{"report_id":"c88d32d5-641d-41ac-bc18-7cf7b7d4f726","version":0,"status":"done","tags":[],"date":"2026-10-08T14:32:37Z","url":{"schema":"http","addr":"73kd.cc/","fqdn":"73kd.cc","domain":"73kd.cc","tld":"cc"},"ip":{"addr":"156.239.225.115","port":0,"asn":154321,"as":"CORENET CLOUD SDN. BHD.","country":"Seychelles","country_code":"SC"},"final":{"url":{"schema":"https","addr":"95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","fqdn":"95zgl92eua.weixiaoti2.xyz","domain":"weixiaoti2.xyz","tld":"xyz"},"title":"在线","dom":{"size":4599,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (467)","md5":"bc36610686975376a22aae9f0f03378c","sha1":"204f1be4a7ada71a0a5a36b7b044a57a95700937","sha256":"fae6aff1a5fa79b8dafa5465d1a02194bf452660d41dba429b7a35fda4d2162b","sha512":"1831e234b3c90139b54557db51b17faff8cf575a031108504c9628307838866838c7c8b30fbe1a50603f0910067bbc7878c00aa4718eba4ddb121360d5ace048","ssdeep":"96:jngMRZJsRZpTRZs+CZxUZsJwBqOEWiI7d9guT/ORTBdIedh0iC11YcXuMc1f:NRZJsRZlRZ8ZxUZsJwBrinuTEdIen0il","tlshash":"5191c531a4e33466021391d667233580b961e907d24ac9c07aedaaf85f90ff674b3b4f","dom_hash":"domhashb8f465981dc562534f12e3daa770b0bf","first_seen":"2026-10-08T14:32:43.437251Z","last_seen":"2026-10-08T14:32:43.437251Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"73kd.cc/","fqdn":"73kd.cc","domain":"73kd.cc","tld":"cc"},"ip":{"addr":"156.239.225.115","port":0,"asn":154321,"as":"CORENET CLOUD SDN. BHD.","country":"Seychelles","country_code":"SC"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-12T14:32:37Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"73kd.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"95zgl92eua.weixiaoti2.xyz","ip":{"addr":"27.222.17.243","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":8,"received_data":238606,"sent_data":4101,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"oss.pantaige.com","ip":{"addr":"138.113.181.177","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"domain_registered":"2024-06-14","domain_rank":0,"first_seen":"2026-08-22T23:56:29.85385Z","last_seen":"2026-10-06T04:00:54.470243Z","alert_count":0,"request_count":17,"received_data":1452940,"sent_data":7980,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"73kd.cc","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-04-15","domain_rank":0,"first_seen":"2026-10-08T14:24:25.907185Z","last_seen":"2026-10-08T14:24:25.907185Z","alert_count":2,"request_count":2,"received_data":495,"sent_data":868,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","fqdn":"95zgl92eua.weixiaoti2.xyz","domain":"weixiaoti2.xyz","tld":"xyz"},"ip":{"addr":"27.222.17.243","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":true,"md5":"bb2aec4887bbaafc34ff3d7a869722e9","sha1":"6cdb368f11f08f5f18552c3ae9f69d372f95a8a2","sha256":"7179898c8e070c7b97eeeaa013ac55b701c7f591f61695fe4ffd85edfbad3b0c","sha512":"66c068d840cae4c6e6862e1e4f5a6459c3ad23bc21d22ce6ccb9deec73fc9ab97e49a4fff56dad7c7a28ab96866468f4d260d70e3ecc9781bbcc5cde6bb01809","ssdeep":"","tlshash":"1c21017d26b320941b03020d6257259576165126168dcac0b6ccdbf85f21ba673f37cf","size":1316,"data":"","first_seen":"2026-09-27T10:27:19.284677Z","last_seen":"2026-10-08T14:32:43.493918Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"95zgl92eua.weixiaoti2.xyz/assets/index-B_dABRb5.js","fqdn":"95zgl92eua.weixiaoti2.xyz","domain":"weixiaoti2.xyz","tld":"xyz"},"ip":{"addr":"27.222.17.243","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"1a87a548f9ac09930a2beaab98d6d103","sha1":"5c397739e744f0110fb58fd5a10e43871ce5f130","sha256":"d95645e83781689667099be082a86212db177f81eb4afd6f30e31fb07dd60dd2","sha512":"e8d8cc9cd09f95a0c3bdae99101e72ace40c9d6a4b376a52a7eb08e77f7b83c892f1c4a6444cfe90043e5e91e19ce2a3b81e7c9231b8b69bcebeb2099f6499ed","ssdeep":"3072:SKey+7RBotNqCoxdrWWOKgk+eugavE88hfbpWviUOzlFz7CZxwr0mX:SKeHCoPgkBugavh8hfgviUY2xwrNX","tlshash":"b2044ca471f57836626319e3a07b1212a23d9806f40880d1f17e8dad2f6a9975377f3f","size":181925,"data":"","first_seen":"2026-09-27T10:27:19.278699Z","last_seen":"2026-10-08T14:32:43.47893Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"95zgl92eua.weixiaoti2.xyz/api/user/user/getManager","fqdn":"95zgl92eua.weixiaoti2.xyz","domain":"weixiaoti2.xyz","tld":"xyz"},"ip":{"addr":"27.222.17.243","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:11.598Z","timestamp":1791469931598,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.weixiaoti2.xyz","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 13 Sep 2026 10:09:10 GMT","end":"Sat, 12 Dec 2026 10:09:09 GMT"},"fingerprint":{"sha1":"A1:2C:90:3B:F6:88:53:81:F1:5E:AA:B8:15:76:85:23:99:0E:40:CB","sha256":"7F:1F:96:F3:A9:22:96:8B:B1:9E:06:0B:E0:C1:4D:A6:D2:C7:AB:76:81:11:6A:6E:6B:F8:53:54:55:55:64:85"}}},"request":{"raw":"POST /api/user/user/getManager HTTP/1.1\r\nHost: 95zgl92eua.weixiaoti2.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\ncontent-type: application/x-www-form-urlencoded\r\nx-requested-with: XMLHttpRequest\r\nContent-Length: 228\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":228,"data":"u_code=u_sCgOIr6Fy7opxkT-\u0026item=index\u0026finger_key=301979fe-7790-4a43-b266-f6b03b694a1e\u0026trace_id=tr_landing_791fea60-5171-4022-a4ba-a1f2c79230eb\u0026landing_host=95zgl92eua.weixiaoti2.xyz\u0026landing_path=%2Fu_sCgOIr6Fy7opxkT-%2Findex.html"}},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=30\r\nDate: Thu, 08 Oct 2026 14:32:11 GMT\r\nX-Request-Id: 700343f62bd958d41b7e550ae8a4a1e7\r\nCache-Control: no-store\r\nx-ws-request-id: 6ac7a96b_PS-TAO-01xXd220_46599-17049\r\nX-Via: 1.1 PS-CZX-01qjh32 [MISS], 1.1 PS-TAO-01xXd220 [MISS]\r\nX-Cache-Status: MISS\r\nServer: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16967,"size_decoded":17373,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"825a47ed4d481c806627e7fd4578313e","sha1":"9d84b4de685ec51feb1451d3b8aa356e824a4cca","sha256":"2cb41b576bcdc3b0c64c199424609b2fb9f3cdc181bbe595ee719071e99aecdd","sha512":"95d990ab6b89bdb999838e5bd2ac29ae99a7384f8c81ec56ea2028da4a033f3a32c143af2d8403d5d077c02fe5629314456f1855ca1834856e0893281cffe227","ssdeep":"192:uONcLX7lu5h2LHLJG87iJzFWdYmB0cDD7tr39Ft0587Ik92hfdsgf/utJFBE5VOe:9eLrofmrS8F9WlSbFf/pVUTjtaZ2To0","tlshash":"8272d699aafc6c7b27457681605f288751d7ad1fa58c2c6d8ec8ce2e00ca377141bb87","first_seen":"2026-10-08T14:32:43.440809Z","last_seen":"2026-10-08T14:32:43.440809Z","times_seen":1,"resource_available":true,"data":null}},"time_used":458,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":398,"receive":60,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oss.pantaige.com/v2/static/eight-step/v1/x11.jpg.enc","fqdn":"oss.pantaige.com","domain":"pantaige.com","tld":"com"},"ip":{"addr":"138.113.181.177","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:12.314Z","timestamp":1791469932314,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oss.pantaige.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 11:36:54 GMT","end":"Sat, 31 Oct 2026 11:36:53 GMT"},"fingerprint":{"sha1":"7D:93:E9:82:67:37:02:2A:34:F6:21:0D:62:B7:96:E2:D1:D3:F4:B0","sha256":"9B:24:85:EA:87:7C:7E:09:52:59:06:6D:83:1C:0A:21:D8:7C:58:37:B2:94:98:79:BF:91:20:3F:3D:65:8E:88"}}},"request":{"raw":"GET /v2/static/eight-step/v1/x11.jpg.enc HTTP/1.1\r\nHost: oss.pantaige.