{"report_id":"c77336f5-a26f-4874-9369-ec8318a342a5","version":6,"status":"done","tags":[],"date":"2026-01-13T05:18:50Z","url":{"schema":"https","addr":"coccin.vip","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":0,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"final":{"url":{"schema":"https","addr":"coccin.vip/#/quotes/index?tabActive=1","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"title":"Coinbase","dom":{"size":37284,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (30518)","md5":"3d86ccde4deb8e69349ada6a6c095136","sha1":"a36e8e75564e5b852eb46314bd33abc88f4c73bb","sha256":"cf5ac05dfa425ba7fe5ddbc92f59c29ff16d130b1a6962fea5035f14abb1e6e3","sha512":"94bba9404f89a7f312b9b13c3a234672e2d51fd8ad66e7ea22bbd9c90dccc629eb66cb9434569c26357279781ccef0c34e74dbd7b5dfd9fff086c9beed6a1c85","ssdeep":"768:XapwWqDQ5ba7iCtcsM2zoLPrZsKp3wEHV36+7:Xaz55ba7iCtcsM2zoLPrZsKp3wEHV36c","tlshash":"edf2da3634150337877791dae8b1afe0e9a1f30ed09ba68075ec2645dfd7c3639841a6","dom_hash":"domhash08ad32383bb8568c2e58226da7c4e2b4","first_seen":"2026-01-13T05:19:16.275036Z","last_seen":"2026-01-13T05:19:16.275036Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"coccin.vip","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":0,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-17T05:18:50Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"coccin.vip","ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":177,"request_count":59,"received_data":10176474,"sent_data":32041,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"coccin.vip/syn/js/index-332e8f65.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":false,"md5":"6dbe458b242294a70e3e15291d862a30","sha1":"40dd14922db7e60d75637e286560ef6a47f1227a","sha256":"584310cd5d4ec6a1a06bfab0f077585bf2c6e4e44f39dd232113662558fb3927","sha512":"67c287bb024d3f2919550b4368b98936ec50a51366e3fde8949b29459d5230fe277e0e559e37e37a47cc9e0e148637d98183e3619a05234166e5c1ae585b5b8f","ssdeep":"384:hXXJsSTPEKCmMY5EMaqDoDh7Zm55yqIa3ljk:pDTcZuWh7Zmryf6Rk","tlshash":"8452f8083546e938b2e7017a6834c08170596feed092c09fbbfc6dd56bc78392299775","size":13541,"data":"","first_seen":"2026-01-13T05:15:15.421524Z","last_seen":"2026-01-13T05:19:16.318241Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-10T19:56:03.540037Z","times_seen":741421,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/vendor-5b6902f7.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"introduction_type":"importedModule","is_inline":false,"md5":"feb8d329b859749afd4817ae9b139893","sha1":"f823b96bc8aca7cc46ea8dbbf443434b418d3201","sha256":"99b6b84498b610d68f0f3012af13ac151bbde4d636a48c263516ef1cf9b63dc4","sha512":"a231310a258ffc6ece6599a1fd063a9bd3b117d126327c339e70807ec0c4e1aeedc25a337a7dd3aa31719a971fb981b95bef117fe9569bf2f2c74ed18b54e15e","ssdeep":"49152:uSNf2ed72IuguFXk6MIqNM7VFXyDtxcqeCd:d/Lck/BeS","tlshash":"f0b53bbd73e13c9605b751a44dbf180faa2a1987508d8468f1bbd4e53fb8844e297b3c","size":2340857,"data":"","first_seen":"2026-01-13T05:15:15.433752Z","last_seen":"2026-01-13T05:19:16.32032Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/vant-e1aa18c9.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"introduction_type":"importedModule","is_inline":false,"md5":"73c8391cd10d500fde5ec52c808c0121","sha1":"0d063440cadea65d63aa642969472a6e266e240a","sha256":"e17d78a1191501e3fc10d854310127f5e0b8a3b919d520555565294c7c3c9048","sha512":"2be78044c68beb227f78909540ecf75e8173045e6266161cb8239c296050f4655505efe32cae5b69985b1782250b423d5af6da68a3b137a0455ce82a517aa853","ssdeep":"3072:XcE0+J8Pggn7cRoT/0i1zJT3A4S4Hwhj92Je3FS6CfiMtMwQT3DbQ+iOjHW3:XcEKgg7t5LS4Hwhjj4PtI/FjW3","tlshash":"8fe34bc0b8d9b43987bb95e4807a0811b62d1f48b009c4e0f07e9d593b699d4b6bff2d","size":156181,"data":"","first_seen":"2026-01-13T05:15:15.405276Z","last_seen":"2026-01-13T05:19:16.302546Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/Layout-a910cce6.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":false,"md5":"b6fc71a48acd9ea6fdd5d57e36da6447","sha1":"4d5900ca5f720a864597ab21e18350f595214d80","sha256":"af0f0162551e430d532b02a132feb57f9419262a86360782ed190f7117e61da7","sha512":"f0d5384950773055d5ddae94f46f005ab3142247e591a99ee7a2b6c424bfa06993f65755aa159f673a013a7bdbd90d41c58afdd8c70162acf56eef9239e648c6","ssdeep":"","tlshash":"80d09765d440b0fe73c858fce215a4c181364ad033ad80f0c2ce8067023a0afc60db00","size":240,"data":"","first_seen":"2026-01-13T05:15:15.425316Z","last_seen":"2026-01-13T05:19:16.29178Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/logo-00b56da7.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"introduction_type":"importedModule","is_inline":false,"md5":"8be23fc935b55ca759d0e1b154db5b49","sha1":"dc8d5c498136da6dc61116a88608ec83d52fd154","sha256":"2836482495dc2bb79b13b7a515b98937877b6a1119d4fb8d0f7f8647b5893f37","sha512":"9311c85c0e41f1011a731482cd50d041dc291b9a0c53707b4deea63d15b7812b3d09734cc019bf2d489339ff4d35636c9927096e4bb67704be1edce44938bd4b","ssdeep":"","tlshash":"519002365904656009c5004dd792e814042554bd6155199b84290981d7a2048df99514","size":53,"data":"","first_seen":"2026-01-13T05:15:15.429228Z","last_seen":"2026-01-13T05:19:16.290557Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/index-f71b474d.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"introduction_type":"importedModule","is_inline":false,"md5":"42f14f4fe2f455d73b0336a2a0f19079","sha1":"b89d66c2293d349c3c9a4cdbaf7ff485b1a099bd","sha256":"ca43accf42c493bdfbe7de1422e37a95cb3e2e0b44b781f738a6c9f286bde820","sha512":"294884c4acb8b129a07b404f493c62a41b688905289c833d55c15a133dd0fbe6b967b6d00526a23f2813b694b9c9e285be165e8165717272be94c1caef8fc78d","ssdeep":"","tlshash":"97018e2fe0c1b0f592f205d8ce2e5126141836d476e7458e37f96ce2838a4a5d72e932","size":830,"data":"","first_seen":"2026-01-13T05:15:15.418964Z","last_seen":"2026-01-13T05:19:16.288481Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/logo-cf27a524.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"introduction_type":"importedModule","is_inline":false,"md5":"af80ce9200c76157c9379bb76cb8e862","sha1":"cef15198ae37892cd10cf90e412c3afb78bf34f1","sha256":"a7196ae54f59a5671c150a5f435bb9250947661886e617816d75a3e3ee5cde1f","sha512":"b71b927cb25d1a887f881eb4de048404dd0029ab3eb47a0fe3b2d3dc7457c64a3721813a15670033ae53f302879eb151baf497f22c0cb2d917c6c3acd9f6418b","ssdeep":"","tlshash":"6a900236650565a058c40099d7529c54041565ac6155195684190581d7610489e9a925","size":53,"data":"","first_seen":"2026-01-13T05:15:15.422412Z","last_seen":"2026-01-13T05:19:16.295458Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-10T19:56:03.540037Z","times_seen":741421,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/index-3b66fcd5.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":false,"md5":"e19938bdf1eb4dd1d1a50cf906cb10c1","sha1":"103f06c4878515219bab84dfa0b78fb863146351","sha256":"540e11e74950002209cb4e7726924b4b97fc0c96cb403e362306e66c76e675ef","sha512":"2cc68aca714dae91ad8c8e2ac2033f384ffd4bc7004e2678569dba16beae793a6b3a6833038625b5bd2b4cf26ad4f84b4552e5304d2afb61049a656f2ce6efdb","ssdeep":"12288:JSLtA2ZOIxbl/N+vML12V9BbSWd1GODDeBEDwlaAvsi:JIWlIjVVm98WjGODDklaAvsi","tlshash":"48a595ae9a5a11660de64dd8dc412a8fe9e09f084267db3bd2fff6a27301014d25373d","size":2230531,"data":"","first_seen":"2026-01-13T05:15:15.43519Z","last_seen":"2026-01-13T05:19:16.321033Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/search-e4a3a12e.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"introduction_type":"importedModule","is_inline":false,"md5":"c859fdeda2e597ff9352c64ee2550f2b","sha1":"fa3f9b77cafa6f3355bd6aeeb602852a732aed67","sha256":"debf94c5ae4b9eb7f578fbd5fe5abba7e8e1caa7ddc80fbd4a48fdd24554a081","sha512":"4022f8ae7ead4b2e8ad424827700c362bbe91655f79678d5f6d927a4f69dc671e32b90e08aa1726ada9cc8e5e558e5f2335b1e8790b5c750fc6ef2b5fe83ff75","ssdeep":"","tlshash":"924129f22c121e10764c1bd8e78a19ad0c21bb8dd0b37bd08ecdea0a961e066e930472","size":2139,"data":"","first_seen":"2025-08-27T06:41:40.812381Z","last_seen":"2026-08-05T04:56:14.340695Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/author-f8e4f331.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"introduction_type":"importedModule","is_inline":false,"md5":"e0b14fabcc8d166bc3cf633258dab47a","sha1":"5c1553e7fe0a70ce31bd5fe4492c8ae315695b9e","sha256":"aa6c1ef25b0022b34623cdf971112dfeb238e6467285725410a14617e09b0b89","sha512":"f0c6f2b6e779a87ef3997278267de465e52889815e26783279a2729a5dabf3ed77209640f1b881135d3ea8da433fc7591ca477eabb75d2e425193c25d633f6ee","ssdeep":"","tlshash":"1a9002221420656058a90088d722c9658b51100d61686565d60a4506e5136859a6e518","size":55,"data":"","first_seen":"2026-01-13T05:15:15.398388Z","last_seen":"2026-01-13T05:19:16.310668Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/List-36999650.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":false,"md5":"e08f5157dc15fa4bc75d44bafbb15a69","sha1":"80f138479bff12a05fc318d7d47ff128c19e6982","sha256":"120942990d5807553845643a518cb789339c16ec653045aebb7553d65f98abe3","sha512":"8e74aff132e77b4d97ab6e8b67e49b90e93f27197058c68d0c420d3043d81be8c4dc9f8394c01f3e31c062683dc0b0f96906239c2c17417229f8bbc97c2b7bdf","ssdeep":"384:tGVXW789Hc7Qcotclcojcouco0citcoFciacimciUco9Ibcgu4myMG2V3CJLyk4l:IVXW789zIbcb4myMvbm8","tlshash":"1762c71ca8228fb9eed70c3dac2269c011fb9f928dddc013e2f54d2d16d5ce6064e5a5","size":15089,"data":"","first_seen":"2026-01-13T05:15:15.416478Z","last_seen":"2026-01-13T05:19:16.298766Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/financialManagement.api-ddd7aaf8.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"introduction_type":"importedModule","is_inline":false,"md5":"3f6c2b32ca6d99283c370afe2325e4ef","sha1":"52c5c210a15e6146fad19f1dc36c6c5d9d3cd3be","sha256":"0ccb8a4765d322e4d4b3bbcb8328605321eb289728d5f58096de3069cdca3f8d","sha512":"db440aaeced903c89c65e27d6f95b00e2903c7121a0d739ca818e18ca2c593bcca0069e3124c9aa990f4d68a1a62b2a75264ce4e90fcd13f5747e44d6021ee0c","ssdeep":"","tlshash":"9e21811b6c07e13e5289d58ebb7e862d8497cf25f96624e83f001c19dbf967d8142418","size":1344,"data":"","first_seen":"2026-01-13T05:15:15.411467Z","last_seen":"2026-01-13T05:19:16.311229Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"coccin.vip/syn/js/vendor-5b6902f7.