+Yy4grRd7CXUYYybL1T1kq4X5bTxM82/d3H9PjKgQrzOmbZuyhD+:4LdKLdoUYXL7t4p5jYH9s51uMaYsx","tlshash":"4d53d023eb65ee63f5e15634a4f5d7d99362fe71c7236302707c361a33291826e4c286","first_seen":"2026-06-12T05:44:54.754671Z","last_seen":"2026-09-05T04:49:44.986948Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2992,"timings":{"blocked":2475,"dns":0,"connect":0,"send":0,"wait":248,"receive":269,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/homenew07.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.381Z","timestamp":1788583747381,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/homenew07.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc58a0223a87\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:08 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":46043,"size_decoded":46236,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=12, height=132, bps=158, PhotometricInterpretation=RGB, orientation=upper-left, width=262], progressive, precision 8, 262x132, components 3","md5":"284baed88d8aa7009ab42c82378d2601","sha1":"40bdb6de250fded89c0e1c59ae99ee2ece6ff0f5","sha256":"9e65f7c2498a91fa51268ea4c30375dd695dfaab91af92668778e1da42077220","sha512":"fbfd52cfa24b9a046b5f2ae16e0abddb67bb39791bc06070db938a0c7ce75a5715e69c378baafe58ebaeaf7cd9ca1912424416edd7423d814ef2c6f5fc53e674","ssdeep":"768:j1YyeucHLNILTPOYyeucHLNIL7qTTzfdtWJMJpijf0niqa3kf/DRtF8DHJG21kuh:56ucr+Lq6ucr+L7qjfdQiyjf9tkfLRtM","tlshash":"5523bf24fbd74d23f9d0c27494e6d342f323eb5987632652b49c2d11a3649c24e8ea27","first_seen":"2026-06-12T05:44:54.728612Z","last_seen":"2026-09-05T04:49:44.988151Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1459,"timings":{"blocked":767,"dns":0,"connect":0,"send":0,"wait":255,"receive":437,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/dateicon.gif","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:10.115Z","timestamp":1788583750115,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/dateicon.gif HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/css/zhenganjx.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/gif\r\nETag: \"8decc58a03a122d\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:11 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":1476,"size_decoded":1668,"mime_type":"image/gif","magic":"GIF image data, version 89a, 14 x 12","md5":"36c756517fb3b76c754f4478d692c570","sha1":"8cd83b35ab861cdb7263a4a40bad98f57a0cee54","sha256":"a3a4051e81e3782a2f71a4ee9aaa4d4276b5c93e84d6b65f31ab8e3b5b2200c7","sha512":"61d9079f1a4afc66050e6eee854cd29a801be4bea7b7983e44e8b700da5f343fdb6eadf547ee0a92abb532b59ea94cb6043171324c31dd729a34eacfbf5811d8","ssdeep":"","tlshash":"1631b64c9844fc01d0dcb9f52df7d92a6a1646808bd8f1c9ac8df82666580bac59eec7","first_seen":"2026-06-12T05:44:54.707316Z","last_seen":"2026-09-05T04:49:44.989092Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1967,"timings":{"blocked":1746,"dns":0,"connect":0,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/font/latin.fab57614.woff2","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:13.437Z","timestamp":1788583753437,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/font/latin.fab57614.woff2 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:13 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T04:49:44.940618Z","times_seen":1335,"resource_available":false,"data":null}},"time_used":542,"timings":{"blocked":317,"dns":0,"connect":0,"send":0,"wait":225,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/font/iconfont.e7187704.woff2","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:13.649Z","timestamp":1788583753649,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/font/iconfont.e7187704.woff2 HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:13 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T04:49:44.940618Z","times_seen":1335,"resource_available":false,"data":null}},"time_used":426,"timings":{"blocked":210,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/picture/rbsmgwmigzeaqeisaabdvano3pe24.webp","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:10.359Z","timestamp":1788583750359,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/picture/rbsmgwmigzeaqeisaabdvano3pe24.webp HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/ky.