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/octet-stream\r\ncontent-length: 70245\r\ndate: Sun, 23 Aug 2026 05:57:26 GMT\r\nlast-modified: Fri, 07 Aug 2026 22:52:57 GMT\r\netag: \"6a7661c9-11265\"\r\ncache-control: public, max-age=31536000, immutable\r\nx-content-type-options: nosniff\r\nx-tbycloud-media-encryption: aes-256-gcm-v1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-allow-headers: Origin, Accept, Content-Type\r\naccess-control-expose-headers: Content-Length, Content-Type, Cache-Control, X-TBYCLOUD-Media-Encryption\r\naccept-ranges: bytes\r\nx-via: 2.0 PS-ARN-04Cun237 [HIT]\r\nage: 4005286\r\nx-ws-request-id: 6ac7a96c_PS-ARN-04Cun237_18678-26700\r\nx-cache-status: HIT\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":70245,"size_decoded":70988,"mime_type":"application/octet-stream","magic":"data","md5":"dcd415585aa6d6dadcdf502038a4260e","sha1":"eba51b2be63f96401bd9ce20f77f69e570903850","sha256":"4e35161acab0cf92a64a9b5040117d9ff1b538a51e4251435874476ea27aa300","sha512":"8b9bf7c4183cd640d2a2549ef3e2f2592ae4515d20c6854a40960e9322f03ce6560f6965567483874667c95725f283326a688faa6d6370d853f15ff1be9bb542","ssdeep":"1536:PlsvJ0NP6Jc3Ap63FY4zi5OQWx5aQkNU9g0ANzvidd4Cl4z+T:teJ0avMFY4m525kNUKNzv6d4CGC","tlshash":"676302bd662314623c9bac2c1f057c991f802161bee834ecd949276872f3c2ea5e9c17","first_seen":"2026-08-30T12:27:47.976529Z","last_seen":"2026-10-08T14:32:43.44519Z","times_seen":2,"resource_available":false,"data":null}},"time_used":632,"timings":{"blocked":-1,"dns":370,"connect":8,"send":0,"wait":10,"receive":2,"ssl":237},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"95zgl92eua.weixiaoti2.xyz/api/user/user/createCaptcha","fqdn":"95zgl92eua.weixiaoti2.xyz","domain":"weixiaoti2.xyz","tld":"xyz"},"ip":{"addr":"27.222.17.243","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:12.321Z","timestamp":1791469932321,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.weixiaoti2.xyz","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 13 Sep 2026 10:09:10 GMT","end":"Sat, 12 Dec 2026 10:09:09 GMT"},"fingerprint":{"sha1":"A1:2C:90:3B:F6:88:53:81:F1:5E:AA:B8:15:76:85:23:99:0E:40:CB","sha256":"7F:1F:96:F3:A9:22:96:8B:B1:9E:06:0B:E0:C1:4D:A6:D2:C7:AB:76:81:11:6A:6E:6B:F8:53:54:55:55:64:85"}}},"request":{"raw":"POST /api/user/user/createCaptcha HTTP/1.1\r\nHost: 95zgl92eua.weixiaoti2.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\ncontent-type: application/x-www-form-urlencoded\r\nx-requested-with: XMLHttpRequest\r\nContent-Length: 162\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 815\r\nConnection: keep-alive\r\nKeep-Alive: timeout=30\r\nDate: Thu, 08 Oct 2026 14:32:13 GMT\r\nX-Request-Id: 4142f0dfc30668e6b6d6bb89f7988447\r\nCache-Control: no-store\r\nx-ws-request-id: 6ac7a96d_PS-TAO-01xXd220_47278-24948\r\nX-Via: 1.1 PS-WUH-01SCO169 [MISS], 1.1 PS-TAO-01xXd220 [MISS]\r\nX-Cache-Status: MISS\r\nServer: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":815,"size_decoded":1215,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"d16e918b97ac7943b8c64bee71184e8a","sha1":"6233e26c9924066557ba3591c641f56d4ee914f8","sha256":"10557ba347d9b93eb837688203f90fc7bc99a3be604e903b09b72bbf0326ee57","sha512":"d3346b7d631373a361fe555a2f54051fab84a055eec60312819d75d3577da0d754bf0eb5e3f021cfba31afca58eb7240d164e3ef93d064f50cecd3d606025bc4","ssdeep":"","tlshash":"1d01ab788f16a8f31d0942c2404fa5e2173e6057f09e1a5ec8de8a240aee9a17a15c2d","first_seen":"2026-10-08T14:32:43.450053Z","last_seen":"2026-10-08T14:32:43.450053Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1431,"timings":{"blocked":-1,"dns":0,"connect":230,"send":0,"wait":964,"receive":0,"ssl":237},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oss.pantaige.com/v2/static/eight-step/v1/a33.jpg.enc","fqdn":"oss.pantaige.com","domain":"pantaige.com","tld":"com"},"ip":{"addr":"138.113.181.177","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:12.959Z","timestamp":1791469932959,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oss.pantaige.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 11:36:54 GMT","end":"Sat, 31 Oct 2026 11:36:53 GMT"},"fingerprint":{"sha1":"7D:93:E9:82:67:37:02:2A:34:F6:21:0D:62:B7:96:E2:D1:D3:F4:B0","sha256":"9B:24:85:EA:87:7C:7E:09:52:59:06:6D:83:1C:0A:21:D8:7C:58:37:B2:94:98:79:BF:91:20:3F:3D:65:8E:88"}}},"request":{"raw":"GET /v2/static/eight-step/v1/a33.jpg.enc HTTP/1.1\r\nHost: oss.pantaige.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/octet-stream\r\ncontent-length: 59571\r\ndate: Tue, 04 Aug 2026 19:43:11 GMT\r\nlast-modified: Mon, 03 Aug 2026 13:40:04 GMT\r\netag: \"6a709a34-e8b3\"\r\ncache-control: public, max-age=31536000, immutable\r\nx-content-type-options: nosniff\r\nx-tbycloud-media-encryption: aes-256-gcm-v1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-allow-headers: Origin, Accept, Content-Type\r\naccess-control-expose-headers: Content-Length, Content-Type, Cache-Control, X-TBYCLOUD-Media-Encryption\r\naccept-ranges: bytes\r\nx-via: 2.0 PS-ARN-04Cun237 [HIT]\r\nage: 5597341\r\nx-ws-request-id: 6ac7a96c_PS-ARN-04Cun237_18678-26703\r\nx-cache-status: HIT\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59571,"size_decoded":60313,"mime_type":"application/octet-stream","magic":"data","md5":"240ac80e997799832a11a70dad08fbab","sha1":"58d731a953c93f671a4f685e9e11afc8300919c3","sha256":"9b19501ce22e267b9445c4883b4cefb3448e05c78f91e026707a45f019968a16","sha512":"dbc9a4a6516c41a32dc8542347ca8b6cdf215cabc707fb987d3a58c8adf9daf318b45edc2ad7741dc118d49b67cd360b3af5f1cb772cb79f61965251bdd153ec","ssdeep":"1536:1d3DFG9RBQAXCBnPtkrcoCQLwUh6dfHTl3bvk4Jr/8+:1d3DF4RRCJPvoBLVsdfzl3bHJjR","tlshash":"774302e5c895ed9d8a277126c5b7cbad42c2379bb10ca6506dc47912287c123bc7bcf4","first_seen":"2026-08-30T12:27:47.96358Z","last_seen":"2026-10-08T14:32:43.45227Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oss.pantaige.com/v2/static/eight-step/v1/t11.jpg.enc","fqdn":"oss.pantaige.com","domain":"pantaige.com","tld":"com"},"ip":{"addr":"138.113.181.177","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:12.986Z","timestamp":1791469932986,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oss.pantaige.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 11:36:54 GMT","end":"Sat, 31 Oct 2026 11:36:53 GMT"},"fingerprint":{"sha1":"7D:93:E9:82:67:37:02:2A:34:F6:21:0D:62:B7:96:E2:D1:D3:F4:B0","sha256":"9B:24:85:EA:87:7C:7E:09:52:59:06:6D:83:1C:0A:21:D8:7C:58:37:B2:94:98:79:BF:91:20:3F:3D:65:8E:88"}}},"request":{"raw":"GET /v2/static/eight-step/v1/t11.jpg.enc HTTP/1.1\r\nHost: oss.pantaige.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/octet-stream\r\ncontent-length: 80820\r\ndate: Tue, 04 Aug 2026 19:43:12 GMT\r\nlast-modified: Mon, 03 Aug 2026 13:40:04 GMT\r\netag: \"6a709a34-13bb4\"\r\ncache-control: public, max-age=31536000, immutable\r\nx-content-type-options: nosniff\r\nx-tbycloud-media-encryption: aes-256-gcm-v1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-allow-headers: Origin, Accept, Content-Type\r\naccess-control-expose-headers: Content-Length, Content-Type, Cache-Control, X-TBYCLOUD-Media-Encryption\r\naccept-ranges: bytes\r\nx-via: 2.0 PS-ARN-04Cun237 [HIT]\r\nage: 5597340\r\nx-ws-request-id: 6ac7a96c_PS-ARN-04Cun237_18678-26705\r\nx-cache-status: HIT\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":80820,"size_decoded":81563,"mime_type":"application/octet-stream","magic":"data","md5":"9045822ac741a547ab3cc98a2d6b303d","sha1":"3c3083aade010bb40666a3843b2af980d81c9ee0","sha256":"5c0e0d531840edfdd11f5adcbf7622e08e40b6075dd36f8bd8d5501165649f4c","sha512":"65ecc07e9165ee239941bb6d281d2a3cb6651ed84f268eefbdb8f484bfe93647f0a5cf37934e6405d93c2021a90468c1bf864f8aee2089c55d3fba416100a8e9","ssdeep":"1536:tWXiZU7+bFAcFxPQLmipBE9Miv6bxfGvTyuEQ0F:4r7oHPQLnpBE9Miv6lf07EQ0F","tlshash":"fd83120b28fa5086d3baaf4924b307caf83dc19b1f8613da3159815d7f5de482c84e92","first_seen":"2026-08-30T12:27:47.964707Z","last_seen":"2026-10-08T14:32:43.454713Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oss.pantaige.com/v2/static/eight-step/v1/t33.jpg.enc","fqdn":"oss.pantaige.com","domain":"pantaige.com","tld":"com"},"ip":{"addr":"138.113.181.177","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:12.989Z","timestamp":1791469932989,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oss.pantaige.