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:31.686Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/vendor-5b6902f7.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://coccin.vip/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-23b7f9\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2340857,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (36722)","md5":"bb8a3841c0c16d9e56e2913800de198f","sha1":"ef26014008ce61d61dbcadf869987438586b7919","sha256":"fa590abd955d6ffa8124a8d0b80c0d2840cab022ec7b2218ca8a52b952b6121d","sha512":"fc403960b540aaae96167942c1819ee808e78732477bf8afa833567920b748b9ef5da1fd72d7a72203a67818599b6cec3ffd4c81b24966adf5d0ee75d3a4db6b","ssdeep":"24576:BE5oNf2ed7yrJhK4FAd3uguFXk6M6WKzqyPReym:uSNf2ed72IuguFXk6MIqNd","tlshash":"89253be8b2a2745142a362f454bf140bf33a184d6488c498f569d9ee2dfd40d66bbf3c","first_seen":"2025-11-25T03:02:04.557179Z","last_seen":"2026-01-13T05:19:16.281017Z","times_seen":3,"resource_available":false,"data":null}},"time_used":262,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":262,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/png/logo-3c4df697.png","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:32.674Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/png/logo-3c4df697.png HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-a511\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":42257,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 320 x 320, 8-bit/color RGB, non-interlaced","md5":"b6e0f154add0bf36cad0c67fb899bad2","sha1":"d485a721257706732d3c05daf988e1aa6eb431a2","sha256":"3c4df69705e8fa998d2f0a9e051919195e1f5b251cc999bbd66fa6747e8808ef","sha512":"aa2a17b54e87e93f0b598623a6bf9c635f61642e5c709fad325afa971775a4b649784da82ba07675e5c7a406c7bf844821f441b0f7356f43577faec7ef6b29fd","ssdeep":"768:z5Ml7nV2lgFyp8BhdF7WvypYZ1BFI09xs1PqAqknnZIk:z5MBn8lgFyp2lWhL3/mqAq8Zp","tlshash":"8113f1d6234993bec7143b2f5dee9373d721c296c20a8431f62f49727841f8ea615c9a","first_seen":"2026-01-13T05:15:15.406142Z","last_seen":"2026-01-13T05:19:16.285924Z","times_seen":2,"resource_available":false,"data":null}},"time_used":259,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":259,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/png/swipeNew2-c6e90a08.png","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.486Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/png/swipeNew2-c6e90a08.png HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-2eb7\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11959,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 332 x 332, 8-bit colormap, non-interlaced","md5":"5f2017d273eb331a14a8b1a0a59fdbda","sha1":"a2828b028010758b98ac13b8ad4d94596ecfe45d","sha256":"c6e90a08a85876a0b0080385e9d443075bf0384edf906a4cb3545f1e3a66efe8","sha512":"bb45509b5f9eb1b8a529a06cfd08e2182f1eb32b70179d582c9c5a736dee044578b2644fbb8194cd6773bbad58664ce4c014c3f6199d46ca0e5c654115699d89","ssdeep":"192:Syz+8DRd8kOlDu+KOgZbt6zgPEgaDIFhvlUwWu28VvL8E/bAISYn51gVTeN3MXSJ:Syq8DRd85mAzuEgkIFhvlUw9ZVwKAItF","tlshash":"c932c0d543b50e28f65ba4f6ef801c33ce286d0920a2fac5cafdcc53111bca85c86479","first_seen":"2026-01-13T05:15:15.430038Z","last_seen":"2026-01-13T05:19:16.286689Z","times_seen":2,"resource_available":false,"data":null}},"time_used":338,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":338,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/index-f71b474d.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.555Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/index-f71b474d.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://coccin.vip/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 830\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\netag: \"69493319-33e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":830,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (829)","md5":"42f14f4fe2f455d73b0336a2a0f19079","sha1":"b89d66c2293d349c3c9a4cdbaf7ff485b1a099bd","sha256":"ca43accf42c493bdfbe7de1422e37a95cb3e2e0b44b781f738a6c9f286bde820","sha512":"294884c4acb8b129a07b404f493c62a41b688905289c833d55c15a133dd0fbe6b967b6d00526a23f2813b694b9c9e285be165e8165717272be94c1caef8fc78d","ssdeep":"","tlshash":"97018e2fe0c1b0f592f205d8ce2e5126141836d476e7458e37f96ce2838a4a5d72e932","first_seen":"2026-01-13T05:15:15.418964Z","last_seen":"2026-01-13T05:19:16.288481Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1044,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1044,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/index-f71b474d.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:34.617Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/index-f71b474d.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/syn/js/index-332e8f65.js\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:34 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 830\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\netag: \"69493319-33e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":830,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (829)","md5":"42f14f4fe2f455d73b0336a2a0f19079","sha1":"b89d66c2293d349c3c9a4cdbaf7ff485b1a099bd","sha256":"ca43accf42c493bdfbe7de1422e37a95cb3e2e0b44b781f738a6c9f286bde820","sha512":"294884c4acb8b129a07b404f493c62a41b688905289c833d55c15a133dd0fbe6b967b6d00526a23f2813b694b9c9e285be165e8165717272be94c1caef8fc78d","ssdeep":"","tlshash":"97018e2fe0c1b0f592f205d8ce2e5126141836d476e7458e37f96ce2838a4a5d72e932","first_seen":"2026-01-13T05:15:15.418964Z","last_seen":"2026-01-13T05:19:16.288481Z","times_seen":2,"resource_available":true,"data":null}},"time_used":249,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":249,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/logo-00b56da7.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:31.767Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/logo-00b56da7.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://coccin.vip/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:31 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 53\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\netag: \"69493319-35\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":53,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"8be23fc935b55ca759d0e1b154db5b49","sha1":"dc8d5c498136da6dc61116a88608ec83d52fd154","sha256":"2836482495dc2bb79b13b7a515b98937877b6a1119d4fb8d0f7f8647b5893f37","sha512":"9311c85c0e41f1011a731482cd50d041dc291b9a0c53707b4deea63d15b7812b3d09734cc019bf2d489339ff4d35636c9927096e4bb67704be1edce44938bd4b","ssdeep":"","tlshash":"519002365904656009c5004dd792e814042554bd6155199b84290981d7a2048df99514","first_seen":"2026-01-13T05:15:15.429228Z","last_seen":"2026-01-13T05:19:16.290557Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1141,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1141,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/Layout-a910cce6.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:31.770Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/Layout-a910cce6.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/syn/js/index-3b66fcd5.js\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:31 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 240\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\netag: \"69493319-f0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":240,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text","md5":"b6fc71a48acd9ea6fdd5d57e36da6447","sha1":"4d5900ca5f720a864597ab21e18350f595214d80","sha256":"af0f0162551e430d532b02a132feb57f9419262a86360782ed190f7117e61da7","sha512":"f0d5384950773055d5ddae94f46f005ab3142247e591a99ee7a2b6c424bfa06993f65755aa159f673a013a7bdbd90d41c58afdd8c70162acf56eef9239e648c6","ssdeep":"","tlshash":"80d09765d440b0fe73c858fce215a4c181364ad033ad80f0c2ce8067023a0afc60db00","first_seen":"2026-01-13T05:15:15.425316Z","last_seen":"2026-01-13T05:19:16.29178Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1139,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1139,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/png/titleBg-ab2f2cc7.png","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/png/titleBg-ab2f2cc7.png HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-20ad\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8365,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 241 x 160, 8-bit colormap, non-interlaced","md5":"c944652e792df22a803a9160423a6316","sha1":"bdc9d4a50dbf6f6055586803fa21e0a9199c8555","sha256":"ab2f2cc7596360e5c03e7dcadcf6e6bc6104cc86c1efcd21ca09e9e5ce9b0d41","sha512":"2b64c7ebc151c0ff658994e6f3ca190f14a27496f491fe73375781ee9721a8d779f65d7ad5162d772ee2eb104d3fd4db8bc9e492c47e0a28770f4dc1e59cafc8","ssdeep":"192:fodVTnHU8y+rg3WZ5rqefw2cvXCFEvmbvlH0ohDuqKuU7gxPdL:fodVTnqWHrqsw2caFTt0bV1WPdL","tlshash":"af028e9d646fb2d7b594b00f2e1ba7bc658c3708287cfc8d2d6bc98a96f24035b055c2","first_seen":"2026-01-13T05:15:15.415587Z","last_seen":"2026-01-13T05:19:16.29243Z","times_seen":2,"resource_available":false,"data":null}},"time_used":294,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":294,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/api/api/item!list.action?type=cryptos\u0026language=en","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:35.020Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /api/api/item!list.action?type=cryptos\u0026language=en HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nsystemRandom: 1768281515863567\r\ntissuePaper: 1768281515\r\nsign: 974630196A605CB73ACBB2D77BC127CA\r\nx-api-client-timezone: UTC\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:35 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nx-frame-options: DENY\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7262,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"3e2410f36ebdf971bd07eb4209224ee8","sha1":"167081366a5b96e5c2e8087717752f5acd9c7617","sha256":"c0f74de7b5981f98dde5785b123afdab615ffd9f17f532c1cb455cd557381aa8","sha512":"31a70d6d12b8e95a4d6be0a274b2f0b8ac7567167f9f0ff505f2226e52e2e997c0d1ec275330be3a4522b64312450774a62da8c68dc7efb2c425a5a7a5c94074","ssdeep":"192:ujSZrDjMD4yn2qbUEkZXynEDmWlQKPGynVPnHc8:ujSZrED4yn26xkZXynEDmWzPGynVPnH/","tlshash":"6ee1cc843f698f1e6fab42c30cf1afec3525729540bd1a84de9e5e6c5189fe23127609","first_seen":"2026-01-13T05:19:16.293116Z","last_seen":"2026-01-13T05:19:16.293116Z","times_seen":1,"resource_available":false,"data":null}},"time_used":289,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":289,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-13T05:18:27.512Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:28 