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:12 GMT\r\nContent-Type: image/webp\r\nContent-Length: 44556\r\nLast-Modified: Mon, 25 Dec 2023 15:21:02 GMT\r\nConnection: keep-alive\r\nETag: \"65899dde-ae0c\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":44556,"size_decoded":44791,"mime_type":"image/webp","magic":"PNG image data, 206 x 173, 8-bit/color RGBA, non-interlaced","md5":"6194ced01b173481e68b89111c85d6b1","sha1":"35a559992114129a74eac4d5c165bcd9a6a2e3f1","sha256":"bf9c1ba4745317154616c229e8abf30963b05a905c43e0e38b3d795c714b6074","sha512":"ae946a383c19f2072ead7621a8a058498c8bc04272397c3d5939e2e0b988cb833b04cf3eb5c023884664e163fb0f5ca2a62d24bd998db47a70af4d1d8ca6609b","ssdeep":"768:wbU7XS2F2IS772TDQnsnw4zcI2jWEVXUy2+Ly70uHLvUZtT5miRxH0a5FxsF3:wci2F2IS772TDQsnw4zJ4NFUK5uzUZts","tlshash":"7b1302204fad1c6c223f233446852697a06cbe5c39139df50ac9b4de1e9ac3b81559bf","first_seen":"2023-05-18T07:54:04Z","last_seen":"2026-09-05T06:16:43.742471Z","times_seen":3496,"resource_available":false,"data":null}},"time_used":3520,"timings":{"blocked":1702,"dns":0,"connect":0,"send":0,"wait":663,"receive":1155,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/css/zhenganjx.css","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.249Z","timestamp":1788583747249,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /css/zhenganjx.css HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: text/css\r\nETag: \"8decc589e8f4b37\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:07 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":12452,"size_decoded":12643,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"8500bb97818de40c515c14b3c6f1fb5c","sha1":"06bf77d0f0e48c3b702f02a03cd507306a9403bf","sha256":"38b848acddd7a727973b76d4d4b0fee994d6632202c62a13a2b64ed5524e8cfc","sha512":"b38187b7ce74ccefb1bc0ff8ce6326004dcd67418e7bfd8746b34227852b38ef41c1043363e83339a4b6093a0344d404446b85349f0d36cb7528861a500c395a","ssdeep":"192:ed6+PoQoTjgq3nDGtcvUl858JKejENsdiDToTuzq:8xoYqStcvUl85WmvDTMuzq","tlshash":"7a4265215313208ff92f6176be539b8a5b1be003a78213fdaef17915c18e46329367c6","first_seen":"2026-06-12T05:44:54.683277Z","last_seen":"2026-09-05T04:49:44.990719Z","times_seen":2,"resource_available":false,"data":null}},"time_used":686,"timings":{"blocked":-1,"dns":0,"connect":218,"send":0,"wait":248,"receive":219,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/logo.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.263Z","timestamp":1788583747263,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/logo.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589eae4a03\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:08 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":97699,"size_decoded":97892,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=12, height=68, bps=158, PhotometricInterpretation=RGB, orientation=upper-left, width=615], baseline, precision 8, 759x100, components 3","md5":"4d975f4c5a8abbf1895c03c617573d8d","sha1":"540fad5a5b9b68b92b56c43f250780660424a665","sha256":"1f62b1aaaa5f150ffcb8f7d97cd36ed0f921121a91c9c84103323c48da7602b6","sha512":"244ee1607a52905fab5ef735932576a230d8d7dea25a5d72493de770e5b4a0c421fa5d7bb766609c27a2671d59fbcf56a98c2ffa1ca2f739332bf68e729972f1","ssdeep":"1536:U4FC4FWqiSbnf2bUqWQxAeGT7PUpQoq95yODc07NQjvBODFXxtUaDQ97:UVKbubUCxSrUpQ75yObObgpXxt5sR","tlshash":"9aa3e0788e26ea95edd4247853d097ab229d290e97f3171cfc4cdc06b7219cab48f582","first_seen":"2026-06-12T05:44:54.795786Z","last_seen":"2026-09-05T04:49:44.991911Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2475,"timings":{"blocked":1562,"dns":0,"connect":0,"send":0,"wait":242,"receive":671,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/UploadFiles/20181226053001631.JPG","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.285Z","timestamp":1788583747285,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /UploadFiles/20181226053001631.JPG HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589fe90220\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:11 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":48287,"size_decoded":48480,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=22, height=3456, bps=0, PhotometricInterpretation=RGB, manufacturer=Canon, model=Canon