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 11:36:54 GMT","end":"Sat, 31 Oct 2026 11:36:53 GMT"},"fingerprint":{"sha1":"7D:93:E9:82:67:37:02:2A:34:F6:21:0D:62:B7:96:E2:D1:D3:F4:B0","sha256":"9B:24:85:EA:87:7C:7E:09:52:59:06:6D:83:1C:0A:21:D8:7C:58:37:B2:94:98:79:BF:91:20:3F:3D:65:8E:88"}}},"request":{"raw":"GET /v2/static/eight-step/v1/t33.jpg.enc HTTP/1.1\r\nHost: oss.pantaige.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/octet-stream\r\ncontent-length: 79625\r\ndate: Tue, 04 Aug 2026 19:43:12 GMT\r\nlast-modified: Mon, 03 Aug 2026 13:40:04 GMT\r\netag: \"6a709a34-13709\"\r\ncache-control: public, max-age=31536000, immutable\r\nx-content-type-options: nosniff\r\nx-tbycloud-media-encryption: aes-256-gcm-v1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-allow-headers: Origin, Accept, Content-Type\r\naccess-control-expose-headers: Content-Length, Content-Type, Cache-Control, X-TBYCLOUD-Media-Encryption\r\naccept-ranges: bytes\r\nx-via: 2.0 PS-ARN-04Cun237 [HIT]\r\nage: 5597340\r\nx-ws-request-id: 6ac7a96c_PS-ARN-04Cun237_18678-26707\r\nx-cache-status: HIT\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":79625,"size_decoded":80368,"mime_type":"application/octet-stream","magic":"data","md5":"35cda9239e603b35daa335c0e6461dbf","sha1":"d4604cd8edfdf9413623373ee51375655534d496","sha256":"a585e7b5ee1929e5cd1061067812837e13e913d9e1b511bcf4290d79f32466a5","sha512":"2b1d1f0e2d04fd6ddce88339c695d7f6cc8bd27b56a57890738ae6ebc03aa992d018f400f650ad48f17bb9ff8ba6cd550f59305a3f8889b2389b26a1441ab6b0","ssdeep":"1536:AV5SYXQF6r8XjxhbTF1nHaVRF8kOMGWaSwGIfCngIoVRrf7SNT7Sh7gOm:ADSjF6yxhbTFMVRFxmkH/glRrTSNT+hu","tlshash":"f873022e504ff847f599562c843ecde34c8c7cd814a61336626ea50cbab7d2c717ea62","first_seen":"2026-08-30T12:27:47.956671Z","last_seen":"2026-10-08T14:32:43.457378Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oss.pantaige.com/v2/static/eight-step/v1/z1.webp.enc","fqdn":"oss.pantaige.com","domain":"pantaige.com","tld":"com"},"ip":{"addr":"138.113.181.177","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:13.012Z","timestamp":1791469933012,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oss.pantaige.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 11:36:54 GMT","end":"Sat, 31 Oct 2026 11:36:53 GMT"},"fingerprint":{"sha1":"7D:93:E9:82:67:37:02:2A:34:F6:21:0D:62:B7:96:E2:D1:D3:F4:B0","sha256":"9B:24:85:EA:87:7C:7E:09:52:59:06:6D:83:1C:0A:21:D8:7C:58:37:B2:94:98:79:BF:91:20:3F:3D:65:8E:88"}}},"request":{"raw":"GET /v2/static/eight-step/v1/z1.webp.enc HTTP/1.1\r\nHost: oss.pantaige.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/octet-stream\r\ncontent-length: 55048\r\ndate: Tue, 04 Aug 2026 19:43:13 GMT\r\nlast-modified: Mon, 03 Aug 2026 13:40:04 GMT\r\netag: \"6a709a34-d708\"\r\ncache-control: public, max-age=31536000, immutable\r\nx-content-type-options: nosniff\r\nx-tbycloud-media-encryption: aes-256-gcm-v1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-allow-headers: Origin, Accept, Content-Type\r\naccess-control-expose-headers: Content-Length, Content-Type, Cache-Control, X-TBYCLOUD-Media-Encryption\r\naccept-ranges: bytes\r\nx-via: 2.0 PS-ARN-04Cun237 [HIT]\r\nage: 5597340\r\nx-ws-request-id: 6ac7a96d_PS-ARN-04Cun237_18678-26709\r\nx-cache-status: HIT\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55048,"size_decoded":55790,"mime_type":"application/octet-stream","magic":"data","md5":"14e64235d8d40719d62390581a685c69","sha1":"75bf2ffbb094f252745dad30c57c6116fa0e87e3","sha256":"78964c5ed685d16e9f8b17485a2145938761f9f5881d7a9834f0cf26d5dd88d2","sha512":"402011eaea604d08687e12f7009e43e35878293ee54e099f2c6c93673844dd8c976709629b3efe7ca4844f2ebdd04e3c7dad7fec1484d1c487a14cbd4e2172d5","ssdeep":"768:iwJMMERd4aa1y4J0/f2+dHnQ13mj9OHSL8Ed/XXM3RnUxzo1tw9xCslLHB0Kcl4H:PVECNly/TjAHShsRUxU1toXLag","tlshash":"c93302db1c8c207b195fa8a77a226d649bd6b5cb608477c005290895a1fd1ccff385bb","first_seen":"2026-08-30T12:27:47.966418Z","last_seen":"2026-10-08T14:32:43.459565Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oss.pantaige.com/v2/static/eight-step/v1/z2.webp.enc","fqdn":"oss.pantaige.com","domain":"pantaige.com","tld":"com"},"ip":{"addr":"138.113.181.177","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:13.013Z","timestamp":1791469933013,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oss.pantaige.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 11:36:54 GMT","end":"Sat, 31 Oct 2026 11:36:53 GMT"},"fingerprint":{"sha1":"7D:93:E9:82:67:37:02:2A:34:F6:21:0D:62:B7:96:E2:D1:D3:F4:B0","sha256":"9B:24:85:EA:87:7C:7E:09:52:59:06:6D:83:1C:0A:21:D8:7C:58:37:B2:94:98:79:BF:91:20:3F:3D:65:8E:88"}}},"request":{"raw":"GET /v2/static/eight-step/v1/z2.webp.enc HTTP/1.1\r\nHost: oss.pantaige.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/octet-stream\r\ncontent-length: 212748\r\ndate: Tue, 04 Aug 2026 19:43:13 GMT\r\nlast-modified: Mon, 03 Aug 2026 13:40:04 GMT\r\netag: \"6a709a34-33f0c\"\r\ncache-control: public, max-age=31536000, immutable\r\nx-content-type-options: nosniff\r\nx-tbycloud-media-encryption: aes-256-gcm-v1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-allow-headers: Origin, Accept, Content-Type\r\naccess-control-expose-headers: Content-Length, Content-Type, Cache-Control, X-TBYCLOUD-Media-Encryption\r\naccept-ranges: bytes\r\nx-via: 2.0 PS-ARN-04Cun237 [HIT]\r\nage: 5597340\r\nx-ws-request-id: 6ac7a96d_PS-ARN-04Cun237_18678-26710\r\nx-cache-status: HIT\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":212748,"size_decoded":213492,"mime_type":"application/octet-stream","magic":"data","md5":"99d89b577a5dc5ab2ebd7e96fefe7439","sha1":"92ef12c3043028e2b4c433d232bc55283408759c","sha256":"a103a4c9124f837625ada1ba79c1221363463f7eb2b20044aa2cae3d061825b2","sha512":"45163434e065759c9d08dd7fcda785e03b224c3f08c36197777e36b06b18f2ed916da2dde4c68d15b24f1ba2d7f1cabd40ee9fe5c55006d6c2afd4ffe42fc5eb","ssdeep":"3072:XnyCDdmwtbmlLzID5B3oXzabH0eCTzGwQctlaSvmdDmM3iBfVmMdT4BD6o:3yCRHs0bSabHCTzLlaSvm9muIm08Bf","tlshash":"5524227b3c3b11bd6e256c525df8368d2bbb849dafa4200610b27e6f81994db75f2204","first_seen":"2026-08-30T12:27:47.972004Z","last_seen":"2026-10-08T14:32:43.462179Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"73kd.cc/","fqdn":"73kd.cc","domain":"73kd.cc","tld":"cc"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-08T14:32:06.900Z","timestamp":1791469926900,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: 73kd.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-08T16:39:50.719065Z","times_seen":18946720,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"73kd.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"95zgl92eua.weixiaoti2.xyz/v2/landing/runtime-events","fqdn":"95zgl92eua.weixiaoti2.xyz","domain":"weixiaoti2.xyz","tld":"xyz"},"ip":{"addr":"27.222.17.243","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:12.076Z","timestamp":1791469932076,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.weixiaoti2.xyz","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 13 Sep 2026 10:09:10 GMT","end":"Sat, 12 Dec 2026 10:09:09 GMT"},"fingerprint":{"sha1":"A1:2C:90:3B:F6:88:53:81:F1:5E:AA:B8:15:76:85:23:99:0E:40:CB","sha256":"7F:1F:96:F3:A9:22:96:8B:B1:9E:06:0B:E0:C1:4D:A6:D2:C7:AB:76:81:11:6A:6E:6B:F8:53:54:55:55:64:85"}}},"request":{"raw":"POST /v2/landing/runtime-events HTTP/1.1\r\nHost: 95zgl92eua.weixiaoti2.