GMT\r\ncontent-type: text/html\r\nlast-modified: Mon, 22 Dec 2025 12:19:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493741-91d\"\r\nset-cookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd; Max-Age=86400; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2333,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (500)","md5":"067127a5d42e41754fc8f3326987ed33","sha1":"17a23ea87cb0b928c2eecef7150b6f7cb503acd4","sha256":"c72acfd243414d43b13dfc3e2a1dfeb383ff123ac1c9e06a7d61d6f9bf67f423","sha512":"aa884a010a0ffafe949264ace10b319ff960c0f2c6d7fd02bb4158597b08599957a657442b93955bc11dff813a95c9ec48e12cc6a5fe0a953aaf00025d86f0b0","ssdeep":"","tlshash":"52415f625c019d12a719051eadedf4c84855a74e4508ec50f8cee0a88f80fea8ef3a6e","first_seen":"2026-01-13T05:15:15.400672Z","last_seen":"2026-01-13T05:19:16.294118Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1235,"timings":{"blocked":493,"dns":1,"connect":244,"send":0,"wait":245,"receive":0,"ssl":250},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/png/swipe2-a907f04d.png","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.479Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/png/swipe2-a907f04d.png HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-2a97\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10903,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 332 x 332, 8-bit colormap, non-interlaced","md5":"7abd267237a2960a95ac3bee5771595b","sha1":"782d106d042cda244b629a305f38776c7c6c751a","sha256":"a907f04d55afd036eb0d191a0113aae4766a6a1df7c6a8d793f97eeab4881867","sha512":"59173df2e93324fcdc459d1baab75d161a334761cb60c9dc79cd89c1ec7a3afd866757f765688e7871c17577b880ee1cf15d945e7b8683bf980ae8d7bd859699","ssdeep":"192:02+jiklZf9fLC7iVgwcE4GNqTt8UMuIOp1KkiJFCKNDhL3ablEY:Nrj7+br3CkuIgWFh3abz","tlshash":"4122a074fe5133e07c5ada3e3292d5a0491aa29d5fa0337d47826eb060844513f6ffe9","first_seen":"2026-01-13T05:15:15.395582Z","last_seen":"2026-01-13T05:19:16.294755Z","times_seen":2,"resource_available":false,"data":null}},"time_used":306,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":306,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/logo-cf27a524.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:34.619Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/logo-cf27a524.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/syn/js/index-332e8f65.js\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:34 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 53\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\netag: \"69493319-35\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":53,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"af80ce9200c76157c9379bb76cb8e862","sha1":"cef15198ae37892cd10cf90e412c3afb78bf34f1","sha256":"a7196ae54f59a5671c150a5f435bb9250947661886e617816d75a3e3ee5cde1f","sha512":"b71b927cb25d1a887f881eb4de048404dd0029ab3eb47a0fe3b2d3dc7457c64a3721813a15670033ae53f302879eb151baf497f22c0cb2d917c6c3acd9f6418b","ssdeep":"","tlshash":"6a900236650565a058c40099d7529c54041565ac6155195684190581d7610489e9a925","first_seen":"2026-01-13T05:15:15.422412Z","last_seen":"2026-01-13T05:19:16.295458Z","times_seen":2,"resource_available":true,"data":null}},"time_used":249,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":249,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/api/api/publicRealtimeTop?type=cryptos\u0026language=en","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:37.470Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /api/api/publicRealtimeTop?type=cryptos\u0026language=en HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nsystemRandom: 1768281517673276\r\ntissuePaper: 1768281517\r\nsign: 304DEBEC91AAA7E34762BEA562771E1F\r\nx-api-client-timezone: UTC\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:37 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nx-frame-options: DENY\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":890,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"a5d584e80bdf661ff293d9232d3f061b","sha1":"940786f2212cb9816e6056c745f7b134b30fc4cf","sha256":"94cbcd92b7662bb128ae6036dbd59449939b5cc3b800345bc41b9f75f60cffa5","sha512":"a98148d8681bd882772fd4304a3a9838c2787fc27df980ec3ffe280910c9d1fd54a1bc3f87d6629e0b2dee3b370a0930e0273104117a91e8e72da4237f9cb43a","ssdeep":"","tlshash":"751104527f548f7517e321830de35e3d01195ae2c0a84f84dbddde5880cc851761f90d","first_seen":"2026-01-13T05:19:16.296112Z","last_seen":"2026-01-13T05:19:16.296112Z","times_seen":1,"resource_available":false,"data":null}},"time_used":249,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":249,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/List-36999650.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:31.761Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/List-36999650.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://coccin.vip/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-3af1\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15089,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (15088)","md5":"e08f5157dc15fa4bc75d44bafbb15a69","sha1":"80f138479bff12a05fc318d7d47ff128c19e6982","sha256":"120942990d5807553845643a518cb789339c16ec653045aebb7553d65f98abe3","sha512":"8e74aff132e77b4d97ab6e8b67e49b90e93f27197058c68d0c420d3043d81be8c4dc9f8394c01f3e31c062683dc0b0f96906239c2c17417229f8bbc97c2b7bdf","ssdeep":"384:tGVXW789Hc7Qcotclcojcouco0citcoFciacimciUco9Ibcgu4myMG2V3CJLyk4l:IVXW789zIbcb4myMvbm8","tlshash":"1762c71ca8228fb9eed70c3dac2269c011fb9f928dddc013e2f54d2d16d5ce6064e5a5","first_seen":"2026-01-13T05:15:15.416478Z","last_seen":"2026-01-13T05:19:16.298766Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1146,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/png/swipe3-f8d76057.png","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.480Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/png/swipe3-f8d76057.png HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-25bf\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9663,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 332 x 332, 8-bit colormap, non-interlaced","md5":"bec8f6241d3f99d073d56d412f967b48","sha1":"07b2ebae5d58f94735c3fb2fd747b2d373c86143","sha256":"f8d7605793d730bcc0197b52f419ad5929daad352adda481a3d0e25b1a9c010a","sha512":"1c0bd2384906737b8c72440ef22fbe3beb5f2aba515b5e0563f0a15a8d058aa3840d516195eb910b37004e39a4b221aca51875a08246e5de11e1bd4032f325f6","ssdeep":"192:pA1VfJsE8eTYsoUZTl9zpy0Tu5HkhkJ55IRMkl2qqp9CgUxoHuRnwvh9G7:m1dJ0e8UIZ+kn5IRMkEERo/m7","tlshash":"a612a0c6738c5dd3a87d21696649b1d66d38b61058fcfca49f81b8d301fdc0464b7d2a","first_seen":"2026-01-13T05:15:15.428176Z","last_seen":"2026-01-13T05:19:16.299522Z","times_seen":2,"resource_available":false,"data":null}},"time_used":317,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":317,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/css/index-b02d7de0.css","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.498Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/css/index-b02d7de0.css HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-2a80\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10880,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (10879)","md5":"92c64522ec15c4f97ea2e56358016edd","sha1":"49de4cb45efb64ed248e9985c4e6b351cca663b8","sha256":"b02d7de03ba6d4807efe2b8765cdf3b575df8f142fa436341671d4759c398fe3","sha512":"c7e3fc374c08577485288eb62b979a35d93b6e80fee0c697c44d935089be59dd65cc9bffa622c644665b060e7cda926bb9925955eccbfa16a16a2c5babe95bd9","ssdeep":"192:SzCYgwW6SqIiaQwo78rj3adwWCX4A46P25SQYwBpLjiEC8D:Kgw7STiaho78KdwvXhBP2owBpiEn","tlshash":"1b227ab3b08dd47f3563d5bd1966ee34112c7a27dd062bb8a93ae0b4b84758122f2871","first_seen":"2026-01-13T05:15:15.408314Z","last_seen":"2026-01-13T05:19:16.300183Z","times_seen":2,"resource_available":false,"data":null}},"time_used":361,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":361,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/api/api/publicRealtimeTop?type=cryptos\u0026language=en","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:35.468Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /api/api/publicRealtimeTop?type=cryptos\u0026language=en HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nsystemRandom: 1768281515145086\r\ntissuePaper: 1768281515\r\nsign: C14CDFA26F39FCD0A2CFF6B93D2F6AA7\r\nx-api-client-timezone: UTC\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:35 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nx-frame-options: DENY\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":891,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"596accabd92baf70ac50934135401391","sha1":"9f157347276b02ae8ad3881fc27bc50b5d95d2e7","sha256":"01e5b7a7ab27af9e8cf0536c64a45d83a725393d30c9fc911530033a099c4484","sha512":"f9e32a972edf78ad8f9d47b438be29139300a7b9387f3d25ca71700d6a02be3e3c2ee2939465a29d817bedb539624c127e6ecb9b905e8f31ff23916bb49340d8","ssdeep":"","tlshash":"2711c0a57f948e6617a211d30df37a7e1054aae2c0640e84dbad9e5880ccc927a1fa09","first_seen":"2026-01-13T05:19:16.300833Z","last_seen":"2026-01-13T05:19:16.300833Z","times_seen":1,"resource_available":false,"data":null}},"time_used":257,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":257,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/api/api/publicRealtimeTop?type=cryptos\u0026language=en","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:43.469Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /api/api/publicRealtimeTop?type=cryptos\u0026language=en HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nsystemRandom: 1768281523975252\r\ntissuePaper: 1768281523\r\nsign: 07AD6076E77BEC412F52BCC28D56EEA7\r\nx-api-client-timezone: UTC\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:43 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nx-frame-options: DENY\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":890,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"36c79f7979bdf680c293ac1a0d3b6693","sha1":"1777ec63d595fc9f927dae4b119276d84c9db09e","sha256":"56c7737c014a919beef47958cd8b0b39971eea5f886166bc115fbc583f813543","sha512":"b5a907f07f326357088ee6ec39f4b0d512a4da2ee3755f703e6867d6ed6958e6d02e17eac8862a047e719d16439f084e45a3cabfe8c63df182c20e0bc103adb5","ssdeep":"","tlshash":"b711dc91bf548a764ba310830ef36a7d10a866e2c0b44ec0d7adee5490cc890761f909","first_seen":"2026-01-13T05:19:16.301658Z","last_seen":"2026-01-13T05:19:16.301658Z","times_seen":1,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":283,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/vant-e1aa18c9.