EOS 1300D, orientation=upper-left, width=5184], progressive, precision 8, 300x225, components 3","md5":"430c0030c4d58fd56faf154668c0282d","sha1":"7dfd0ac6efaf72aafa350826c60d281ec9414084","sha256":"8076e89183500254703dab3c2d2f6b690abf7e9527c156c0d048e7152fd48418","sha512":"a9a7e633295257d985ccd5a4aebd20fe20b801ef3eda69ea639f466238d028e799ba0db7d45da0d21f659100976d598f5a5562ffec39a759692979cd849d421a","ssdeep":"768:ggfYyvHGosUP9YyvHGosQ9BW4Yyb1oN0dfkI/aV9VL+K8IvWssK6vmbX67l:ggfTphTp3nW4XaN0dfjaXn8IecWYX2","tlshash":"c523be38eb80cd93f9d05a3058e5c3a6b359e919d3b32a02b01c76163bb23d19e4e15b","first_seen":"2026-06-12T05:44:54.720895Z","last_seen":"2026-09-05T04:49:44.992982Z","times_seen":2,"resource_available":false,"data":null}},"time_used":4935,"timings":{"blocked":4428,"dns":0,"connect":0,"send":0,"wait":241,"receive":266,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/homenew01.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.286Z","timestamp":1788583747286,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/homenew01.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589feb6462\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:10 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":51757,"size_decoded":51950,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=12, height=132, bps=158, PhotometricInterpretation=RGB, orientation=upper-left, width=262], progressive, precision 8, 262x132, components 3","md5":"212f961278bb24f16068ccc58a9d7316","sha1":"b335a707c55f8ba64ffcb4ca5510f33999cbb67b","sha256":"14bc34202bf023c186b7862de7ee1b4bf870606e67eeba33ef40a11fe67379ce","sha512":"0f953ae85e251792a1e78ff3ce3b9ba21810cb3caa65b9bc65446f6fe2ade4c4ab37a46e22555c172a31023415e349c3cc376ec61c7ef8aa3f0f62732f04cc9f","ssdeep":"1536:8+Kek+KepqM0rzjfOTuq3lnNrDzYWSKhmV:8+Kek+Ke70rzw1NrDMhFV","tlshash":"0f33e061bbc7de63ece096b45898d7c2b302db5a33a3239630acb814bbb52415c4d307","first_seen":"2026-06-12T05:44:54.778136Z","last_seen":"2026-09-05T04:49:44.994146Z","times_seen":2,"resource_available":false,"data":null}},"time_used":3484,"timings":{"blocked":3025,"dns":0,"connect":0,"send":0,"wait":236,"receive":223,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/UploadFiles/201812260531377.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.282Z","timestamp":1788583747282,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /UploadFiles/201812260531377.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589fc7a10d\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:11 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":64397,"size_decoded":64590,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=22, height=3456, bps=0, PhotometricInterpretation=RGB, manufacturer=Canon, model=Canon EOS 1300D, orientation=upper-left, width=5184], progressive, precision 8, 300x225, components 3","md5":"e9933a4f271e6fae6a3feb2550c25912","sha1":"e89076ce670bcced760460ffa2600836cb5ee083","sha256":"c121f71593e7c173c5a375b99367e15c619bb91a626f3cac4f8019e204f248f4","sha512":"31f4f0208693fd66617e1e76b3c8bd993cd5359056f25491ff187d5eb44e392ca7651b231dfd18a7b23ff2e17a29bce137b5670c8ba71607fbfed5e6b87e5313","ssdeep":"1536:UgmwJcwnnz86eV7Byton36yY8OxUCE5LhA5CFL8nI:mj+uqIOxnyhA5CFp","tlshash":"2a53d025eb12fe63fce0813454f49391f3927b24ca532b87755c9629bf763819c8e09a","first_seen":"2026-06-12T05:44:54.723928Z","last_seen":"2026-09-05T04:49:44.995213Z","times_seen":2,"resource_available":false,"data":null}},"time_used":4428,"timings":{"blocked":3953,"dns":0,"connect":0,"send":0,"wait":251,"receive":224,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/ky.html","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:10.076Z","timestamp":1788583750076,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/ky.html HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:10 GMT\r\nContent-Type: text/html\r\nLast-Modified: Tue, 01 Sep 2026 07:56:10 