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\ncontent-type: application/json\r\nContent-Length: 1071\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1071,"data":"{\"trace_id\":\"tr_landing_791fea60-5171-4022-a4ba-a1f2c79230eb\",\"attempt_id\":\"\",\"route_type\":\"direct_profile\",\"route_intent\":\"strong_open\",\"public_code\":\"RX-7d279as80q25phmj\",\"u_code\":\"u_sCgOIr6Fy7opxkT-\",\"item_code\":\"index\",\"channel\":\"browser\",\"entry_scene\":\"\",\"landing_scene\":\"strong_open\",\"landing_host\":\"95zgl92eua.weixiaoti2.xyz\",\"landing_path\":\"/u_sCgOIr6Fy7opxkT-/index.html\",\"token_id\":\"\",\"visitor_id\":0,\"event_type\":\"channel_gate\",\"outcome\":\"passed\",\"reason\":\"channel allowed\",\"signals\":{\"source\":\"ylfff_same_origin\",\"attempt_id\":\"\",\"route_mode\":\"strong_open\",\"route_intent\":\"strong_open\",\"public_code\":\"RX-7d279as80q25phmj\",\"channel\":\"browser\",\"entry_scene\":\"\",\"runtime_source\":\"ylfff_same_origin_compat\",\"landing_scene\":\"strong_open\",\"scene_behavior\":\"direct_u_code_item_getManager_runtime\",\"channel_gate\":\"matched\",\"captcha_profile\":\"eight_step\",\"redirect_profile\":\"off\",\"landing_info\":\"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html\",\"expected_channel\":\"all\",\"actual_channel\":\"browser\",\"detected_channel\":\"browser\",\"channel_policy\":\"browser\"}}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 207\r\nConnection: keep-alive\r\nKeep-Alive: timeout=30\r\nDate: Thu, 08 Oct 2026 14:32:12 GMT\r\nX-Request-Id: ba92257d5922ddc1f497fdf6429bb407\r\nX-Trace-Id: tr_landing_791fea60-5171-4022-a4ba-a1f2c79230eb\r\nCache-Control: no-store\r\nx-ws-request-id: 6ac7a96c_PS-TAO-01xXd220_46599-17057\r\nX-Via: 1.1 PS-HIA-01Q6h147 [MISS], 1.1 PS-TAO-01xXd220 [MISS]\r\nX-Cache-Status: MISS\r\nServer: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":207,"size_decoded":668,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"f6a3611eab07b3e5416e986aec4b8b0c","sha1":"b16137d78d3b78017f5a24de79f59ffab29e39ab","sha256":"15e3555a4b0c9dbd348f7b8a08d9cfa7aac02177fbdaf6e013643d02f7dd4496","sha512":"14d7ecd1a78676ab0949680de67263d384eba59af8eb4521325a7b4ddf4dd104232dd4abec30803eabb5bf58111f26967c3cdbd392bf6c4edb2fdcfad42890c9","ssdeep":"","tlshash":"3bd02240cc0e6cb85383a11b400e2a000afe1663a64121a90aacd728860d253abf0a72","first_seen":"2026-10-08T14:32:43.464392Z","last_seen":"2026-10-08T14:32:43.464392Z","times_seen":1,"resource_available":true,"data":null}},"time_used":369,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":369,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oss.pantaige.com/v2/static/eight-step/v1/a22.jpg.enc","fqdn":"oss.pantaige.com","domain":"pantaige.com","tld":"com"},"ip":{"addr":"138.113.181.177","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:12.958Z","timestamp":1791469932958,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oss.pantaige.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 11:36:54 GMT","end":"Sat, 31 Oct 2026 11:36:53 GMT"},"fingerprint":{"sha1":"7D:93:E9:82:67:37:02:2A:34:F6:21:0D:62:B7:96:E2:D1:D3:F4:B0","sha256":"9B:24:85:EA:87:7C:7E:09:52:59:06:6D:83:1C:0A:21:D8:7C:58:37:B2:94:98:79:BF:91:20:3F:3D:65:8E:88"}}},"request":{"raw":"GET /v2/static/eight-step/v1/a22.jpg.enc HTTP/1.1\r\nHost: oss.pantaige.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/octet-stream\r\ncontent-length: 56376\r\ndate: Tue, 04 Aug 2026 19:43:11 GMT\r\nlast-modified: Mon, 03 Aug 2026 13:40:04 GMT\r\netag: \"6a709a34-dc38\"\r\ncache-control: public, max-age=31536000, immutable\r\nx-content-type-options: nosniff\r\nx-tbycloud-media-encryption: aes-256-gcm-v1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-allow-headers: Origin, Accept, Content-Type\r\naccess-control-expose-headers: Content-Length, Content-Type, Cache-Control, X-TBYCLOUD-Media-Encryption\r\naccept-ranges: bytes\r\nx-via: 2.0 PS-ARN-04Cun237 [HIT]\r\nage: 5597341\r\nx-ws-request-id: 6ac7a96c_PS-ARN-04Cun237_18678-26702\r\nx-cache-status: HIT\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":56376,"size_decoded":57118,"mime_type":"application/octet-stream","magic":"data","md5":"2c2567d265fc3b7a92f7be9c9228701d","sha1":"22192c3631204b523d0651d191acba3a3ab72e5c","sha256":"10198a057b8f5cf703ab3118387b7af17fe8e8d53b089bb3cd8000110bece0fd","sha512":"cc3895b23b49f2d51d478079fa82f78fae311f12a6a4b3c07f33e3a39ac4af7990bd8b62f3e6fa37042c5e151afd6b003556847af1e67e43ee2cdbcb10c539a6","ssdeep":"1536:2om72QwxDC8pQlVKfPYO7bitqJGbzh6qkQZmzb:Cy1DC3VkPYq/gbkQkH","tlshash":"9043020d10616d24b2ffcb8a4158399a04d71b83ee07e7429f02bb5ba1539e7b83db58","first_seen":"2026-08-30T12:27:47.961466Z","last_seen":"2026-10-08T14:32:43.465762Z","times_seen":2,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oss.pantaige.com/v2/static/eight-step/v1/a44.jpg.enc","fqdn":"oss.pantaige.com","domain":"pantaige.com","tld":"com"},"ip":{"addr":"138.113.181.177","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:12.960Z","timestamp":1791469932960,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oss.pantaige.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 11:36:54 GMT","end":"Sat, 31 Oct 2026 11:36:53 GMT"},"fingerprint":{"sha1":"7D:93:E9:82:67:37:02:2A:34:F6:21:0D:62:B7:96:E2:D1:D3:F4:B0","sha256":"9B:24:85:EA:87:7C:7E:09:52:59:06:6D:83:1C:0A:21:D8:7C:58:37:B2:94:98:79:BF:91:20:3F:3D:65:8E:88"}}},"request":{"raw":"GET /v2/static/eight-step/v1/a44.jpg.enc HTTP/1.1\r\nHost: oss.pantaige.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/octet-stream\r\ncontent-length: 71859\r\ndate: Tue, 04 Aug 2026 19:43:10 GMT\r\nlast-modified: Mon, 03 Aug 2026 13:40:04 GMT\r\netag: \"6a709a34-118b3\"\r\ncache-control: public, max-age=31536000, immutable\r\nx-content-type-options: nosniff\r\nx-tbycloud-media-encryption: aes-256-gcm-v1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-allow-headers: Origin, Accept, Content-Type\r\naccess-control-expose-headers: Content-Length, Content-Type, Cache-Control, X-TBYCLOUD-Media-Encryption\r\naccept-ranges: bytes\r\nx-via: 2.0 PS-ARN-04Cun237 [HIT]\r\nage: 5597342\r\nx-ws-request-id: 6ac7a96c_PS-ARN-04Cun237_18678-26704\r\nx-cache-status: HIT\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":71859,"size_decoded":72602,"mime_type":"application/octet-stream","magic":"data","md5":"7bed90db355df0e4e5b47b9a129153d7","sha1":"d9e1c1176e1f2fd85b083765f2ec089280cfa2da","sha256":"f40fab16bea997f51d88ccefb56853d4bd80aa78b4e16395a608a8053aa8fd83","sha512":"c66bd3dcb68d2938499352a010130319085d66a2d5eb9a419513989f672ebba669d191543aeec0ebdd74ad9e00b5599b5b9d955006ca7c60b6e0707aa3926c2b","ssdeep":"1536:1aS+0hRTWE0ackQt/Z6isucmW2Hj7gTOMEiW:1aSJjWoAU/KWOj7rN","tlshash":"c5630236b416d4660c9f6407563b93b99afc8035d6cfa2d4a7229708948dffecf2640b","first_seen":"2026-08-30T12:27:47.978744Z","last_seen":"2026-10-08T14:32:43.467147Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oss.pantaige.com/v2/static/eight-step/v1/z3.webp.enc","fqdn":"oss.pantaige.com","domain":"pantaige.com","tld":"com"},"ip":{"addr":"138.113.181.177","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:13.014Z","timestamp":1791469933014,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oss.pantaige.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 11:36:54 GMT","end":"Sat, 31 Oct 2026 11:36:53 GMT"},"fingerprint":{"sha1":"7D:93:E9:82:67:37:02:2A:34:F6:21:0D:62:B7:96:E2:D1:D3:F4:B0","sha256":"9B:24:85:EA:87:7C:7E:09:52:59:06:6D:83:1C:0A:21:D8:7C:58:37:B2:94:98:79:BF:91:20:3F:3D:65:8E:88"}}},"request":{"raw":"GET /v2/static/eight-step/v1/z3.webp.enc HTTP/1.1\r\nHost: oss.pantaige.