{"report_id":"cca53f06-cf3e-4241-94f6-4a92fbeae347","version":0,"status":"done","tags":[],"date":"2026-09-06T22:54:29Z","url":{"schema":"http","addr":"sa-zq.xyz/","fqdn":"sa-zq.xyz","domain":"sa-zq.xyz","tld":"xyz"},"ip":{"addr":"104.21.38.29","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"sa-zq.xyz/login/index","fqdn":"sa-zq.xyz","domain":"sa-zq.xyz","tld":"xyz"},"title":"BTG","dom":{"size":8470,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"122d4db89a59cc0672a8f59d7b20d941","sha1":"a1fa579c80f9c858fb80f52aca79b26214c4df6a","sha256":"5bd7173c21010c499c462ea67018b4fbc8b48a6d7e8f19b7a416df4eafa0a210","sha512":"c64e67c6e78c56cc27ef6fb27995f83073bad786903496162016c50036a3e3663c6f4b87e0b4f0c340b3038d25d7fdee23ac5f4263cd9b2f35929f4537101fe6","ssdeep":"192:DlgbRJ8JepBFLIHfwsf0CgD2Pf2ktk8eSsjguaF3QZ0EVphxUj:2bwIWHI8sSPGjU1AZ0E1U","tlshash":"75028914a8e24916752395245fef9a1cbcd0c003860acc04bbfc57e4afd6f5a89b769e","dom_hash":"domhashda04e9283853b7b1f45c8cc0651568b9","first_seen":"2026-09-06T22:54:30.195386Z","last_seen":"2026-09-06T22:54:30.195386Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"sa-zq.xyz/","fqdn":"sa-zq.xyz","domain":"sa-zq.xyz","tld":"xyz"},"ip":{"addr":"104.21.38.29","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-11T22:54:29Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"sa-zq.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"sa-zq.xyz","ip":{"addr":"172.67.218.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-08-20","domain_rank":0,"first_seen":"2026-09-06T22:45:05.398412Z","last_seen":"2026-09-06T22:45:05.398412Z","alert_count":14,"request_count":14,"received_data":561966,"sent_data":10998,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"jQuery:1.11.3","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"sa-zq.xyz/static/home/js/jquery-1.11.3.min.js","fqdn":"sa-zq.xyz","domain":"sa-zq.xyz","tld":"xyz"},"ip":{"addr":"172.67.218.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e73e73f10b0074aeb269444ce5e3f9b6","sha1":"ea877268850e9b9f0bd43fe667345d5091d0997d","sha256":"7e8a507ae93c58221a2d97d062019443e63992699980aa27535d804d2b2cceca","sha512":"25e4bc43cc350f38cab68b422101b528781bcd271a299cad39aaf64aa331ed0a35b9dfed3938ddccaa08c31161ee2c472acf297aabea334315758e128487b0fb","ssdeep":"1536:OP10iSi65U/dXXeyhzeBuG+HYE0WEeLDFoNqLTW8+S5VRZIVI6xSb8xh2ZbQnRme:R+41ZqLTW8xRrqSb8qGH77da98HrH","tlshash":"d993d8d9b7d67162977730b850bf510bb13a98eab80c4ca0f0a4d8e47d74a89507bf2d","size":95958,"data":"","first_seen":"2023-03-13T22:46:41Z","last_seen":"2026-09-06T22:54:30.21465Z","times_seen":40,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sa-zq.xyz/static/home/js/layer.js","fqdn":"sa-zq.xyz","domain":"sa-zq.xyz","tld":"xyz"},"ip":{"addr":"172.67.218.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"dd2d9abc4f31f7e0b5eadde59641632e","sha1":"98b28a118b5211190bf368bd437d8a26e752fa63","sha256":"772e7cd4bcdb897178cadf50cd8a97f99fcfc39027c02fb4ff20b7fe053d2af3","sha512":"590df323ae2253d2fa56a3b2e0bc579932dc2303e9b090a1e116cce0692fcad546438b78f729681f358d796b0d3c76611b4cee11a65bcea5c4a98a277f9f9f8b","ssdeep":"","tlshash":"0261a47af10136b7661320c5e06f690f76775151b2008800e0e5e1adaafed0ca8bbf5d","size":3267,"data":"","first_seen":"2023-03-08T08:53:50Z","last_seen":"2026-09-06T22:54:30.204914Z","times_seen":195,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"sa-zq.xyz/static/home/css/iconfont.css","fqdn":"sa-zq.xyz","domain":"sa-zq.xyz","tld":"xyz"},"ip":{"addr":"172.67.218.