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a96851a-520e\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":21006,"size_decoded":5526,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1181)","md5":"a5af32cb8919b0b262196a7cf01df788","sha1":"164ce928ea3db6daad26dcf273e3907639c6ef18","sha256":"7db3fb3ecd8c94c01039b7cdda21fe798308e192a401cefc4d4f71526442cd9f","sha512":"c5a903b540694921699da8d513bc2f28a96d0763d1cfa543d35aa6f822704ecfa9b9219cd623261cddfdf7cac533efe43e948e5c2c3456b71395fc1777607712","ssdeep":"384:i5eLAa76E6dODCJkBlNDYO3y3jKAxuxMx0xSxh:IA76E6dODCJkDNMO3y3jKMCYgWh","tlshash":"42922e6644f304771273a0a66b6a67873fa4ea13c90b8b457bec1be45fc2d92cd0354e","first_seen":"2026-09-05T04:49:44.996331Z","last_seen":"2026-09-05T04:49:44.996331Z","times_seen":1,"resource_available":false,"data":null}},"time_used":221,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/font/iconfont.e7187704.ttf","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:15.418Z","timestamp":1788583755418,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/font/iconfont.e7187704.ttf HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:15 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T04:49:44.940618Z","times_seen":1335,"resource_available":false,"data":null}},"time_used":222,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":222,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/UploadFiles/20181226070427652.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.275Z","timestamp":1788583747275,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /UploadFiles/20181226070427652.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589f4e0852\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:10 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":42761,"size_decoded":42954,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=22, height=3456, bps=0, PhotometricInterpretation=RGB, manufacturer=Canon, model=Canon EOS 1300D, orientation=upper-left, width=5184], baseline, precision 8, 300x255, components 3","md5":"83ec6b2b57329533b728e9c7a751cdb1","sha1":"beb00d66ab1192a0c015893d151ea66f6170aa5f","sha256":"eee97d566240b496a871bc0996244a1b1fc8f4cde5c3c718a996038747006b82","sha512":"969463329274c0198311fb4613c63af01898cd34842bf9e764d3d9875d0240fca53d0715f6b3c9a24ba07cb13385c23328bcfe3867679232048af363580c3857","ssdeep":"768:hg5YyxCuPsYyxCt9BZ5YybVny5Z9BK2BpDPPkn4B9Cd8bgqR:hg5oTotnZ5XpinfgncMCV","tlshash":"0f13bf38af45dd61e5f0e238b4e3f785f2b1aa6693637b92340c65217b521c0ad8e04e","first_seen":"2026-06-12T05:44:54.730637Z","last_seen":"2026-09-05T04:49:44.997346Z","times_seen":2,"resource_available":false,"data":null}},"time_used":3936,"timings":{"blocked":3462,"dns":0,"connect":0,"send":0,"wait":248,"receive":226,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/picture/rbsmgwmmnw-ahnf9aabt7ce2zgq87.webp","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:10.360Z","timestamp":1788583750360,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/picture/rbsmgwmmnw-ahnf9aabt7ce2zgq87.webp HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/ky.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:12 GMT\r\nContent-Type: image/webp\r\nContent-Length: 21484\r\nLast-Modified: Mon, 25 Dec 2023 15:21:03 GMT\r\nConnection: keep-alive\r\nETag: \"65899ddf-53ec\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21484,"size_decoded":21719,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ccf323bf4e1c41b61aaa296ea59b8b81","sha1":"83f1f27a2fc6c58c751b5e7fc627015a1991b374","sha256":"c7959283d90c9940056378a35789761735a565490945094cd5b77c6b4bf1cc74","sha512":"e75e1bfd61482f56c07ebaa6591f3bee348cc1badbec88a9cfffe930cc5da68a8ccb80271a324fda8d0563b9ccdd4c966a14e4435caa9b9da3fbe1679a6a6e8d","ssdeep":"384:ioDvU5aozxCzakUC75bUncSMiubtHuyO9+2lm/3t0mn/gK0QqbLDng7v:1o4LaagncSzEtH4+DF0mYZfUv","tlshash":"b1a2e1f798af70b3532a495c93f695ee5b84ab340c8dac43e879986ca3352734831e05","first_seen":"2023-05-18T07:54:03Z","last_seen":"2026-09-05T06:16:43.726533Z","times_seen":3511,"resource_available":false,"data":null}},"time_used":1930,"timings":{"blocked":1701,"dns":0,"connect":0,"send":0,"wait":227,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/image/ayxlogo.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:12.562Z","timestamp":1788583752562,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/image/ayxlogo.