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/octet-stream\r\ncontent-length: 48946\r\ndate: Tue, 04 Aug 2026 19:43:13 GMT\r\nlast-modified: Mon, 03 Aug 2026 13:40:04 GMT\r\netag: \"6a709a34-bf32\"\r\ncache-control: public, max-age=31536000, immutable\r\nx-content-type-options: nosniff\r\nx-tbycloud-media-encryption: aes-256-gcm-v1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-allow-headers: Origin, Accept, Content-Type\r\naccess-control-expose-headers: Content-Length, Content-Type, Cache-Control, X-TBYCLOUD-Media-Encryption\r\naccept-ranges: bytes\r\nx-via: 2.0 PS-ARN-04Cun237 [HIT]\r\nage: 5597340\r\nx-ws-request-id: 6ac7a96d_PS-ARN-04Cun237_18678-26711\r\nx-cache-status: HIT\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":48946,"size_decoded":49688,"mime_type":"application/octet-stream","magic":"data","md5":"6a9e6f3eeb14d59b978a0b84d725f080","sha1":"6fdabb1e42f8edbda89d5445d621f7e331103688","sha256":"46f0df8890535d29a5f77805a4dde1ea8eaa82861d5ded6005f7ea1ba18473ff","sha512":"dcb201c6f86872ec01d76559ffda5cce8e5c4d8c50634fc4ddd0ab388bbdab4eae7bcafdd7ef36cb8f1c9e37159c5c748c0fcc1934d045a6671e53bc19d7bf76","ssdeep":"768:usBKDhT1G4ya0eO3zdfIXT08LdaJ3aeizXQaH+YzTev1ZkqdhpUrW/4kQepGuHWL:uJ5GQ0vzy48EJEQaZz8Zbd4Wgle5HXuR","tlshash":"b823f1b57bcd034e8f1eb93438013529e755d07660f4ae774ae102ad86a78e8e85df4c","first_seen":"2026-08-30T12:27:47.967492Z","last_seen":"2026-10-08T14:32:43.469098Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oss.pantaige.com/v2/static/eight-step/v1/z4.webp.enc","fqdn":"oss.pantaige.com","domain":"pantaige.com","tld":"com"},"ip":{"addr":"138.113.181.177","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:13.014Z","timestamp":1791469933014,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oss.pantaige.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 11:36:54 GMT","end":"Sat, 31 Oct 2026 11:36:53 GMT"},"fingerprint":{"sha1":"7D:93:E9:82:67:37:02:2A:34:F6:21:0D:62:B7:96:E2:D1:D3:F4:B0","sha256":"9B:24:85:EA:87:7C:7E:09:52:59:06:6D:83:1C:0A:21:D8:7C:58:37:B2:94:98:79:BF:91:20:3F:3D:65:8E:88"}}},"request":{"raw":"GET /v2/static/eight-step/v1/z4.webp.enc HTTP/1.1\r\nHost: oss.pantaige.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/octet-stream\r\ncontent-length: 157096\r\ndate: Tue, 04 Aug 2026 19:43:13 GMT\r\nlast-modified: Mon, 03 Aug 2026 13:40:04 GMT\r\netag: \"6a709a34-265a8\"\r\ncache-control: public, max-age=31536000, immutable\r\nx-content-type-options: nosniff\r\nx-tbycloud-media-encryption: aes-256-gcm-v1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-allow-headers: Origin, Accept, Content-Type\r\naccess-control-expose-headers: Content-Length, Content-Type, Cache-Control, X-TBYCLOUD-Media-Encryption\r\naccept-ranges: bytes\r\nx-via: 2.0 PS-ARN-04Cun237 [HIT]\r\nage: 5597340\r\nx-ws-request-id: 6ac7a96d_PS-ARN-04Cun237_18678-26712\r\nx-cache-status: HIT\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":157096,"size_decoded":157840,"mime_type":"application/octet-stream","magic":"data","md5":"cc12d4c140958ef17127cf3a9718e16e","sha1":"8a30acc7974e6834a14b794de96e87be985e0c83","sha256":"9be60b1da523aa3347601960a33e60efb33bd67bdc4ef34d821742540e76bf1c","sha512":"0d783bd572c505f6f0f67d2c1f017866adcfe722dca9e85f014410f93ffc673982dae6c618540455d93e77ed1e5e2f957a276a0edde26740321388ef6803e8a2","ssdeep":"3072:GfEVRw/2ZrrIlB4TTphe7CbBiPbvGSAO1hOnZoNt51jawH9fRe4N2B6j:iEVOUrwBMthGCbBzO1Eo9g4J1kBs","tlshash":"6ee3127e372bb09b46bf7561477e0a19081adc07ac352f89d45b2a83b9d213e7b474c2","first_seen":"2026-08-30T12:27:47.979914Z","last_seen":"2026-10-08T14:32:43.470617Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":11,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","fqdn":"95zgl92eua.weixiaoti2.xyz","domain":"weixiaoti2.xyz","tld":"xyz"},"ip":{"addr":"27.222.17.243","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-08T14:32:08.227Z","timestamp":1791469928227,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.weixiaoti2.xyz","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 13 Sep 2026 10:09:10 GMT","end":"Sat, 12 Dec 2026 10:09:09 GMT"},"fingerprint":{"sha1":"A1:2C:90:3B:F6:88:53:81:F1:5E:AA:B8:15:76:85:23:99:0E:40:CB","sha256":"7F:1F:96:F3:A9:22:96:8B:B1:9E:06:0B:E0:C1:4D:A6:D2:C7:AB:76:81:11:6A:6E:6B:F8:53:54:55:55:64:85"}}},"request":{"raw":"GET /u_sCgOIr6Fy7opxkT-/index.html HTTP/1.1\r\nHost: 95zgl92eua.weixiaoti2.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=30\r\nDate: Thu, 08 Oct 2026 14:32:10 GMT\r\nLast-Modified: Sun, 13 Sep 2026 15:09:09 GMT\r\nETag: W/\"6aa6bc95-b3d\"\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: same-origin\r\nContent-Encoding: gzip\r\nx-ws-request-id: 6ac7a969_PS-TAO-01xXd220_46599-16972\r\nX-Via: 1.1 PS-WUH-01SCO169 [MISS], 1.1 PS-TAO-01xXd220 [MISS]\r\nX-Cache-Status: MISS\r\nServer: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2877,"size_decoded":1918,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"909ed9b3e16d748e8d5157d6b6780b93","sha1":"f40e938aeb84d218580a6782c8028384e6745bf7","sha256":"46661b3bbc05d4ccbab903a5a44d2ee75186ebfd28db3d11c0a5a2b9161ed736","sha512":"05aceeb35a1ce13379b79cd84f639f6fba9283698ca3d789d514c3b6e69175c625b779f2c1c5ff3ec992efe671314350e263c1f5501ca253acdfa56124a2ed44","ssdeep":"","tlshash":"1d511bab25f350950513818c7a9375807aa1d023924ec98476dd93bc8f20721b6f37ce","first_seen":"2026-09-27T10:27:19.277776Z","last_seen":"2026-10-08T14:32:43.47273Z","times_seen":2,"resource_available":true,"data":null}},"time_used":2276,"timings":{"blocked":0,"dns":125,"connect":236,"send":0,"wait":1410,"receive":0,"ssl":505},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"95zgl92eua.weixiaoti2.xyz/assets/index-6S2RkUO9.css","fqdn":"95zgl92eua.weixiaoti2.xyz","domain":"weixiaoti2.xyz","tld":"xyz"},"ip":{"addr":"27.222.17.243","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:10.691Z","timestamp":1791469930691,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.weixiaoti2.xyz","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 13 Sep 2026 10:09:10 GMT","end":"Sat, 12 Dec 2026 10:09:09 GMT"},"fingerprint":{"sha1":"A1:2C:90:3B:F6:88:53:81:F1:5E:AA:B8:15:76:85:23:99:0E:40:CB","sha256":"7F:1F:96:F3:A9:22:96:8B:B1:9E:06:0B:E0:C1:4D:A6:D2:C7:AB:76:81:11:6A:6E:6B:F8:53:54:55:55:64:85"}}},"request":{"raw":"GET /assets/index-6S2RkUO9.css HTTP/1.1\r\nHost: 95zgl92eua.weixiaoti2.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=30\r\nDate: Sun, 13 Sep 2026 15:15:29 GMT\r\nLast-Modified: Sun, 13 Sep 2026 15:07:05 GMT\r\nETag: \"6aa6bc19-7109\"\r\nCache-Control: public, max-age=31536000, immutable\r\nX-Content-Type-Options: nosniff\r\nAccept-Ranges: bytes\r\nX-Via: 1.1 PS-TAO-01xXd220 [HIT]\r\nContent-Encoding: gzip\r\nAge: 2157402\r\nx-ws-request-id: 6ac7a96b_PS-TAO-01xXd220_46901-24422\r\nX-Cache-Status: HIT\r\nServer: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28937,"size_decoded":8267,"mime_type":"text/css","magic":"ASCII text, with very long lines (28936)","md5":"1340ddf071af8675d1a82142551b35f2","sha1":"53aa8380dd64571f5f60f3b903c331c0781cf3a3","sha256":"02085e0b8064a380aa8f7fa7324dba42bb7c29588183bf62418daa8098ee4220","sha512":"97c11785de154986b799c1cd7299fac1d863c56e557deffbc79459c1393405b08d490b608237c66a128e2f0d2cbc04bffa771a845b0bce9ec7a89284e63b0746","ssdeep":"384:HW/QTcjz3tY43BH1L3INogI9OqQsWuF3fktmY7Yy4zjUaWzO/yQFSDZTz4H4Xx:kLC43BH14gjZstR7SA5QFS9f4U","tlshash":"12d2b532e598253eb037c696b490a6caf114d413f22257edfed5b438c78a1fb2672706","first_seen":"2026-09-27T10:27:19.271169Z","last_seen":"2026-10-08T14:32:43.474462Z","times_seen":2,"resource_available":true,"data":null}},"time_used":757,"timings":{"blocked":-1,"dns":0,"connect":249,"send":0,"wait":253,"receive":1,"ssl":253},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"95zgl92eua.weixiaoti2.xyz/favicon.ico","fqdn":"95zgl92eua.weixiaoti2.xyz","domain":"weixiaoti2.xyz","tld":"xyz"},"ip":{"addr":"27.222.17.243","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:11.698Z","timestamp":1791469931698,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.weixiaoti2.xyz","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 13 Sep 2026 10:09:10 GMT","end":"Sat, 12 Dec 2026 10:09:09 GMT"},"fingerprint":{"sha1":"A1:2C:90:3B:F6:88:53:81:F1:5E:AA:B8:15:76:85:23:99:0E:40:CB","sha256":"7F:1F:96:F3:A9:22:96:8B:B1:9E:06:0B:E0:C1:4D:A6:D2:C7:AB:76:81:11:6A:6E:6B:F8:53:54:55:55:64:85"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: 95zgl92eua.weixiaoti2.