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:31.688Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/vant-e1aa18c9.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://coccin.vip/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-26215\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":156181,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"73c8391cd10d500fde5ec52c808c0121","sha1":"0d063440cadea65d63aa642969472a6e266e240a","sha256":"e17d78a1191501e3fc10d854310127f5e0b8a3b919d520555565294c7c3c9048","sha512":"2be78044c68beb227f78909540ecf75e8173045e6266161cb8239c296050f4655505efe32cae5b69985b1782250b423d5af6da68a3b137a0455ce82a517aa853","ssdeep":"3072:XcE0+J8Pggn7cRoT/0i1zJT3A4S4Hwhj92Je3FS6CfiMtMwQT3DbQ+iOjHW3:XcEKgg7t5LS4Hwhjj4PtI/FjW3","tlshash":"8fe34bc0b8d9b43987bb95e4807a0811b62d1f48b009c4e0f07e9d593b699d4b6bff2d","first_seen":"2026-01-13T05:15:15.405276Z","last_seen":"2026-01-13T05:19:16.302546Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/search-e4a3a12e.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:31.765Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/search-e4a3a12e.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://coccin.vip/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-85b\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2139,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (2138)","md5":"c859fdeda2e597ff9352c64ee2550f2b","sha1":"fa3f9b77cafa6f3355bd6aeeb602852a732aed67","sha256":"debf94c5ae4b9eb7f578fbd5fe5abba7e8e1caa7ddc80fbd4a48fdd24554a081","sha512":"4022f8ae7ead4b2e8ad424827700c362bbe91655f79678d5f6d927a4f69dc671e32b90e08aa1726ada9cc8e5e558e5f2335b1e8790b5c750fc6ef2b5fe83ff75","ssdeep":"","tlshash":"924129f22c121e10764c1bd8e78a19ad0c21bb8dd0b37bd08ecdea0a961e066e930472","first_seen":"2025-08-27T06:41:40.812381Z","last_seen":"2026-08-05T04:56:14.340695Z","times_seen":10,"resource_available":true,"data":null}},"time_used":1145,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1145,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/png/title-590569c9.png","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.497Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/png/title-590569c9.png HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-48c5\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18629,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 320 x 320, 8-bit/color RGBA, non-interlaced","md5":"42b24f133043eecbeaf012646987f122","sha1":"9ee1c74c9b4a8a01a2c16894b7f1bca6127b2716","sha256":"590569c9edf32bcf44e9acb79620ea058632b7b95e8b7ac1fed7f62ff14b6514","sha512":"addfb42599c2fdd02d2d96056e1afeedfe157a56c43a25092ded9313550574a20610b03573f1539429b8c6bec7fe5d609a7aaccb16fe5b1c6f1aec5eb4a8389d","ssdeep":"384:0970BScz11Yqs0TILxfZPGIj2ZbPxAJXtainu75jU9T7s8:MIBdsbqGdGO2tYln0jsn9","tlshash":"8282c0a3a2b359c1de2a94d8f9692232330681134467c1cb9638d0db35fd6be91bce4d","first_seen":"2024-08-21T10:14:45.559555Z","last_seen":"2026-01-13T05:19:16.303774Z","times_seen":3,"resource_available":false,"data":null}},"time_used":357,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":357,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/api/api/publicRealtimeByType?type=cryptos\u0026pageNo=1\u0026language=en","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:41.468Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /api/api/publicRealtimeByType?type=cryptos\u0026pageNo=1\u0026language=en HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nsystemRandom: 1768281521802277\r\ntissuePaper: 1768281521\r\nsign: 3A736DA070EDF696ECC29E36BED71C24\r\nx-api-client-timezone: UTC\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:41 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nx-frame-options: DENY\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5272,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"71e4f49a391c9412e4cb3683a9441332","sha1":"4d0beac29eca3b87fbb5c9c61cd6120a3983c99a","sha256":"1c5063af6ac1b763d93c5270630397f65bbb0e2a1bc3e24e9579ae0404df8fe1","sha512":"cb613d98e0a5270a485125a7600b0b52bca288a959da68ed0d4725895cba7cdbef7e3aab658c709d6e38cbd8843de9b876a3bcf158360303c7db28736688cf03","ssdeep":"96:vliObZsBNcOLzOngHXg9VJeQLym+dXE87Le4FyYD1Nub7rtnGjTkiUE0iDQE8Evf:PWNJsYQLGXXL91Arq0pEBJkE9wh1VloX","tlshash":"07b10fe5bf988f6957e315430df3966c10143ae2c0a54ec4abbecd98d0ccea1751f618","first_seen":"2026-01-13T05:19:16.304367Z","last_seen":"2026-01-13T05:19:16.304367Z","times_seen":1,"resource_available":false,"data":null}},"time_used":263,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":263,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/css/vendor-cd61fefb.css","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:28.453Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/css/vendor-cd61fefb.css HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-202c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8236,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (8235)","md5":"9720d313c57964bfc483bb1aea702154","sha1":"755a3eab8810207cabf677786378c1a8e6ebfa3a","sha256":"cd61fefb29122944aa17ddb529180b986ef15eba763a3d382d90e514f5da5aab","sha512":"8c5f2135bbd324c442f29b30b63c0ef36d0a8b54893411dc2adf3b2b4fb9da8805643f40ed869bbc366d6fca3b4317699653f2e4f4dd93732f2c6c331700ee03","ssdeep":"96:qON/zs9omMHE64mtq0rHr53rWnrDjrQIPgwgO7o7W7m7/lFLR4LHhyqBG0GDKAMr:s9omMJL57WrDXQNR4ewAmFGLRM","tlshash":"e602f021a231140ddc1bd33ab4d0bddcd26ae186b5a20b9de794731dcecd9ea24766cc","first_seen":"2025-08-27T06:41:40.838533Z","last_seen":"2026-06-27T23:38:59.275731Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1009,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1009,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/logo-00b56da7.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.164Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/logo-00b56da7.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/syn/js/List-36999650.js\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 53\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\netag: \"69493319-35\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":53,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"8be23fc935b55ca759d0e1b154db5b49","sha1":"dc8d5c498136da6dc61116a88608ec83d52fd154","sha256":"2836482495dc2bb79b13b7a515b98937877b6a1119d4fb8d0f7f8647b5893f37","sha512":"9311c85c0e41f1011a731482cd50d041dc291b9a0c53707b4deea63d15b7812b3d09734cc019bf2d489339ff4d35636c9927096e4bb67704be1edce44938bd4b","ssdeep":"","tlshash":"519002365904656009c5004dd792e814042554bd6155199b84290981d7a2048df99514","first_seen":"2026-01-13T05:15:15.429228Z","last_seen":"2026-01-13T05:19:16.290557Z","times_seen":2,"resource_available":true,"data":null}},"time_used":244,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":244,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/png/swipeNew1-f824ea59.png","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.483Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/png/swipeNew1-f824ea59.png HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-3447\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13383,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 332 x 332, 8-bit colormap, non-interlaced","md5":"63d959a5a2ab05718c827c702d8a538c","sha1":"8d4fdc4a249170b039753e564631feae6fde1304","sha256":"f824ea59fa658e9f0c9713ffdf894ee4c793cf2b374a8096ee1fe20fb510cc82","sha512":"857d7ad7d51b5b6d79bd5a4c61b176ec2fcd4240ad14fe0906beb98f95a674837f4765ea93336dc1779b85cbfc9e89bbbf5243df8c61e97d413f92ce189cf014","ssdeep":"384:mChL65Rv8Mrpoez2FVcFCAexEMEP6KPSaN68gJutIjJ:mCBIwQ2LWCR0E9","tlshash":"ed52c0efe2f0c15a70c178387af98678a098c9744fd7f06c28f8b53c4c69616b03a219","first_seen":"2026-01-13T05:15:15.420698Z","last_seen":"2026-01-13T05:19:16.30616Z","times_seen":2,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/api/api/news!list_v2_popup.action?language=en","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:35.017Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /api/api/news!list_v2_popup.action?language=en HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nsystemRandom: 1768281515258048\r\ntissuePaper: 1768281515\r\nsign: 4CAD0B6FA3F71350EE3AF4ECE588DC7B\r\nx-api-client-timezone: UTC\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:35 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nx-frame-options: DENY\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":54,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"3fc32505f0e4df38c160361aba0c2d3a","sha1":"8d7762a126311c464efdcfb4e2c0da9bafa2eb5f","sha256":"356d2ce4062e4a7a2162607498740eba4c3fea017145a4d39c634c5bb0143d19","sha512":"26d6ef93bb5e0745908781d261637e85d792c9ff508c38c184e61ef8255c1119cd079866a4b451abbbc788880b178a6b9021378e50db65daf2ff5e747e7850dc","ssdeep":"","tlshash":"03900213151c2592574561dc211b5a6501a510764d155771c8cc9f288a1a0d16b01521","first_seen":"2024-11-12T08:48:04.664014Z","last_seen":"2026-07-22T05:15:59.511974Z","times_seen":53,"resource_available":false,"data":null}},"time_used":255,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":255,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/api/api/exchangerateuserconfig!get.action?language=en","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:35.028Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /api/api/exchangerateuserconfig!get.action?language=en HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nsystemRandom: 1768281515577315\r\ntissuePaper: 1768281515\r\nsign: 2BF134363572233C8B7D48638A502745\r\nx-api-client-timezone: UTC\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:35 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nx-frame-options: DENY\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":117,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"397a80485219a2f751c8d64ce7f37015","sha1":"22ff7a53330461de70984ec346668f4423976fb3","sha256":"bda20e3c46f9869ab1952ae186680c7e93f47d48d3d93b28dd94df449a1fb14e","sha512":"7187b7132cc69a386ff1bd69524b8f5650b93b72d46dd65fa5194732f122ade3df330e95cc52d057734b38dede3dc3f6017b784ea276d0e3105ffb06bd2858d7","ssdeep":"","tlshash":"8cb09b02102d4aa5c25290dd6145592d562115221d95577085dc4e14864a0c5d605935","first_seen":"2025-08-27T06:41:40.794092Z","last_seen":"2026-06-24T06:42:59.885944Z","times_seen":16,"resource_available":false,"data":null}},"time_used":259,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":259,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/api/api/publicRealtimeByType?type=cryptos\u0026pageNo=1\u0026language=en","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:39.