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sa-zq.xyz/login/index","date":"2026-09-06T22:53:52.597Z","timestamp":1788735232597,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sa-zq.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 13:07:37 GMT","end":"Wed, 18 Nov 2026 14:06:23 GMT"},"fingerprint":{"sha1":"5F:53:8F:95:62:7B:CE:2D:04:7F:AD:13:89:1C:74:5B:9F:50:2C:80","sha256":"2A:0D:53:67:0B:18:B7:C5:FF:EA:E6:A2:1A:2C:EF:11:9C:77:C1:58:46:8A:93:12:57:CD:63:30:58:7C:2E:0C"}}},"request":{"raw":"GET /static/home/css/iconfont.css HTTP/1.1\r\nHost: sa-zq.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sa-zq.xyz/login/index\r\nCookie: sec_session=eyJpdiI6Ik9LVmp2a1lmdXdHNXhqSTl0aERoWlE9PSIsInZhbHVlIjoieTF2dXZLeEx3YlY5SjdiTTE1dE5rNWtpQWpSWHZmUzNjaUxSVXNJdDVzODJRQXdpc1dKbXVkMFJwUUFKWTZFTiIsIm1hYyI6IjFiODU1YWJlZTNlOGZlMDU2OTI2MThlZTM4ZWJlMjQ3ZmU3OTk1ZjFjNDgwODQ0MWRhZjU3ZDEwZWM2NWNlNzMifQ%3D%3D; server_session_2bd7d8c0=1e5b82e34a6e2a8bc4de9e3e36980435\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 06 Sep 2026 22:53:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 26 Apr 2026 04:25:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ed93ad-1fab\"\r\nexpires: Mon, 07 Sep 2026 10:44:35 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 557\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uBeSTVr1srmmqkwnhPTTldbxgzvIU%2FPzJoiU0CYNn8fjAhz4S17s43HRNi9LfC6hPUJQWKqADhawixdJLyCmInnDk9rgUFvEelnG31sfeZDv0oOgIJsgbiW2Utc%3D\"}]}\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncf-ray: a3710d63be970883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8107,"size_decoded":6385,"mime_type":"text/css","magic":"ASCII text, with very long lines (6675)","md5":"4f15735b459aa3d5700216cdb3a514db","sha1":"743249775bef18a981e15c5a8c0911e7cdb1c262","sha256":"7cacd438aa0c20dc37f54d304140d49306a321a838316a9229384f1ce659ba73","sha512":"f8dd4cf1f4374f2432308b17a6eef7c456455bae041b75c9b5ebeb7eb42903b07f20c41ccc90ff1856f1bd335b5bd0043cb357e045ad044e2ab618a95735dd7a","ssdeep":"96:2hLRf5BWTx8369CfYYoqFblqpAnh/Y6nuE3ZAScKMlGXp2UEIRIjWkbczMER6hD1:2hPB5xuqFJ0EJAS1Mqp97pkbcwER0MY","tlshash":"77f14bf01e2c38b41791d8866227b654bf91b33fc9528c57e12a2d8cc3f5718928abd8","first_seen":"2025-05-17T11:45:14.487878Z","last_seen":"2026-09-06T22:54:30.202453Z","times_seen":16,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"sa-zq.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sa-zq.xyz/static/new/layui.css","fqdn":"sa-zq.xyz","domain":"sa-zq.xyz","tld":"xyz"},"ip":{"addr":"172.67.218.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sa-zq.xyz/login/index","date":"2026-09-06T22:53:52.602Z","timestamp":1788735232602,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sa-zq.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 13:07:37 GMT","end":"Wed, 18 Nov 2026 14:06:23 GMT"},"fingerprint":{"sha1":"5F:53:8F:95:62:7B:CE:2D:04:7F:AD:13:89:1C:74:5B:9F:50:2C:80","sha256":"2A:0D:53:67:0B:18:B7:C5:FF:EA:E6:A2:1A:2C:EF:11:9C:77:C1:58:46:8A:93:12:57:CD:63:30:58:7C:2E:0C"}}},"request":{"raw":"GET /static/new/layui.css HTTP/1.1\r\nHost: sa-zq.