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 4529\r\nLast-Modified: Thu, 03 Sep 2026 08:57:51 GMT\r\nConnection: keep-alive\r\nETag: \"6a99368f-11b1\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4529,"size_decoded":4762,"mime_type":"image/png","magic":"PNG image data, 216 x 86, 8-bit colormap, non-interlaced","md5":"e256973ea8d16108426bb96c7ab000d0","sha1":"141d705413daa1b5ff2839bd34966fc630280261","sha256":"2f3bb5cae805e7494c488c26382b1fad126a21ee7585c46888334f75035ee724","sha512":"5ec60df88754b4fff41fbd59401f1bb5bb5cf6b49647a075fa4e4443365981bb5d532898cdd62cbd3b17883cb154333757a99f58cb60cbd780fe8fb6834fb826","ssdeep":"96:aOkWAfVwL2sk5S+0a2GJo0EklIwU5B00PhdFhIg6U1:aOkVKJk5SBcJooU5G0PhZI01","tlshash":"e9916c0a6eb023f136afd0794098bba827050e28b1db5d765062eda6544eec9a701d37","first_seen":"2024-08-19T13:14:17.540946Z","last_seen":"2026-09-05T06:16:43.747276Z","times_seen":127,"resource_available":false,"data":null}},"time_used":1746,"timings":{"blocked":1522,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/font/iconfont.e7187704.woff","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:14.937Z","timestamp":1788583754937,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/font/iconfont.e7187704.woff HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:15 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T04:49:44.940618Z","times_seen":1335,"resource_available":false,"data":null}},"time_used":476,"timings":{"blocked":237,"dns":0,"connect":0,"send":0,"wait":239,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/css/banner.css","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.253Z","timestamp":1788583747253,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /css/banner.css HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: text/css\r\nETag: \"8decc589e835fb7\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:07 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":955,"size_decoded":1146,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"defb227ba1265a872b6ad435c506b45a","sha1":"bea64cb729f96035ba3fee7e12d37c4e3f2f3875","sha256":"d3fcb4d9f16c15598503f46ee8352810cf1b09c8e0530055527a80460570ccf7","sha512":"b7c2b49d038bc297e9eadeaf405e1502a33c6d326b14246e4626cf1f0005e78f86f4a73be6181d467c4d515fae0fda3f0ec0bd0b396053de9787a5bc624f7f68","ssdeep":"","tlshash":"4c117b201e5b2429f01be16bacb28f8f55af9107e24b046ce2e834b1596d86e7436384","first_seen":"2026-06-12T05:44:54.693223Z","last_seen":"2026-09-05T04:49:45.000218Z","times_seen":2,"resource_available":false,"data":null}},"time_used":460,"timings":{"blocked":-1,"dns":0,"connect":216,"send":0,"wait":244,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/UploadFiles/%E9%AB%98%E6%B8%A9%E6%B6%A6%E6%BB%91%E8%84%82.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.280Z","timestamp":1788583747280,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /UploadFiles/%E9%AB%98%E6%B8%A9%E6%B6%A6%E6%BB%91%E8%84%82.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589f90ca76\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:11 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":54769,"size_decoded":54962,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=1080, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=1440], progressive, precision 8, 300x225, components 3","md5":"ee21e4cefe802b2cb7b5b6c904724c25","sha1":"576aea673d8a0f2fb86144f0ca6b27e5fc0b1f8d","sha256":"a528015daa6b47a2e25c7663f5e24b469778eb76cbf84e5a08a85134266f704c","sha512":"248e4016094c1c484256b54e85141805ccae79d1fe038884a9f467c7c186506bcc37aafccd797dc25c912df391fc04008e73972baa2add3235b005095f55d1fd","ssdeep":"1536:la+GOa+GDzL1CXEhTokyvGzeS17W12SRX2Y:lTGOTGLTyvjeWnRmY","tlshash":"ae33e0256bb99e52e4f8e23136f6d7da2321a654a3033287795c73617f367c40c6e283","first_seen":"2026-06-12T05:44:54.732024Z","last_seen":"2026-09-05T04:49:45.001236Z","times_seen":2,"resource_available":false,"data":null}},"time_used":4443,"timings":{"blocked":3911,"dns":0,"connect":0,"send":0,"wait":269,"receive":263,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/UploadFiles/20181226072911912.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.270Z","timestamp":1788583747270,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /UploadFiles/20181226072911912.