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /api/api/publicRealtimeByType?type=cryptos\u0026pageNo=1\u0026language=en HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nsystemRandom: 1768281519163395\r\ntissuePaper: 1768281519\r\nsign: FB2697A9323A7B12D85C2A0F9263C336\r\nx-api-client-timezone: UTC\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:39 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nx-frame-options: DENY\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5269,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"18dfd39cf6c3dd167bef3f983cb49425","sha1":"366c1036df2b74cda7f8f85c8102a2a08244dd06","sha256":"9866c16545a4b9bcb9233b5eaf1ba155d5ae4220f95ab44619d433ecadf09478","sha512":"12430ffce4259b06ac0788ace0614daa452d324d2739bb40763d139eb1b0f20cc87c665c1c640aec75ea1fc6b2297faf83438065e6e2ba1df43804e5d34aa37d","ssdeep":"96:AlitUZsBNcOLEOngHsyVJydvzm+pj87Npz4FEtQub9rqnGHB4ki2b0iDQErEvHBO:RbNJRbvjoNpd9r9LWEmE7/Cw0Yhreop/","tlshash":"5cb1cea57f988f6913f315430de39a7c12147ae2c0994e89abface9d80ccda1751f618","first_seen":"2026-01-13T05:19:16.308015Z","last_seen":"2026-01-13T05:19:16.308015Z","times_seen":1,"resource_available":false,"data":null}},"time_used":272,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":272,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/css/index-60a0353f.css","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:28.458Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/css/index-60a0353f.css HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-e144\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":57668,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (57667)","md5":"78fe8011792cd3e96f1a689aab03fe47","sha1":"a660d29ecbf3fc47e20bb413be3a1492bd77cc80","sha256":"60a0353ff941693fb9fd893939826296aae16166c05c47721685b83052631355","sha512":"fffc786bf014a4c5c77362ea7955bf6112e771d653d75b2532a46ac4a31eb20944b1670c9fd374382efccc34fa31c81f4b456dede7a1a298d1513c2ba4e999d3","ssdeep":"384:uXHYG1CET2mYouHJNWC7BKcJgw7STiaho78OdwvXhBP2Ew7pSGiM0gw7STiaho79:MVC7BKcuMjEFGKZ7","tlshash":"684394abb8cc202d7763c1f9d075efa81218b20ac2445bdef92b75716dc72d22a73549","first_seen":"2026-01-13T05:15:15.412363Z","last_seen":"2026-01-13T05:19:16.308887Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1008,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1008,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/ttf/iconfont-a9696848.ttf?t=1763877526057","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.529Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/ttf/iconfont-a9696848.ttf?t=1763877526057 HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/syn/css/index-60a0353f.css\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 7712\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\netag: \"69493319-1e20\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7712,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 11 tables, 1st \"GSUB\", 18 names, Macintosh, Created by iconfonticonfontRegulariconfonticonfontVersion 1.0iconfontGenerated by svg2ttf from F","md5":"0d3ae473611cf8d4ad24e093af1571e6","sha1":"cb826b1450b3309d27d27ffbbc247632e972ac33","sha256":"a9696848a5c7e045a430c0a08dccc2dfb7c58667f188f7592e7fa05f39ea40c5","sha512":"ad4bf2a4bcf9af690508fda4cfd78eb182d5e8a5a0807ee61a76af4315e713eb287dfa426b238e8d4b0530deda43113dfda9c091c14d6ca0bc6c89b27a9b3a13","ssdeep":"192:0//cpHk+vIzdCTLu0cPAoKfArCZ8fusWpV:0OuhCTySABGDV","tlshash":"19f13c61cbb9afcfc56a6a3c28775b024bbdf830717ac70b81546caf48298a40da4705","first_seen":"2026-01-13T05:15:15.418066Z","last_seen":"2026-01-13T05:19:16.309473Z","times_seen":2,"resource_available":false,"data":null}},"time_used":437,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":436,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/css/vant-2db668ec.css","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:28.454Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/css/vant-2db668ec.css HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-30d0a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":199946,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"8f3de7106d2af3e1f19d4e4b3f7ab3c3","sha1":"b573d49a6c6c0d1793cfcb3a7e3bbb47cfd8ae7a","sha256":"2db668eca5c178042d1829dabf3d94d159b58bfb6fc174dd9d55dc650b463411","sha512":"98ae01225d8b331a8b2a6deb9b4d8694e020b359a14a515cd1be7e17714cef6e44d5a05e17afa6f38befb69f09f7c3b6d6a38332b32758b6d8a193e6532318f7","ssdeep":"1536:DaEVKV6N7QbFNJ+jqkiHckCwsBlDOFIxuVoxmN1/V1Af5a4zU:ZNmClDsIxuVSm/Ks","tlshash":"5514a595e69091bcbf27f175ab8b96dcf23cf560ed01daa4f10091580ec7bf50623a1a","first_seen":"2026-01-13T05:15:15.426138Z","last_seen":"2026-01-13T05:19:16.310075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1009,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1009,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/author-f8e4f331.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.164Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/author-f8e4f331.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/syn/js/List-36999650.js\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 55\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\netag: \"69493319-37\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":55,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"e0b14fabcc8d166bc3cf633258dab47a","sha1":"5c1553e7fe0a70ce31bd5fe4492c8ae315695b9e","sha256":"aa6c1ef25b0022b34623cdf971112dfeb238e6467285725410a14617e09b0b89","sha512":"f0c6f2b6e779a87ef3997278267de465e52889815e26783279a2729a5dabf3ed77209640f1b881135d3ea8da433fc7591ca477eabb75d2e425193c25d633f6ee","ssdeep":"","tlshash":"1a9002221420656058a90088d722c9658b51100d61686565d60a4506e5136859a6e518","first_seen":"2026-01-13T05:15:15.398388Z","last_seen":"2026-01-13T05:19:16.310668Z","times_seen":2,"resource_available":true,"data":null}},"time_used":244,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":244,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/financialManagement.api-ddd7aaf8.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.557Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/financialManagement.api-ddd7aaf8.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://coccin.vip/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-540\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1344,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1343)","md5":"3f6c2b32ca6d99283c370afe2325e4ef","sha1":"52c5c210a15e6146fad19f1dc36c6c5d9d3cd3be","sha256":"0ccb8a4765d322e4d4b3bbcb8328605321eb289728d5f58096de3069cdca3f8d","sha512":"db440aaeced903c89c65e27d6f95b00e2903c7121a0d739ca818e18ca2c593bcca0069e3124c9aa990f4d68a1a62b2a75264ce4e90fcd13f5747e44d6021ee0c","ssdeep":"","tlshash":"9e21811b6c07e13e5289d58ebb7e862d8497cf25f96624e83f001c19dbf967d8142418","first_seen":"2026-01-13T05:15:15.411467Z","last_seen":"2026-01-13T05:19:16.311229Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1044,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1044,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/vendor-5b6902f7.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:30.247Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/vendor-5b6902f7.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/syn/js/index-3b66fcd5.js\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:30 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-23b7f9\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2340857,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (36722)","md5":"bb8a3841c0c16d9e56e2913800de198f","sha1":"ef26014008ce61d61dbcadf869987438586b7919","sha256":"fa590abd955d6ffa8124a8d0b80c0d2840cab022ec7b2218ca8a52b952b6121d","sha512":"fc403960b540aaae96167942c1819ee808e78732477bf8afa833567920b748b9ef5da1fd72d7a72203a67818599b6cec3ffd4c81b24966adf5d0ee75d3a4db6b","ssdeep":"24576:BE5oNf2ed7yrJhK4FAd3uguFXk6M6WKzqyPReym:uSNf2ed72IuguFXk6MIqNd","tlshash":"89253be8b2a2745142a362f454bf140bf33a184d6488c498f569d9ee2dfd40d66bbf3c","first_seen":"2025-11-25T03:02:04.557179Z","last_seen":"2026-01-13T05:19:16.281017Z","times_seen":3,"resource_available":false,"data":null}},"time_used":274,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":274,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/css/List-764af924.css","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:31.753Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/css/List-764af924.css HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:31 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-4597\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17815,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (17814)","md5":"261325fe7c28a5eb74e15918a3af6350","sha1":"ff9ef40749c32f7cf458e52d71114aa41e64bc88","sha256":"764af924cae0c7fd2d8a933e95199a46abaf8b862d513957aab0471d13ade851","sha512":"21ccaa86dbffc16358ea2661bba1f3f1afd57aeaf8736ce18784dfdfcaf1a9b1b5fd92779473eb7e688962d3562af04b3c2468668f851df26b32564812ae86eb","ssdeep":"384:Ggw7STiaho786dwvXhBP2cwrJuo+FphdAokWCaxxwqH:NoOdAokwwqH","tlshash":"188230a6b08dd1697463d5bd2c34db17121cb387d1040baafb2bf4b4fe875922abe441","first_seen":"2026-01-13T05:15:15.424389Z","last_seen":"2026-01-13T05:19:16.311787Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1146,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/List-36999650.