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=30\r\nDate: Thu, 08 Oct 2026 14:32:12 GMT\r\nLast-Modified: Sun, 13 Sep 2026 15:09:09 GMT\r\nETag: W/\"6aa6bc95-b3d\"\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: same-origin\r\nContent-Encoding: gzip\r\nx-ws-request-id: 6ac7a96b_PS-TAO-01xXd220_46901-24443\r\nX-Via: 1.1 PS-000-011Sj172 [MISS], 1.1 PS-TAO-01xXd220 [MISS]\r\nX-Cache-Status: MISS\r\nServer: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2877,"size_decoded":1918,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"909ed9b3e16d748e8d5157d6b6780b93","sha1":"f40e938aeb84d218580a6782c8028384e6745bf7","sha256":"46661b3bbc05d4ccbab903a5a44d2ee75186ebfd28db3d11c0a5a2b9161ed736","sha512":"05aceeb35a1ce13379b79cd84f639f6fba9283698ca3d789d514c3b6e69175c625b779f2c1c5ff3ec992efe671314350e263c1f5501ca253acdfa56124a2ed44","ssdeep":"","tlshash":"1d511bab25f350950513818c7a9375807aa1d023924ec98476dd93bc8f20721b6f37ce","first_seen":"2026-09-27T10:27:19.277776Z","last_seen":"2026-10-08T14:32:43.47273Z","times_seen":2,"resource_available":true,"data":null}},"time_used":954,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":952,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oss.pantaige.com/v2/static/eight-step/v1/x44.jpg.enc","fqdn":"oss.pantaige.com","domain":"pantaige.com","tld":"com"},"ip":{"addr":"138.113.181.177","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:12.319Z","timestamp":1791469932319,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oss.pantaige.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 11:36:54 GMT","end":"Sat, 31 Oct 2026 11:36:53 GMT"},"fingerprint":{"sha1":"7D:93:E9:82:67:37:02:2A:34:F6:21:0D:62:B7:96:E2:D1:D3:F4:B0","sha256":"9B:24:85:EA:87:7C:7E:09:52:59:06:6D:83:1C:0A:21:D8:7C:58:37:B2:94:98:79:BF:91:20:3F:3D:65:8E:88"}}},"request":{"raw":"GET /v2/static/eight-step/v1/x44.jpg.enc HTTP/1.1\r\nHost: oss.pantaige.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/octet-stream\r\ncontent-length: 95728\r\ndate: Sun, 23 Aug 2026 05:57:25 GMT\r\nlast-modified: Fri, 07 Aug 2026 22:52:57 GMT\r\netag: \"6a7661c9-175f0\"\r\ncache-control: public, max-age=31536000, immutable\r\nx-content-type-options: nosniff\r\nx-tbycloud-media-encryption: aes-256-gcm-v1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-allow-headers: Origin, Accept, Content-Type\r\naccess-control-expose-headers: Content-Length, Content-Type, Cache-Control, X-TBYCLOUD-Media-Encryption\r\naccept-ranges: bytes\r\nx-via: 2.0 PS-ARN-04Cun237 [HIT]\r\nage: 4005287\r\nx-ws-request-id: 6ac7a96c_PS-ARN-04Cun237_18678-26697\r\nx-cache-status: HIT\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":95728,"size_decoded":96471,"mime_type":"application/octet-stream","magic":"data","md5":"835b4944c18a7a273a14c26e8430ae9b","sha1":"28dda41c05306e55d158b0b29b623fbc83e23a8a","sha256":"f748a498e3a8880ec255ff39b8d694515e3ae59e6be6d0b2ed760771ec7b4f07","sha512":"4448b47d54077d5ac80b231997d1c558cd27d200298fc95090ca8582a118faba9b3c4c4c8e24f49dabca83e78914be6cd0edca46223f78bcf2ccbcaf7da76f57","ssdeep":"1536:8qm1kZYXJNWfVVze7ZXWITEgn73bjsEBklI8QyZFvQdZ+4LkLeG351OjUC:8Oze7N7Lj1Bkdg+UkF1FC","tlshash":"319312683863c4263b1730073d72379376767182c69da237110bb39a46d46fdb6e58bb","first_seen":"2026-08-30T12:27:47.954495Z","last_seen":"2026-10-08T14:32:43.476021Z","times_seen":2,"resource_available":false,"data":null}},"time_used":618,"timings":{"blocked":-1,"dns":366,"connect":8,"send":0,"wait":9,"receive":2,"ssl":232},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"95zgl92eua.weixiaoti2.xyz/v2/route-traces/events","fqdn":"95zgl92eua.weixiaoti2.xyz","domain":"weixiaoti2.xyz","tld":"xyz"},"ip":{"addr":"27.222.17.243","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:12.320Z","timestamp":1791469932320,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.weixiaoti2.xyz","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 13 Sep 2026 10:09:10 GMT","end":"Sat, 12 Dec 2026 10:09:09 GMT"},"fingerprint":{"sha1":"A1:2C:90:3B:F6:88:53:81:F1:5E:AA:B8:15:76:85:23:99:0E:40:CB","sha256":"7F:1F:96:F3:A9:22:96:8B:B1:9E:06:0B:E0:C1:4D:A6:D2:C7:AB:76:81:11:6A:6E:6B:F8:53:54:55:55:64:85"}}},"request":{"raw":"POST /v2/route-traces/events HTTP/1.1\r\nHost: 95zgl92eua.weixiaoti2.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\ncontent-type: application/json\r\nContent-Length: 499\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":499,"data":"{\"trace_id\":\"tr_landing_791fea60-5171-4022-a4ba-a1f2c79230eb\",\"attempt_id\":\"\",\"route_type\":\"direct_profile\",\"public_code\":\"RX-7d279as80q25phmj\",\"channel\":\"browser\",\"entry_scene\":\"\",\"landing_host\":\"95zgl92eua.weixiaoti2.xyz\",\"landing_path\":\"/u_sCgOIr6Fy7opxkT-/index.html\",\"stage\":\"landing_captcha_required\",\"outcome\":\"pending\",\"reason\":\"eight_step\",\"visitor_id\":0,\"device_id\":0,\"signals_json\":\"{\\\"mode\\\":\\\"eight_step\\\",\\\"phrase_required\\\":false,\\\"click_captcha_switch\\\":false,\\\"quiz_questions\\\":0}\"}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 101\r\nConnection: keep-alive\r\nKeep-Alive: timeout=30\r\nDate: Thu, 08 Oct 2026 14:32:12 GMT\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Request-ID, X-Trace-ID\r\nX-Request-Id: 01113eca6887ceb5e0f0081fd25ec974\r\nX-Trace-Id: tr_landing_791fea60-5171-4022-a4ba-a1f2c79230eb\r\nCache-Control: no-store\r\nx-ws-request-id: 6ac7a96c_PS-TAO-01xXd220_46599-17065\r\nX-Via: 1.1 PS-000-01WFJ234 [MISS], 1.1 PS-TAO-01xXd220 [MISS]\r\nX-Cache-Status: MISS\r\nServer: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":101,"size_decoded":651,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"d6bf9fb1a66e322dac627273a112c3e0","sha1":"8bc2ef77365a850b0029bd04809d1bae850b25f8","sha256":"b13e8e101a850f8b17f7c0c29b4510e5fb7e9e77a4cdadcc03d0d2e2d0967429","sha512":"3f9c4d53642ce383c1b230482f58044f396943bb8ef99c13534f9de6aa46d641b5a1d881fe759dc9d15c86671663c54dee01e2e8e91b0d05fc08b9c06fff2786","ssdeep":"","tlshash":"81b012114e197829798bc207120a6966c3def022608018270d5de254c7575a48232db4","first_seen":"2026-10-08T14:32:43.477599Z","last_seen":"2026-10-08T14:32:43.477599Z","times_seen":1,"resource_available":true,"data":null}},"time_used":466,"timings":{"blocked":-1,"dns":0,"connect":234,"send":0,"wait":341,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"73kd.cc/","fqdn":"73kd.cc","domain":"73kd.cc","tld":"cc"},"ip":{"addr":"156.239.225.115","port":80,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-08T14:32:07.551Z","timestamp":1791469927551,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: 73kd.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: nginx\r\nDate: Thu, 08 Oct 2026 14:32:08 GMT\r\nContent-Type: text/html; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-control: no-cache,must-revalidate\r\nLocation: https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-08T16:39:50.719065Z","times_seen":18946720,"resource_available":true,"data":null}},"time_used":671,"timings":{"blocked":-1,"dns":3,"connect":307,"send":0,"wait":361,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"73kd.