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589f5c5684\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:09 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":96293,"size_decoded":96486,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=12, height=800, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=600], progressive, precision 8, 400x300, components 3","md5":"0f6a52cbf23ac91a5563ab39e9b570a3","sha1":"eebe2bacefa78d0028adaf4affd1796389bf5519","sha256":"e886cf19fdf5c4e12da8dc03fc76a6d9901a49e8a895dab58b4059a64b44ad14","sha512":"6ce3f03ce98ebd0af4e43c195cd42a28f135d3a00c459ce96b31dc552ae066713cc9f0016eceb88183148bfe54aa0b0518ef7ad0ff0631b031ec6061f5bdc1d9","ssdeep":"1536:lV1W9LN3j8V1W9LN3jtUq/etWj6T1YWIJfhwfarWfhQ7GVfTMoajv2dK1PvnZicC:lbW9LN3YbW9LN3P/etisYXwuWM8Ilv2J","tlshash":"5693012e7fa9ed50e4eac230d95ec3d13143725e26539ec875ec6a04331fbe1a59ca90","first_seen":"2026-06-12T05:44:54.675441Z","last_seen":"2026-09-05T04:49:45.002632Z","times_seen":2,"resource_available":false,"data":null}},"time_used":3149,"timings":{"blocked":2263,"dns":0,"connect":0,"send":0,"wait":233,"receive":653,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/homenew12.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.379Z","timestamp":1788583747379,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/homenew12.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc58a00cc5f5\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:08 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":35648,"size_decoded":35841,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=12, height=132, bps=158, PhotometricInterpretation=RGB, orientation=upper-left, width=262], progressive, precision 8, 262x132, components 3","md5":"79356bdf7c18a81999dab15611c82c15","sha1":"b098208b27897643073fb32f034d660e90ebc6c5","sha256":"5ac05026c7e7a3dfa16fa231108dab020b6dfa09f8064ada7c73c09b0950fdb3","sha512":"47bdf456ff2dc821e8e2064c21c8293f22e6fb535413a0b23be95249d062969a8d0723104e300a48a6b5b9e6144731d5a268e6f1c664566c6df2254f755b169c","ssdeep":"768:MPYyT+TPEYyT+9qfOeL/hDePK8kOZAWlX7cNsvi:K+g+9qfOeLNqH1/lL23","tlshash":"94f29e356b529e63f9e4933890facb42e267af5097733242ba4c75057f61bc08c5c19b","first_seen":"2026-06-12T05:44:54.725375Z","last_seen":"2026-09-05T04:49:45.003781Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1453,"timings":{"blocked":768,"dns":0,"connect":0,"send":0,"wait":250,"receive":435,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/image/background.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:12.540Z","timestamp":1788583752540,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/image/background.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 181983\r\nLast-Modified: Wed, 18 Sep 2024 07:03:42 GMT\r\nConnection: keep-alive\r\nETag: \"66ea7b4e-2c6df\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":181983,"size_decoded":182219,"mime_type":"image/png","magic":"PNG image data, 1920 x 1030, 8-bit colormap, non-interlaced","md5":"05bf65d40291d266c59f26f96e67cc72","sha1":"a82f0c303aa0db6e99b37cd73853d7a6810c3e47","sha256":"1a977499b07e4c440c3b1c4284f83140194739f0308cd5090f5f7157a1cd34f3","sha512":"782b2c8345334a55ab399e0767618b74a2bad35835953181831197ce640e4016c6d829f7b5ec02ef2ebb90c91a4aed08ef611ce0b69396874f6b8fe91528ff8d","ssdeep":"3072:yH+fSTQYIsZeo40OdAbcP5CSxRg5rKI/vSk+sD1WDHMfwNNo4rDR:8+aQY1ZI95CSxK57Sk+vIfwk4rDR","tlshash":"4c0412aa6cb708f3c5844cacb0b4add476ebebac05dc7ccef691089d9953c190e84756","first_seen":"2023-09-17T16:12:24Z","last_seen":"2026-09-05T04:49:45.005367Z","times_seen":3751,"resource_available":false,"data":null}},"time_used":1102,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":230,"receive":872,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/image/leyulogo.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:12.563Z","timestamp":1788583752563,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/image/leyulogo.