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:32.912Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/List-36999650.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/syn/js/index-3b66fcd5.js\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-3af1\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15089,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (15088)","md5":"e08f5157dc15fa4bc75d44bafbb15a69","sha1":"80f138479bff12a05fc318d7d47ff128c19e6982","sha256":"120942990d5807553845643a518cb789339c16ec653045aebb7553d65f98abe3","sha512":"8e74aff132e77b4d97ab6e8b67e49b90e93f27197058c68d0c420d3043d81be8c4dc9f8394c01f3e31c062683dc0b0f96906239c2c17417229f8bbc97c2b7bdf","ssdeep":"384:tGVXW789Hc7Qcotclcojcouco0citcoFciacimciUco9Ibcgu4myMG2V3CJLyk4l:IVXW789zIbcb4myMvbm8","tlshash":"1762c71ca8228fb9eed70c3dac2269c011fb9f928dddc013e2f54d2d16d5ce6064e5a5","first_seen":"2026-01-13T05:15:15.416478Z","last_seen":"2026-01-13T05:19:16.298766Z","times_seen":2,"resource_available":true,"data":null}},"time_used":246,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":246,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/png/swipe1-ba365e4c.png","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.474Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/png/swipe1-ba365e4c.png HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-30db\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12507,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 332 x 332, 8-bit colormap, non-interlaced","md5":"8e3f4ddd554982319d5837b771497945","sha1":"efcf5f25c0efbf46068549f6145647cc557dcfa3","sha256":"ba365e4ccb316c27a7c12aa58b6a478032d2c871a9e0aeea100eaf26444dd66e","sha512":"7d906f2b1c895594c7919dae153240d36bcaed9faab801aa539669c32bbe5e375c7068cfb240f707776e7dca17521cea0d232c3c07ad85d83930a3aeec536cf5","ssdeep":"192:Fv/JEASMsEHRsoABFxw933zkV1yH+YfaZgBt02TRd0dkB1FtTj+0tXolL903ZxH:XNSMsvvHMjkQ+Yf93mkzFljj8LaJt","tlshash":"7b42c0cd89e9c7f5cd4a7fad01c0a7700e6ac94b1013473e1c3de7742d9ca46a99b952","first_seen":"2026-01-13T05:15:15.404337Z","last_seen":"2026-01-13T05:19:16.312303Z","times_seen":2,"resource_available":false,"data":null}},"time_used":301,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":301,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/index-3b66fcd5.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.553Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/index-3b66fcd5.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://coccin.vip/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-220903\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2230531,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"f1ee7435e7c2e82912265a3a196f87ac","sha1":"5af67d7390edad694486e8c609a09bf05d30d28e","sha256":"ba2e6451447fdab6ca22a5f8dff1294b48f0de116fef36bb0b3978d5ef6a7c22","sha512":"312d231d55169f89eea7de7a9c00b157c74d9c799475112fb3d34f8595d97dbf621acb86064f095f55506f29ff7de243db24f8f7bd748fd7aebdee45664027bf","ssdeep":"6144:aybOJ5FiRSnLt/O64oAIOjiaqOcZoUifSX1x7l8ZUj31wyLbNMrPvxbvInHqokkt:JSLtA2ZOIxbl/Nn","tlshash":"18256fae9b2611610dea48c8dc552b8eead16f0852639f3bd2fff6a27301015d153b3d","first_seen":"2026-01-13T05:15:15.397441Z","last_seen":"2026-01-13T05:19:16.312901Z","times_seen":2,"resource_available":false,"data":null}},"time_used":440,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":440,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/png/swipeNew3-bbbd218c.png","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.491Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/png/swipeNew3-bbbd218c.png HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-27f2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10226,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 332 x 332, 8-bit colormap, non-interlaced","md5":"6c2627a09cb5a4b6e11fa990386f62c6","sha1":"a2652767030cc49d29181f2e634abe706ae87d46","sha256":"bbbd218c86cf8cadab9d569c69a1b204f0c0679771bfa26069a6037439fd2248","sha512":"ebca3f0bbda7d15c37fc039d72868ed0f58d7edc0aa5496b174cbd32740c7de2406536ae558e636ff7ff15b4b9443e786506ebb51c68029b3788841a2bf0df62","ssdeep":"192:i8otVspQYMOzlNH1DFiC8rC4HRjXSFU9/UbLfm:i8osWqzLVDFiCKtRj4U+P+","tlshash":"f322ae2e1777f1af408c673d2031856ec1f7ab928b2f289a7176d0da59d41b84325f83","first_seen":"2026-01-13T05:15:15.41718Z","last_seen":"2026-01-13T05:19:16.313567Z","times_seen":2,"resource_available":false,"data":null}},"time_used":344,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":344,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/financialManagement.api-ddd7aaf8.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:34.618Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/financialManagement.api-ddd7aaf8.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/syn/js/index-332e8f65.js\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:34 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-540\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1344,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1343)","md5":"3f6c2b32ca6d99283c370afe2325e4ef","sha1":"52c5c210a15e6146fad19f1dc36c6c5d9d3cd3be","sha256":"0ccb8a4765d322e4d4b3bbcb8328605321eb289728d5f58096de3069cdca3f8d","sha512":"db440aaeced903c89c65e27d6f95b00e2903c7121a0d739ca818e18ca2c593bcca0069e3124c9aa990f4d68a1a62b2a75264ce4e90fcd13f5747e44d6021ee0c","ssdeep":"","tlshash":"9e21811b6c07e13e5289d58ebb7e862d8497cf25f96624e83f001c19dbf967d8142418","first_seen":"2026-01-13T05:15:15.411467Z","last_seen":"2026-01-13T05:19:16.311229Z","times_seen":2,"resource_available":true,"data":null}},"time_used":249,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":249,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/api/api/publicRealtimeByType?type=cryptos\u0026pageNo=1\u0026language=en","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:37.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /api/api/publicRealtimeByType?type=cryptos\u0026pageNo=1\u0026language=en HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nsystemRandom: 1768281517186394\r\ntissuePaper: 1768281517\r\nsign: 6FF603F8B3A007D884F6A8FD8118830B\r\nx-api-client-timezone: UTC\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:37 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nx-frame-options: DENY\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5269,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"18dfd39cf6c3dd167bef3f983cb49425","sha1":"366c1036df2b74cda7f8f85c8102a2a08244dd06","sha256":"9866c16545a4b9bcb9233b5eaf1ba155d5ae4220f95ab44619d433ecadf09478","sha512":"12430ffce4259b06ac0788ace0614daa452d324d2739bb40763d139eb1b0f20cc87c665c1c640aec75ea1fc6b2297faf83438065e6e2ba1df43804e5d34aa37d","ssdeep":"96:AlitUZsBNcOLEOngHsyVJydvzm+pj87Npz4FEtQub9rqnGHB4ki2b0iDQErEvHBO:RbNJRbvjoNpd9r9LWEmE7/Cw0Yhreop/","tlshash":"5cb1cea57f988f6913f315430de39a7c12147ae2c0994e89abface9d80ccda1751f618","first_seen":"2026-01-13T05:19:16.308015Z","last_seen":"2026-01-13T05:19:16.308015Z","times_seen":1,"resource_available":false,"data":null}},"time_used":263,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":263,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/vant-e1aa18c9.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:30.249Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/vant-e1aa18c9.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/syn/js/index-3b66fcd5.js\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:30 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-26215\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":156181,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"73c8391cd10d500fde5ec52c808c0121","sha1":"0d063440cadea65d63aa642969472a6e266e240a","sha256":"e17d78a1191501e3fc10d854310127f5e0b8a3b919d520555565294c7c3c9048","sha512":"2be78044c68beb227f78909540ecf75e8173045e6266161cb8239c296050f4655505efe32cae5b69985b1782250b423d5af6da68a3b137a0455ce82a517aa853","ssdeep":"3072:XcE0+J8Pggn7cRoT/0i1zJT3A4S4Hwhj92Je3FS6CfiMtMwQT3DbQ+iOjHW3:XcEKgg7t5LS4Hwhjj4PtI/FjW3","tlshash":"8fe34bc0b8d9b43987bb95e4807a0811b62d1f48b009c4e0f07e9d593b699d4b6bff2d","first_seen":"2026-01-13T05:15:15.405276Z","last_seen":"2026-01-13T05:19:16.302546Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1005,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1005,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/search-e4a3a12e.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.162Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/search-e4a3a12e.