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"95zgl92eua.weixiaoti2.xyz/assets/index-B_dABRb5.js","fqdn":"95zgl92eua.weixiaoti2.xyz","domain":"weixiaoti2.xyz","tld":"xyz"},"ip":{"addr":"27.222.17.243","port":443,"asn":4837,"as":"CHINA UNICOM China169 Backbone","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:10.690Z","timestamp":1791469930690,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.weixiaoti2.xyz","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 13 Sep 2026 10:09:10 GMT","end":"Sat, 12 Dec 2026 10:09:09 GMT"},"fingerprint":{"sha1":"A1:2C:90:3B:F6:88:53:81:F1:5E:AA:B8:15:76:85:23:99:0E:40:CB","sha256":"7F:1F:96:F3:A9:22:96:8B:B1:9E:06:0B:E0:C1:4D:A6:D2:C7:AB:76:81:11:6A:6E:6B:F8:53:54:55:55:64:85"}}},"request":{"raw":"GET /assets/index-B_dABRb5.js HTTP/1.1\r\nHost: 95zgl92eua.weixiaoti2.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=30\r\nDate: Sun, 13 Sep 2026 15:15:29 GMT\r\nLast-Modified: Sun, 13 Sep 2026 15:07:05 GMT\r\nETag: \"6aa6bc19-2c6a5\"\r\nCache-Control: public, max-age=31536000, immutable\r\nX-Content-Type-Options: nosniff\r\nAccept-Ranges: bytes\r\nX-Via: 1.1 PS-TAO-01xXd220 [HIT]\r\nContent-Encoding: gzip\r\nAge: 2157401\r\nx-ws-request-id: 6ac7a96a_PS-TAO-01xXd220_46599-17020\r\nX-Cache-Status: HIT\r\nServer: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":181925,"size_decoded":67471,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (27905)","md5":"1a87a548f9ac09930a2beaab98d6d103","sha1":"5c397739e744f0110fb58fd5a10e43871ce5f130","sha256":"d95645e83781689667099be082a86212db177f81eb4afd6f30e31fb07dd60dd2","sha512":"e8d8cc9cd09f95a0c3bdae99101e72ace40c9d6a4b376a52a7eb08e77f7b83c892f1c4a6444cfe90043e5e91e19ce2a3b81e7c9231b8b69bcebeb2099f6499ed","ssdeep":"3072:SKey+7RBotNqCoxdrWWOKgk+eugavE88hfbpWviUOzlFz7CZxwr0mX:SKeHCoPgkBugavh8hfgviUY2xwrNX","tlshash":"b2044ca471f57836626319e3a07b1212a23d9806f40880d1f17e8dad2f6a9975377f3f","first_seen":"2026-09-27T10:27:19.278699Z","last_seen":"2026-10-08T14:32:43.47893Z","times_seen":2,"resource_available":true,"data":null}},"time_used":853,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":483,"receive":370,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oss.pantaige.com/v2/static/eight-step/v1/background.jpg.enc","fqdn":"oss.pantaige.com","domain":"pantaige.com","tld":"com"},"ip":{"addr":"138.113.181.177","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:12.312Z","timestamp":1791469932312,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oss.pantaige.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 11:36:54 GMT","end":"Sat, 31 Oct 2026 11:36:53 GMT"},"fingerprint":{"sha1":"7D:93:E9:82:67:37:02:2A:34:F6:21:0D:62:B7:96:E2:D1:D3:F4:B0","sha256":"9B:24:85:EA:87:7C:7E:09:52:59:06:6D:83:1C:0A:21:D8:7C:58:37:B2:94:98:79:BF:91:20:3F:3D:65:8E:88"}}},"request":{"raw":"GET /v2/static/eight-step/v1/background.jpg.enc HTTP/1.1\r\nHost: oss.pantaige.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/octet-stream\r\ncontent-length: 113269\r\ndate: Tue, 04 Aug 2026 18:43:22 GMT\r\nlast-modified: Mon, 03 Aug 2026 13:40:04 GMT\r\netag: \"6a709a34-1ba75\"\r\ncache-control: public, max-age=31536000, immutable\r\nx-content-type-options: nosniff\r\nx-tbycloud-media-encryption: aes-256-gcm-v1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-allow-headers: Origin, Accept, Content-Type\r\naccess-control-expose-headers: Content-Length, Content-Type, Cache-Control, X-TBYCLOUD-Media-Encryption\r\naccept-ranges: bytes\r\nx-via: 2.0 PS-ARN-04Cun237 [HIT]\r\nage: 5600930\r\nx-ws-request-id: 6ac7a96c_PS-ARN-04Cun237_18678-26695\r\nx-cache-status: HIT\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":113269,"size_decoded":114013,"mime_type":"application/octet-stream","magic":"data","md5":"7cc57512b4c1e80e373820fddf307756","sha1":"ddc029fad85c6f2914991ab975932ef51472d03c","sha256":"8a823d7ee6e77e3f387633495682c1c9f47bb1ba37494585d2da8fd2ed398aa0","sha512":"fa654e4eadb727955dfba6b456ab184fa703254a0a05f9f4b5d2ecab07d272f2939d0e067d28903b9d1b4d556e9357670acfa866c3a55db7db83634ce940bbd5","ssdeep":"3072:CiOlVn31C1dxP+EKY2sWVN7DWbcjTzFe5YU:CiOlVlCtP+9YlWV1D0kHFeuU","tlshash":"b4b3129615940dffc23ce35279eeb4379eb61c42f020063a0e6a27f7ee19480529b1bd","first_seen":"2026-08-30T12:27:47.957757Z","last_seen":"2026-10-08T14:32:43.480611Z","times_seen":2,"resource_available":false,"data":null}},"time_used":426,"timings":{"blocked":-1,"dns":372,"connect":9,"send":0,"wait":10,"receive":11,"ssl":24},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oss.pantaige.com/v2/static/eight-step/v1/x22.jpg.enc","fqdn":"oss.pantaige.com","domain":"pantaige.com","tld":"com"},"ip":{"addr":"138.113.181.177","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:12.317Z","timestamp":1791469932317,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oss.pantaige.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 11:36:54 GMT","end":"Sat, 31 Oct 2026 11:36:53 GMT"},"fingerprint":{"sha1":"7D:93:E9:82:67:37:02:2A:34:F6:21:0D:62:B7:96:E2:D1:D3:F4:B0","sha256":"9B:24:85:EA:87:7C:7E:09:52:59:06:6D:83:1C:0A:21:D8:7C:58:37:B2:94:98:79:BF:91:20:3F:3D:65:8E:88"}}},"request":{"raw":"GET /v2/static/eight-step/v1/x22.jpg.enc HTTP/1.1\r\nHost: oss.pantaige.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/octet-stream\r\ncontent-length: 64363\r\ndate: Sun, 23 Aug 2026 19:51:56 GMT\r\nlast-modified: Fri, 07 Aug 2026 22:52:57 GMT\r\netag: \"6a7661c9-fb6b\"\r\ncache-control: public, max-age=31536000, immutable\r\nx-content-type-options: nosniff\r\nx-tbycloud-media-encryption: aes-256-gcm-v1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-allow-headers: Origin, Accept, Content-Type\r\naccess-control-expose-headers: Content-Length, Content-Type, Cache-Control, X-TBYCLOUD-Media-Encryption\r\naccept-ranges: bytes\r\nx-via: 2.0 PS-ARN-04Cun237 [HIT]\r\nage: 3955216\r\nx-ws-request-id: 6ac7a96c_PS-ARN-04Cun237_18678-26698\r\nx-cache-status: HIT\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":64363,"size_decoded":65105,"mime_type":"application/octet-stream","magic":"data","md5":"57a5ee0c3f9d13e78c44c60d79171e7b","sha1":"7f9c01cc5efa506f591ff3047586871f655b6e65","sha256":"6d493d2b72e85a70184c895f01a305276b315c475a22c9c1b25229f327588d51","sha512":"b84cf05989b7e2e7a8a283b217227ee522eef6c35a29636dffcbde99777610ddf0d07c4cf6116e0f4a30d79b69be5af183100dfa177e95fe67ebce92a2f41b61","ssdeep":"768:pBWNiAFhWdaF3Sat9Q1fxRlKLL/dWTnzYTzFj2ULhvwcbzK750z+6Uow/r1Vivp3:po4shbiatOpKXp2T75z6dEnIXIaTky11","tlshash":"0253f18fc0a63549e2bf0137aeb291eb3a03b7239c5904539e0d57f79a43d43b59321a","first_seen":"2026-08-30T12:27:47.952708Z","last_seen":"2026-10-08T14:32:43.482452Z","times_seen":2,"resource_available":false,"data":null}},"time_used":624,"timings":{"blocked":-1,"dns":368,"connect":8,"send":0,"wait":9,"receive":1,"ssl":233},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oss.pantaige.com/v2/static/eight-step/v1/x33.jpg.enc","fqdn":"oss.pantaige.com","domain":"pantaige.com","tld":"com"},"ip":{"addr":"138.113.181.177","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:12.318Z","timestamp":1791469932318,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oss.pantaige.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 11:36:54 GMT","end":"Sat, 31 Oct 2026 11:36:53 GMT"},"fingerprint":{"sha1":"7D:93:E9:82:67:37:02:2A:34:F6:21:0D:62:B7:96:E2:D1:D3:F4:B0","sha256":"9B:24:85:EA:87:7C:7E:09:52:59:06:6D:83:1C:0A:21:D8:7C:58:37:B2:94:98:79:BF:91:20:3F:3D:65:8E:88"}}},"request":{"raw":"GET /v2/static/eight-step/v1/x33.jpg.enc HTTP/1.1\r\nHost: oss.pantaige.