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 5939\r\nLast-Modified: Sun, 01 Jun 2025 06:13:05 GMT\r\nConnection: keep-alive\r\nETag: \"683bef71-1733\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5939,"size_decoded":6172,"mime_type":"image/png","magic":"PNG image data, 250 x 100, 8-bit colormap, non-interlaced","md5":"0766823d7d695ab7be2022a7856ba852","sha1":"8784e00785274e6a63bc8f83461d4786953b6e76","sha256":"a0f09589fdb876045b3ff19713921db68e488d1a853ac7d3872241f9bf624594","sha512":"0ab9505feb5f8a8312f9ae3ebf10a1131b37b5e545e663df68a7f941b597a3ab5c9c14bad11c74b3bd54b5e20347249e673a99e1449db46b6e23c3218d38f764","ssdeep":"96:tWaPv1GR74oIl25kQN0Fw731k8PFwrD2oX6cHuvQoAD7uvsk9wzibJD9msveFW/5:UaPgR77Il25SmRkfrz6cOvQouukJqxmE","tlshash":"42c19fd6184a5a61e142090fd4a8ea0cf8f4f15fe6dc26e4df5c8ad787c3cc85be5184","first_seen":"2024-06-11T19:41:23Z","last_seen":"2026-09-05T06:16:43.733991Z","times_seen":3218,"resource_available":false,"data":null}},"time_used":1756,"timings":{"blocked":1538,"dns":0,"connect":0,"send":0,"wait":218,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/image/kaiyunlogo.png","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:12.570Z","timestamp":1788583752570,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/image/kaiyunlogo.png HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 15054\r\nLast-Modified: Wed, 18 Sep 2024 07:04:06 GMT\r\nConnection: keep-alive\r\nETag: \"66ea7b66-3ace\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15054,"size_decoded":15288,"mime_type":"image/png","magic":"PNG image data, 814 x 200, 8-bit colormap, non-interlaced","md5":"5bdb83ec9f353d69c2ebc9c36cef090e","sha1":"e3a542a5b41ab05a8a444c3f106186806d1f025e","sha256":"fc148ba9a62f11da475123e65ced85cb59d9715e2c202655e4322942803bde0e","sha512":"465c1eb28d8641c930c163efdafb203a10dd280eb47d5fdc121459bc243309ee18c8fd5f1162bc39402ee416d6ad4034a83253195d5961633a23620a6dfcc261","ssdeep":"192:JpKA2giu6cjK+61eWj17lwRm+M2HtS7NGO+bgJvlClT+ehacY7qZFimlLKztvuBJ:Xk+6Jx7lwRmCpOPJ4T1oulZwtHa","tlshash":"1e62d1c3420996a3fe3624fc31850bada934fcbe5411f725d621758fc9f4aa34c9191e","first_seen":"2023-09-17T16:12:24Z","last_seen":"2026-09-05T04:49:45.006409Z","times_seen":3609,"resource_available":false,"data":null}},"time_used":2136,"timings":{"blocked":1883,"dns":0,"connect":0,"send":0,"wait":253,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/homenew03.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.288Z","timestamp":1788583747288,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/homenew03.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589ff28b71\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:10 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":46661,"size_decoded":46854,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=12, height=132, bps=158, PhotometricInterpretation=RGB, orientation=upper-left, width=262], progressive, precision 8, 262x132, components 3","md5":"e2c49aa9ced8b019931d31ed7ec06665","sha1":"1d52612ebc4c826c8231e06a4168d80b118b998b","sha256":"0df96e482f6b0300867e930887de0cbd843e6b451541a36eb28367184bc3b289","sha512":"454a7b3645dfbd1838a5fc7b1bfe879779e3bfbf0ddf438829da1dddafdbf9c1aaa9899a878b29c6cc5850b2af881f33890770f2a2596118b2ecad3005a72652","ssdeep":"768:RySaiPeSacq2BL0XtyHKLJoE31r6fZenbTr7HaPRxIGHqCMm02kU2ULXLjYXwm:EHcq2BLAMK9H3ugr7ue857QtOXL8T","tlshash":"6323e009b6e79a61f6c40a3866b8c3560b319f9c3e87d20b7d9d24907fb5915ed3e0c2","first_seen":"2026-06-12T05:44:54.762572Z","last_seen":"2026-09-05T04:49:45.006902Z","times_seen":2,"resource_available":false,"data":null}},"time_used":3652,"timings":{"blocked":3148,"dns":0,"connect":0,"send":0,"wait":241,"receive":263,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ptfafa.com/go/kaiyun3/static/font/iconfont.e7187704.woff","fqdn":"www.ptfafa.com","domain":"ptfafa.com","tld":"com"},"ip":{"addr":"27.124.6.204","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.ptfafa.com/go/kaiyun3/ky.html","date":"2026-09-05T04:49:13.871Z","timestamp":1788583753871,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.ptfafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 18:32:08 GMT","end":"Wed, 04 Nov 2026 18:32:07 GMT"},"fingerprint":{"sha1":"4D:75:AE:C1:A0:34:CB:A2:5E:3B:63:75:15:8D:4C:7C:17:6B:A2:60","sha256":"1B:AB:61:D5:D2:44:7C:34:5D:1D:94:B3:33:24:3B:46:F4:D5:17:87:71:41:FD:F3:58:E5:A7:EF:A8:FA:E4:C1"}}},"request":{"raw":"GET /go/kaiyun3/static/font/iconfont.e7187704.woff HTTP/1.1\r\nHost: www.ptfafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ptfafa.com/go/kaiyun3/static/css/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 04:49:13 GMT\r\nContent-Type: text/html\r\nContent-Length: 149\r\nConnection: keep-alive\r\nETag: \"6a26603c-95\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":149,"size_decoded":318,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"072b53f1225664624bbc650a1d989157","sha1":"410bdc01a54c052267a829f0c27772a8b6e001c2","sha256":"b91edd68807f90417064cda18a801c34746354709580d3f33e25b812b6317c18","sha512":"a42918e7916fe52f41e610629a13840cd86ed22bf4c66d3365d903c49a9623528c5d22d363f56694bb124c1e9e6baec5acfd460424ad4745595995581d49e986","ssdeep":"","tlshash":"6bc02b2c35232b488513203113e33290c087833f787e852104008033f2cb399eec33d6","first_seen":"2025-08-14T15:59:58.728241Z","last_seen":"2026-09-05T04:49:44.940618Z","times_seen":1335,"resource_available":false,"data":null}},"time_used":236,"timings":{"blocked":10,"dns":0,"connect":0,"send":0,"wait":226,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"www.ptfafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/UploadFiles/20181227083925374.jpg","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:07.278Z","timestamp":1788583747278,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /UploadFiles/20181227083925374.jpg HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/jpeg\r\nETag: \"8decc589f8c05ab\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:10 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":74348,"size_decoded":74541,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=12, height=1080, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=1440], progressive, precision 8, 300x225, components 3","md5":"1215a098f8727aa998eae30ff43414d8","sha1":"aee5840088c4b3213c0ae33039fefdd2f9c06cbf","sha256":"cdb1c3e2920fc5971230374aef521f342dd25667ae9a0d59121b19e520527cab","sha512":"b91674b452b1a72d1a32dd511350c98e7590009d7da5735e1860449ec6bbf2bb04b5e7a4f785c968a10da0d198e68422aae03bff1c7b9db8c9265d87da8c4a7e","ssdeep":"1536:7+nbsih4+nbsihEUB4q5/UflFq8MxAjZ25k6mGg8Dx9aJP87:7GYq4GYqX4q5/UfO8MxAt/ScE","tlshash":"0873e1165b5cdd55f0e184309493c7e7b6219d90db7336a6387c782b3b28bc68d0e316","first_seen":"2026-06-12T05:44:54.757831Z","last_seen":"2026-09-05T04:49:45.008276Z","times_seen":2,"resource_available":false,"data":null}},"time_used":4113,"timings":{"blocked":3650,"dns":0,"connect":0,"send":0,"wait":241,"receive":222,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"clear-e.com/images/h_servericon.png","fqdn":"clear-e.com","domain":"clear-e.com","tld":"com"},"ip":{"addr":"156.250.34.3","port":80,"asn":35916,"as":"MULTA-ASN1","country":"South Africa","country_code":"ZA"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://clear-e.com/","date":"2026-09-05T04:49:10.110Z","timestamp":1788583750110,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/h_servericon.png HTTP/1.1\r\nHost: clear-e.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://clear-e.com/css/zhenganjx.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Type: image/png\r\nETag: \"8decc58a03a122d\"\r\nServer: Nginx Microsoft-HTTPAPI/2.0\r\nX-Powered-By: Nginx\r\nDate: Sat, 05 Sep 2026 04:49:10 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft HTTPAPI:2.0","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","website":"https://learn.microsoft.com/en-us/windows/win32/http/http-api-start-page","common_platform_enumeration":"","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24057,"size_decoded":24249,"mime_type":"image/png","magic":"PNG image data, 200 x 300, 8-bit/color RGBA, non-interlaced","md5":"2bb7f82caf83f203fdac664b30e3a288","sha1":"c595ff288bfcc8a684ea9752475b926e65e1c5f5","sha256":"769b11d862e3238fd7e6f9d82d080cdfc916cc563d387c06a504debf39143d25","sha512":"344d9526e45e2dbd8c3b0e248d22e03e926fa4b0f37feeeb33146c041be77910f979fd38c2351278317f7ba263cb1ba08de63ab5e215047477c81f2fe51a1583","ssdeep":"384:R50wjj8kxU/4XvENOuxWxvWsJ1G82mEfYERvj0OYl/+AtVdU:TJj89/SsjxyvT1YgERr0Nl1dU","tlshash":"b6b2d0daf6d6c01d5203779b74e7db9f4048d71042c76ee44eec26562e21cba8d6a833","first_seen":"2026-06-12T05:44:54.691096Z","last_seen":"2026-09-05T04:49:45.009435Z","times_seen":2,"resource_available":false,"data":null}},"time_used":581,"timings":{"blocked":118,"dns":0,"connect":0,"send":0,"wait":243,"receive":220,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"clear-e.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}