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/syn/js/List-36999650.js\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-85b\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2139,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (2138)","md5":"c859fdeda2e597ff9352c64ee2550f2b","sha1":"fa3f9b77cafa6f3355bd6aeeb602852a732aed67","sha256":"debf94c5ae4b9eb7f578fbd5fe5abba7e8e1caa7ddc80fbd4a48fdd24554a081","sha512":"4022f8ae7ead4b2e8ad424827700c362bbe91655f79678d5f6d927a4f69dc671e32b90e08aa1726ada9cc8e5e558e5f2335b1e8790b5c750fc6ef2b5fe83ff75","ssdeep":"","tlshash":"924129f22c121e10764c1bd8e78a19ad0c21bb8dd0b37bd08ecdea0a961e066e930472","first_seen":"2025-08-27T06:41:40.812381Z","last_seen":"2026-08-05T04:56:14.340695Z","times_seen":10,"resource_available":true,"data":null}},"time_used":244,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":244,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/css/index-52996893.css","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.500Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/css/index-52996893.css HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-be6b\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":48747,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (48746)","md5":"cbdd6c9ce677f02e101e354071105c3e","sha1":"d7dec65ee979dd6eeadfe5a7f3ec190498333735","sha256":"5299689379673bd26483b7c7507916ca48076279ab04d2d53dbdee34e5af7172","sha512":"9d9f4f81a00455f5e2f3bab025ecb3d44ea6306a2b2bdaf6363b74c920a125ff1cd8da65471fb2ced5304238387e8776b9d60e08ae785ee7039cb7fbcdc4c216","ssdeep":"384:xgw7STiaho78XdwvXhBP2zwkaH2tgw7STiaho78LdwvXhBP2DwgeX2Wgw7STiahE:z2D2rAoukzG","tlshash":"65231273b0cc647a3a67d8bd2c7aefa812287717c1440bacbe6d76b47c8b08525b3551","first_seen":"2026-01-13T05:15:15.430891Z","last_seen":"2026-01-13T05:19:16.31414Z","times_seen":2,"resource_available":false,"data":null}},"time_used":463,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":463,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/api/api/publicRealtimeByType?type=cryptos\u0026pageNo=1\u0026language=en","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:43.465Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /api/api/publicRealtimeByType?type=cryptos\u0026pageNo=1\u0026language=en HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nsystemRandom: 1768281523196214\r\ntissuePaper: 1768281523\r\nsign: A4266DBCFD00869652DCCEDCBCC7C0DE\r\nx-api-client-timezone: UTC\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:43 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nx-frame-options: DENY\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5272,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"71e4f49a391c9412e4cb3683a9441332","sha1":"4d0beac29eca3b87fbb5c9c61cd6120a3983c99a","sha256":"1c5063af6ac1b763d93c5270630397f65bbb0e2a1bc3e24e9579ae0404df8fe1","sha512":"cb613d98e0a5270a485125a7600b0b52bca288a959da68ed0d4725895cba7cdbef7e3aab658c709d6e38cbd8843de9b876a3bcf158360303c7db28736688cf03","ssdeep":"96:vliObZsBNcOLzOngHXg9VJeQLym+dXE87Le4FyYD1Nub7rtnGjTkiUE0iDQE8Evf:PWNJsYQLGXXL91Arq0pEBJkE9wh1VloX","tlshash":"07b10fe5bf988f6957e315430df3966c10143ae2c0a54ec4abbecd98d0ccea1751f618","first_seen":"2026-01-13T05:19:16.304367Z","last_seen":"2026-01-13T05:19:16.304367Z","times_seen":1,"resource_available":false,"data":null}},"time_used":298,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":298,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/index-3b66fcd5.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:28.451Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/index-3b66fcd5.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:28 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-220903\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2230531,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"f1ee7435e7c2e82912265a3a196f87ac","sha1":"5af67d7390edad694486e8c609a09bf05d30d28e","sha256":"ba2e6451447fdab6ca22a5f8dff1294b48f0de116fef36bb0b3978d5ef6a7c22","sha512":"312d231d55169f89eea7de7a9c00b157c74d9c799475112fb3d34f8595d97dbf621acb86064f095f55506f29ff7de243db24f8f7bd748fd7aebdee45664027bf","ssdeep":"6144:aybOJ5FiRSnLt/O64oAIOjiaqOcZoUifSX1x7l8ZUj31wyLbNMrPvxbvInHqokkt:JSLtA2ZOIxbl/Nn","tlshash":"18256fae9b2611610dea48c8dc552b8eead16f0852639f3bd2fff6a27301015d153b3d","first_seen":"2026-01-13T05:15:15.397441Z","last_seen":"2026-01-13T05:19:16.312901Z","times_seen":2,"resource_available":false,"data":null}},"time_used":493,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":493,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/png/logo-3c4df697.png","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:32.675Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/png/logo-3c4df697.png HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-a511\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42257,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 320 x 320, 8-bit/color RGB, non-interlaced","md5":"b6e0f154add0bf36cad0c67fb899bad2","sha1":"d485a721257706732d3c05daf988e1aa6eb431a2","sha256":"3c4df69705e8fa998d2f0a9e051919195e1f5b251cc999bbd66fa6747e8808ef","sha512":"aa2a17b54e87e93f0b598623a6bf9c635f61642e5c709fad325afa971775a4b649784da82ba07675e5c7a406c7bf844821f441b0f7356f43577faec7ef6b29fd","ssdeep":"768:z5Ml7nV2lgFyp8BhdF7WvypYZ1BFI09xs1PqAqknnZIk:z5MBn8lgFyp2lWhL3/mqAq8Zp","tlshash":"8113f1d6234993bec7143b2f5dee9373d721c296c20a8431f62f49727841f8ea615c9a","first_seen":"2026-01-13T05:15:15.406142Z","last_seen":"2026-01-13T05:19:16.285924Z","times_seen":2,"resource_available":false,"data":null}},"time_used":304,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":304,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/logo-cf27a524.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.559Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/logo-cf27a524.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://coccin.vip/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 53\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\netag: \"69493319-35\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":53,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"af80ce9200c76157c9379bb76cb8e862","sha1":"cef15198ae37892cd10cf90e412c3afb78bf34f1","sha256":"a7196ae54f59a5671c150a5f435bb9250947661886e617816d75a3e3ee5cde1f","sha512":"b71b927cb25d1a887f881eb4de048404dd0029ab3eb47a0fe3b2d3dc7457c64a3721813a15670033ae53f302879eb151baf497f22c0cb2d917c6c3acd9f6418b","ssdeep":"","tlshash":"6a900236650565a058c40099d7529c54041565ac6155195684190581d7610489e9a925","first_seen":"2026-01-13T05:15:15.422412Z","last_seen":"2026-01-13T05:19:16.295458Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1043,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1043,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/api/api/publicRealtimeByType?type=cryptos\u0026pageNo=1\u0026language=en","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:35.466Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /api/api/publicRealtimeByType?type=cryptos\u0026pageNo=1\u0026language=en HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nsystemRandom: 1768281515919675\r\ntissuePaper: 1768281515\r\nsign: 295C839D6783CF718F9DAA52E0073999\r\nx-api-client-timezone: UTC\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:35 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nx-frame-options: DENY\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5274,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"b504ae4c5fabce0119570a1bcdabf4cf","sha1":"7696b62e3015108d30c16995f7187c64660ff890","sha256":"e64e2e9c5a2177e24b423080454f8ca6716083f3cff62be9eda90c89c90635d2","sha512":"e3734e814d04cfa8920b1e326ffa03180c872e618a03ec37076c048543239bba6b9f307dca4b81561232547c3d1fc2c41256090834686adb2ffea09fec34e154","ssdeep":"96:fliz9rZsBNcOLXOngH3+XVJyjim+X6879pU4FCsubXrdnGPobkiBU0iDQEMEvHSC:kcNJuqjcJ9pCLrF55Ex17/V/Djhdk1Dk","tlshash":"4eb1b1a57f988f6917f215830df39a7c21147ae1c0a54e84abbecd5c80ccde2791f618","first_seen":"2026-01-13T05:19:16.315001Z","last_seen":"2026-01-13T05:19:16.315001Z","times_seen":1,"resource_available":false,"data":null}},"time_used":274,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":274,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/api/api/publicRealtimeByType?type=cryptos\u0026pageNo=1\u0026language=en","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:45.464Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /api/api/publicRealtimeByType?type=cryptos\u0026pageNo=1\u0026language=en HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nsystemRandom: 1768281525649104\r\ntissuePaper: 1768281525\r\nsign: 114149F56A9BB39CB1B102F0A3EC8B52\r\nx-api-client-timezone: UTC\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:45 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nx-frame-options: DENY\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5277,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"a2ed7514b2ae5e4a131575ba3feb07c5","sha1":"ba4404cb4e0cc5e026042d6b12ca42daa7f15fe1","sha256":"aac725827ead34a4aa50c7046395426211d91075d491ff38d0a9b5d206c08543","sha512":"06af661943aeabbb23d71958ebe819f383ba65b1118c12464921d145fde769dc109dd6cc77bdca890c62456525d04a5d31c05e68755330121c3fdb9a0e4246de","ssdeep":"96:ilixjZs9fO8+OngHYGVJQrhm+eps875p54FAKubr+QnGZ1kinsP0iDQEJEvHr0YA:j2HjJref5pft+H5sqE8az+QQh15++2m8","tlshash":"dcb1efa5bf988e6a13e616430df3563c10187ae1c0a64e88bbfecd9d80cdda5751f618","first_seen":"2026-01-13T05:19:16.315916Z","last_seen":"2026-01-13T05:19:16.315916Z","times_seen":1,"resource_available":false,"data":null}},"time_used":267,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":267,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/api/api/publicRealtimeTop?type=cryptos\u0026language=en","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:45.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /api/api/publicRealtimeTop?type=cryptos\u0026language=en HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nsystemRandom: 1768281525593821\r\ntissuePaper: 1768281525\r\nsign: A10272217CE86F536A466842B244F19A\r\nx-api-client-timezone: UTC\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:45 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nx-frame-options: DENY\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":891,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"22c1ecc073ff672484dff8dcb799ee2a","sha1":"3059fd42233ad06f32a1f4090f5a1b1db3a78703","sha256":"ced84f870a3c898e52931f5672f86b1719b49df203bcc7f74dd50f57353dab0f","sha512":"898c7aa7e40fcd44f17512012462bce6b713f8e9dd4a75f3e566f5268ff2e9e679953424a185fc1b4d669fe33e0b7c0863148b00b9b15bc55bacfdaca1e0a5e7","ssdeep":"","tlshash":"b0110052bfa48e76179612830ee32a3e00546ae1c0a50fc4ebedcd5880cdc80791f919","first_seen":"2026-01-13T05:19:16.317498Z","last_seen":"2026-01-13T05:19:16.317498Z","times_seen":1,"resource_available":false,"data":null}},"time_used":251,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":251,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/Layout-a910cce6.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:31.758Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/Layout-a910cce6.