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/octet-stream\r\ncontent-length: 56393\r\ndate: Sun, 23 Aug 2026 05:57:25 GMT\r\nlast-modified: Fri, 07 Aug 2026 22:52:57 GMT\r\netag: \"6a7661c9-dc49\"\r\ncache-control: public, max-age=31536000, immutable\r\nx-content-type-options: nosniff\r\nx-tbycloud-media-encryption: aes-256-gcm-v1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-allow-headers: Origin, Accept, Content-Type\r\naccess-control-expose-headers: Content-Length, Content-Type, Cache-Control, X-TBYCLOUD-Media-Encryption\r\naccept-ranges: bytes\r\nx-via: 2.0 PS-ARN-04Cun237 [HIT]\r\nage: 4005287\r\nx-ws-request-id: 6ac7a96c_PS-ARN-04Cun237_18678-26699\r\nx-cache-status: HIT\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":56393,"size_decoded":57135,"mime_type":"application/octet-stream","magic":"data","md5":"a85b3e152c469a87570fbc081f4f037d","sha1":"461b838dcaea4fdaf028e8f87941f322368e2d99","sha256":"1302a33267acec101bd6125748d1a17ef7bec5406e5a29c14a28451fc10d8326","sha512":"9f59983b5575c6c29b44a5f12864cecd3b5d5095f3eecd815255db012a61219544cb8866a034fa4ee65aa8401e6043d366e44a1e974db5f2050cf2d6e7b3293b","ssdeep":"1536:BD0HbwEmww5InMOcm8WBVbQgSzkXdXqjj:/Emww5UM88mcAXtq/","tlshash":"8943024887eae3e4d6d42b9e990fcaab775a0c18599f099e40e0e0c15cd7b1f0907ed7","first_seen":"2026-08-30T12:27:47.977479Z","last_seen":"2026-10-08T14:32:43.484147Z","times_seen":2,"resource_available":false,"data":null}},"time_used":627,"timings":{"blocked":-1,"dns":367,"connect":8,"send":0,"wait":13,"receive":1,"ssl":234},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oss.pantaige.com/v2/static/eight-step/v1/a11.jpg.enc","fqdn":"oss.pantaige.com","domain":"pantaige.com","tld":"com"},"ip":{"addr":"138.113.181.177","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:12.956Z","timestamp":1791469932956,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oss.pantaige.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 11:36:54 GMT","end":"Sat, 31 Oct 2026 11:36:53 GMT"},"fingerprint":{"sha1":"7D:93:E9:82:67:37:02:2A:34:F6:21:0D:62:B7:96:E2:D1:D3:F4:B0","sha256":"9B:24:85:EA:87:7C:7E:09:52:59:06:6D:83:1C:0A:21:D8:7C:58:37:B2:94:98:79:BF:91:20:3F:3D:65:8E:88"}}},"request":{"raw":"GET /v2/static/eight-step/v1/a11.jpg.enc HTTP/1.1\r\nHost: oss.pantaige.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/octet-stream\r\ncontent-length: 74846\r\ndate: Tue, 04 Aug 2026 19:43:11 GMT\r\nlast-modified: Mon, 03 Aug 2026 13:40:04 GMT\r\netag: \"6a709a34-1245e\"\r\ncache-control: public, max-age=31536000, immutable\r\nx-content-type-options: nosniff\r\nx-tbycloud-media-encryption: aes-256-gcm-v1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-allow-headers: Origin, Accept, Content-Type\r\naccess-control-expose-headers: Content-Length, Content-Type, Cache-Control, X-TBYCLOUD-Media-Encryption\r\naccept-ranges: bytes\r\nx-via: 2.0 PS-ARN-04Cun237 [HIT]\r\nage: 5597341\r\nx-ws-request-id: 6ac7a96c_PS-ARN-04Cun237_18678-26701\r\nx-cache-status: HIT\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":74846,"size_decoded":75589,"mime_type":"application/octet-stream","magic":"data","md5":"4e2eeba411383854d9ede95cc2e7666f","sha1":"7488abd9bf5c82152920256c99727f7958864c67","sha256":"f000023ec7ed6dcde9997c80b7d1321591ecde623771ea6735bd0bfdc9f42dec","sha512":"dea499148a6819c17e790547cd2f7a124a4e86de44c66ec33f07fa8968fc2e268657b32ab06ba4010984c2fea4c98000140d0944cd04553b682a99fc8e79b34e","ssdeep":"1536:MYDAtp2vK5Z3gJ6SXPdjZEGw7vcKDBwlC858xO8kPoIz1sjrje:PDAjKUwJ6ePdjZEGw7EKtw0CV1Wm","tlshash":"ee7302edfcf8a3195ed46f94899e1363914ef0108aef10f1c19aa225f74e5a2f5138b1","first_seen":"2026-08-30T12:27:47.9602Z","last_seen":"2026-10-08T14:32:43.487072Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oss.pantaige.com/v2/static/eight-step/v1/t22.jpg.enc","fqdn":"oss.pantaige.com","domain":"pantaige.com","tld":"com"},"ip":{"addr":"138.113.181.177","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:12.988Z","timestamp":1791469932988,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oss.pantaige.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 11:36:54 GMT","end":"Sat, 31 Oct 2026 11:36:53 GMT"},"fingerprint":{"sha1":"7D:93:E9:82:67:37:02:2A:34:F6:21:0D:62:B7:96:E2:D1:D3:F4:B0","sha256":"9B:24:85:EA:87:7C:7E:09:52:59:06:6D:83:1C:0A:21:D8:7C:58:37:B2:94:98:79:BF:91:20:3F:3D:65:8E:88"}}},"request":{"raw":"GET /v2/static/eight-step/v1/t22.jpg.enc HTTP/1.1\r\nHost: oss.pantaige.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/octet-stream\r\ncontent-length: 78015\r\ndate: Tue, 04 Aug 2026 19:43:12 GMT\r\nlast-modified: Mon, 03 Aug 2026 13:40:04 GMT\r\netag: \"6a709a34-130bf\"\r\ncache-control: public, max-age=31536000, immutable\r\nx-content-type-options: nosniff\r\nx-tbycloud-media-encryption: aes-256-gcm-v1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-allow-headers: Origin, Accept, Content-Type\r\naccess-control-expose-headers: Content-Length, Content-Type, Cache-Control, X-TBYCLOUD-Media-Encryption\r\naccept-ranges: bytes\r\nx-via: 2.0 PS-ARN-04Cun237 [HIT]\r\nage: 5597340\r\nx-ws-request-id: 6ac7a96c_PS-ARN-04Cun237_18678-26706\r\nx-cache-status: HIT\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":78015,"size_decoded":78758,"mime_type":"application/octet-stream","magic":"data","md5":"3df0d383bfec2818ab76422abc06a763","sha1":"5c2f643aa211d33fb1a432694d8ea28bde7ccdcc","sha256":"dcc8cd5e0044b6179e54c37f203a64c75e7a6b312ef6fd70c8834fefc313ec24","sha512":"c1ad0e60ae61dec34cf53f137f297548eecc813edef7fb022ab744c39707b5004d8f580a31f1c28595905c39f15ae200fb6f9d7e50d8d6e77815bd67f332a179","ssdeep":"1536:KIfikG30UElt8V73Vlh3yUHRlhm40B/Z0SSpZm4xHuZ5:KIfE3zEli1hiWlhm40B/qVZvOL","tlshash":"bc7302f7300332a0bbc2dc97a59221941454b2dacdaf8c0b97544f65a2cf51f35f5ab6","first_seen":"2026-08-30T12:27:47.970999Z","last_seen":"2026-10-08T14:32:43.49057Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oss.pantaige.com/v2/static/eight-step/v1/t44.jpg.enc","fqdn":"oss.pantaige.com","domain":"pantaige.com","tld":"com"},"ip":{"addr":"138.113.181.177","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://95zgl92eua.weixiaoti2.xyz/u_sCgOIr6Fy7opxkT-/index.html","date":"2026-10-08T14:32:12.990Z","timestamp":1791469932990,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"oss.pantaige.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 11:36:54 GMT","end":"Sat, 31 Oct 2026 11:36:53 GMT"},"fingerprint":{"sha1":"7D:93:E9:82:67:37:02:2A:34:F6:21:0D:62:B7:96:E2:D1:D3:F4:B0","sha256":"9B:24:85:EA:87:7C:7E:09:52:59:06:6D:83:1C:0A:21:D8:7C:58:37:B2:94:98:79:BF:91:20:3F:3D:65:8E:88"}}},"request":{"raw":"GET /v2/static/eight-step/v1/t44.jpg.enc HTTP/1.1\r\nHost: oss.pantaige.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://95zgl92eua.weixiaoti2.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/octet-stream\r\ncontent-length: 65365\r\ndate: Tue, 04 Aug 2026 19:43:12 GMT\r\nlast-modified: Mon, 03 Aug 2026 13:40:04 GMT\r\netag: \"6a709a34-ff55\"\r\ncache-control: public, max-age=31536000, immutable\r\nx-content-type-options: nosniff\r\nx-tbycloud-media-encryption: aes-256-gcm-v1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-allow-headers: Origin, Accept, Content-Type\r\naccess-control-expose-headers: Content-Length, Content-Type, Cache-Control, X-TBYCLOUD-Media-Encryption\r\naccept-ranges: bytes\r\nx-via: 2.0 PS-ARN-04Cun237 [HIT]\r\nage: 5597340\r\nx-ws-request-id: 6ac7a96c_PS-ARN-04Cun237_18678-26708\r\nx-cache-status: HIT\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65365,"size_decoded":66107,"mime_type":"application/octet-stream","magic":"data","md5":"af9498085900a458b7dd2534468ef121","sha1":"f1a826f7960416b54f66a1ce5004f62f7ab6ab44","sha256":"89c824121577943ac938f8cd518d2c6bcf040fef55448ff7568087d0be63b350","sha512":"e1ad4a237783c88c58694fcbefb658d23f6eeb38d837551bea2e18f08535bc927439c07df5ce1151e31f9be7eba62a31d7ab86bc10a488f6a52b0a7ab49b58d8","ssdeep":"1536:B7jSprhgRlwgWPwn5YdrO3LxJfUCfJhxeLHCX89J0V:Jh5WPEYw1f3xeDCs9KV","tlshash":"1c530158d98220d3df259d9bab51375e52fb081ee4f07fd4712478098e9e9b0f5bc822","first_seen":"2026-08-30T12:27:47.9752Z","last_seen":"2026-10-08T14:32:43.492473Z","times_seen":2,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}