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://coccin.vip/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:31 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 240\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\netag: \"69493319-f0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":240,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text","md5":"b6fc71a48acd9ea6fdd5d57e36da6447","sha1":"4d5900ca5f720a864597ab21e18350f595214d80","sha256":"af0f0162551e430d532b02a132feb57f9419262a86360782ed190f7117e61da7","sha512":"f0d5384950773055d5ddae94f46f005ab3142247e591a99ee7a2b6c424bfa06993f65755aa159f673a013a7bdbd90d41c58afdd8c70162acf56eef9239e648c6","ssdeep":"","tlshash":"80d09765d440b0fe73c858fce215a4c181364ad033ad80f0c2ce8067023a0afc60db00","first_seen":"2026-01-13T05:15:15.425316Z","last_seen":"2026-01-13T05:19:16.29178Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1144,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1144,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/png/logo-3c4df697.png","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.464Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/png/logo-3c4df697.png HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-a511\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42257,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 320 x 320, 8-bit/color RGB, non-interlaced","md5":"b6e0f154add0bf36cad0c67fb899bad2","sha1":"d485a721257706732d3c05daf988e1aa6eb431a2","sha256":"3c4df69705e8fa998d2f0a9e051919195e1f5b251cc999bbd66fa6747e8808ef","sha512":"aa2a17b54e87e93f0b598623a6bf9c635f61642e5c709fad325afa971775a4b649784da82ba07675e5c7a406c7bf844821f441b0f7356f43577faec7ef6b29fd","ssdeep":"768:z5Ml7nV2lgFyp8BhdF7WvypYZ1BFI09xs1PqAqknnZIk:z5MBn8lgFyp2lWhL3/mqAq8Zp","tlshash":"8113f1d6234993bec7143b2f5dee9373d721c296c20a8431f62f49727841f8ea615c9a","first_seen":"2026-01-13T05:15:15.406142Z","last_seen":"2026-01-13T05:19:16.285924Z","times_seen":2,"resource_available":false,"data":null}},"time_used":259,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":259,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/index-332e8f65.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.977Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/index-332e8f65.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/syn/js/List-36999650.js\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:34 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-34e5\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13541,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (13540)","md5":"6dbe458b242294a70e3e15291d862a30","sha1":"40dd14922db7e60d75637e286560ef6a47f1227a","sha256":"584310cd5d4ec6a1a06bfab0f077585bf2c6e4e44f39dd232113662558fb3927","sha512":"67c287bb024d3f2919550b4368b98936ec50a51366e3fde8949b29459d5230fe277e0e559e37e37a47cc9e0e148637d98183e3619a05234166e5c1ae585b5b8f","ssdeep":"384:hXXJsSTPEKCmMY5EMaqDoDh7Zm55yqIa3ljk:pDTcZuWh7Zmryf6Rk","tlshash":"8452f8083546e938b2e7017a6834c08170596feed092c09fbbfc6dd56bc78392299775","first_seen":"2026-01-13T05:15:15.421524Z","last_seen":"2026-01-13T05:19:16.318241Z","times_seen":2,"resource_available":true,"data":null}},"time_used":626,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":626,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/author-f8e4f331.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:31.769Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/author-f8e4f331.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://coccin.vip/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:31 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 55\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\netag: \"69493319-37\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"e0b14fabcc8d166bc3cf633258dab47a","sha1":"5c1553e7fe0a70ce31bd5fe4492c8ae315695b9e","sha256":"aa6c1ef25b0022b34623cdf971112dfeb238e6467285725410a14617e09b0b89","sha512":"f0c6f2b6e779a87ef3997278267de465e52889815e26783279a2729a5dabf3ed77209640f1b881135d3ea8da433fc7591ca477eabb75d2e425193c25d633f6ee","ssdeep":"","tlshash":"1a9002221420656058a90088d722c9658b51100d61686565d60a4506e5136859a6e518","first_seen":"2026-01-13T05:15:15.398388Z","last_seen":"2026-01-13T05:19:16.310668Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1141,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1141,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/syn/js/index-332e8f65.js","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:33.551Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /syn/js/index-332e8f65.js HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://coccin.vip/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:33 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 22 Dec 2025 12:01:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69493319-34e5\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13541,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (13540)","md5":"6dbe458b242294a70e3e15291d862a30","sha1":"40dd14922db7e60d75637e286560ef6a47f1227a","sha256":"584310cd5d4ec6a1a06bfab0f077585bf2c6e4e44f39dd232113662558fb3927","sha512":"67c287bb024d3f2919550b4368b98936ec50a51366e3fde8949b29459d5230fe277e0e559e37e37a47cc9e0e148637d98183e3619a05234166e5c1ae585b5b8f","ssdeep":"384:hXXJsSTPEKCmMY5EMaqDoDh7Zm55yqIa3ljk:pDTcZuWh7Zmryf6Rk","tlshash":"8452f8083546e938b2e7017a6834c08170596feed092c09fbbfc6dd56bc78392299775","first_seen":"2026-01-13T05:15:15.421524Z","last_seen":"2026-01-13T05:19:16.318241Z","times_seen":2,"resource_available":true,"data":null}},"time_used":422,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":422,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/api/api/news!list.action?language=en","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:35.009Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /api/api/news!list.action?language=en HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nsystemRandom: 1768281514662692\r\ntissuePaper: 1768281514\r\nsign: 2A8CAC43623791CB1878CB6E8DFB4811\r\nx-api-client-timezone: UTC\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:35 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nx-frame-options: DENY\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4881,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"ccd37b6f023bb232a69e61b245d804ea","sha1":"eaf8c24ffad1e90b2dfac9c7a2297fd3fe816ee4","sha256":"e64bf18b6aebd34ae39c59e80f37609002caabff899a8a466e13d81133020ba6","sha512":"bb52346025e23044d754f5b71228ed0cc425828f6965bf4eabb5907e2f98876efe96bf75fa5fcfc1aa2ebfae637d0044c422b24a90b9c5bec88a2991ecae7458","ssdeep":"96:qSLUIJPu2bjTn5FPumxLQjHnGLH6KJwPu2j/t5erv+kVKmiJ5iOBkePuN:bUIJPtZFPZlQ7GLHZJwP9rt5eiFmi3it","tlshash":"5ca1b63b5bb636391e5400c1b3863769472a9660139094fcfc0d8a49d6e287e07bf78f","first_seen":"2025-11-25T03:02:04.563394Z","last_seen":"2026-01-13T05:19:16.319016Z","times_seen":3,"resource_available":false,"data":null}},"time_used":255,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":255,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/api/api/publicRealtimeTop?type=cryptos\u0026language=en","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:39.472Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /api/api/publicRealtimeTop?type=cryptos\u0026language=en HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nsystemRandom: 1768281519694721\r\ntissuePaper: 1768281519\r\nsign: 8517B736223FAF777794B38C7B85BF78\r\nx-api-client-timezone: UTC\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:39 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nx-frame-options: DENY\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":890,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"a5d584e80bdf661ff293d9232d3f061b","sha1":"940786f2212cb9816e6056c745f7b134b30fc4cf","sha256":"94cbcd92b7662bb128ae6036dbd59449939b5cc3b800345bc41b9f75f60cffa5","sha512":"a98148d8681bd882772fd4304a3a9838c2787fc27df980ec3ffe280910c9d1fd54a1bc3f87d6629e0b2dee3b370a0930e0273104117a91e8e72da4237f9cb43a","ssdeep":"","tlshash":"751104527f548f7517e321830de35e3d01195ae2c0a84f84dbddde5880cc851761f90d","first_seen":"2026-01-13T05:19:16.296112Z","last_seen":"2026-01-13T05:19:16.296112Z","times_seen":1,"resource_available":false,"data":null}},"time_used":250,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":250,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coccin.vip/api/api/publicRealtimeTop?type=cryptos\u0026language=en","fqdn":"coccin.vip","domain":"coccin.vip","tld":"vip"},"ip":{"addr":"134.122.140.226","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coccin.vip/","date":"2026-01-13T05:18:41.472Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coaain.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 07:18:49 GMT","end":"Tue, 07 Apr 2026 07:18:48 GMT"},"fingerprint":{"sha1":"76:D0:05:B6:4D:3B:5B:7F:BF:B0:12:8C:63:91:EE:FB:60:03:BD:96","sha256":"49:FB:DD:32:DE:E6:68:70:C6:FE:0C:B2:0E:A7:B3:14:B2:FA:7C:9E:62:A6:2C:13:F0:C2:CE:25:94:A4:90:14"}}},"request":{"raw":"GET /api/api/publicRealtimeTop?type=cryptos\u0026language=en HTTP/1.1\r\nHost: coccin.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nsystemRandom: 1768281521808046\r\ntissuePaper: 1768281521\r\nsign: EECFA0D46AC6C2B3ACDBECDF6449DC15\r\nx-api-client-timezone: UTC\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coccin.vip/\r\nCookie: server_name_session=e6001f43077e3ed82f79c9c819f413cd\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 13 Jan 2026 05:18:41 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nx-frame-options: DENY\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":890,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"36c79f7979bdf680c293ac1a0d3b6693","sha1":"1777ec63d595fc9f927dae4b119276d84c9db09e","sha256":"56c7737c014a919beef47958cd8b0b39971eea5f886166bc115fbc583f813543","sha512":"b5a907f07f326357088ee6ec39f4b0d512a4da2ee3755f703e6867d6ed6958e6d02e17eac8862a047e719d16439f084e45a3cabfe8c63df182c20e0bc103adb5","ssdeep":"","tlshash":"b711dc91bf548a764ba310830ef36a7d10a866e2c0b44ec0d7adee5490cc890761f909","first_seen":"2026-01-13T05:19:16.301658Z","last_seen":"2026-01-13T05:19:16.301658Z","times_seen":1,"resource_available":false,"data":null}},"time_used":249,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":249,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-13","alert":"Phishing Block","trigger":"coccin.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"coccin.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}