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sa-zq.xyz/login/index\r\nCookie: sec_session=eyJpdiI6Ik9LVmp2a1lmdXdHNXhqSTl0aERoWlE9PSIsInZhbHVlIjoieTF2dXZLeEx3YlY5SjdiTTE1dE5rNWtpQWpSWHZmUzNjaUxSVXNJdDVzODJRQXdpc1dKbXVkMFJwUUFKWTZFTiIsIm1hYyI6IjFiODU1YWJlZTNlOGZlMDU2OTI2MThlZTM4ZWJlMjQ3ZmU3OTk1ZjFjNDgwODQ0MWRhZjU3ZDEwZWM2NWNlNzMifQ%3D%3D; server_session_2bd7d8c0=1e5b82e34a6e2a8bc4de9e3e36980435\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 06 Sep 2026 22:53:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 26 Apr 2026 04:43:37 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ed97f9-1e39c\"\r\nexpires: Mon, 07 Sep 2026 10:44:35 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 557\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x3ZDuIF%2BKPHdw1iJYjyZTWtTqyA4CINt4iVqSqHEyJFdPglrwjyYQtxzdgY2c7XhcKkDKDlajOvg%2FawzTDsMIyHuOdYJpPaack8Rkb3VxoBc3MJoAncGPVEv7gY%3D\"}]}\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncf-ray: a3710d63ce990883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":123804,"size_decoded":22308,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"123d8c170eba3282831b951684e100d5","sha1":"79d0e22a4a3e6ae67a6080aa0a689809b4d8fc38","sha256":"9550b63d91f82b0faa112e7d1d6e1e99792ad4f86eb63760b58f55b10f8da4aa","sha512":"8efab452ecdcbb1b3c5bb8b36a8f9a9eb330c89985f71eb8d747621bd6c44e84f7ed444e19e444c351fec086a3bc5af2355b4121674abc041115a7e0de291376","ssdeep":"768:iT0gZN/qdZyGYLF9hlDj1JpZ9rwyQaIYKNR3zdVhl09Tr1BpRNMyM6U8ql9HKikr:aF/qdZyDHIfN0S5Y8gzJGPb+QgI6n","tlshash":"ffc39432e5012c98712bc315e1ccbebda5b89902ea630e6df352371b8b858971177f5b","first_seen":"2024-07-18T11:13:13Z","last_seen":"2026-09-06T22:54:30.203728Z","times_seen":174,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"sa-zq.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sa-zq.xyz/static/home/js/layer.js","fqdn":"sa-zq.xyz","domain":"sa-zq.xyz","tld":"xyz"},"ip":{"addr":"172.67.218.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sa-zq.xyz/login/index","date":"2026-09-06T22:53:52.605Z","timestamp":1788735232605,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sa-zq.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 13:07:37 GMT","end":"Wed, 18 Nov 2026 14:06:23 GMT"},"fingerprint":{"sha1":"5F:53:8F:95:62:7B:CE:2D:04:7F:AD:13:89:1C:74:5B:9F:50:2C:80","sha256":"2A:0D:53:67:0B:18:B7:C5:FF:EA:E6:A2:1A:2C:EF:11:9C:77:C1:58:46:8A:93:12:57:CD:63:30:58:7C:2E:0C"}}},"request":{"raw":"GET /static/home/js/layer.js HTTP/1.1\r\nHost: sa-zq.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sa-zq.xyz/login/index\r\nCookie: sec_session=eyJpdiI6Ik9LVmp2a1lmdXdHNXhqSTl0aERoWlE9PSIsInZhbHVlIjoieTF2dXZLeEx3YlY5SjdiTTE1dE5rNWtpQWpSWHZmUzNjaUxSVXNJdDVzODJRQXdpc1dKbXVkMFJwUUFKWTZFTiIsIm1hYyI6IjFiODU1YWJlZTNlOGZlMDU2OTI2MThlZTM4ZWJlMjQ3ZmU3OTk1ZjFjNDgwODQ0MWRhZjU3ZDEwZWM2NWNlNzMifQ%3D%3D; server_session_2bd7d8c0=1e5b82e34a6e2a8bc4de9e3e36980435\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 06 Sep 2026 22:53:52 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 26 Apr 2026 04:25:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ed93ad-cc3\"\r\nexpires: Mon, 07 Sep 2026 10:44:34 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 557\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IjLjAqf1HFUp5qUIg4%2FCM9xJinrqFht7XBuvsoVUNheGVBzMBIeGxy39n4%2F%2B0%2BNv1bJm7UDfK33XVbCDoINp4Kn9aAsdooMsL4YFDagaVCnBZn7JFNm2ni0qnKU%3D\"}]}\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a3710d63ce9b0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3267,"size_decoded":2311,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (3204)","md5":"dd2d9abc4f31f7e0b5eadde59641632e","sha1":"98b28a118b5211190bf368bd437d8a26e752fa63","sha256":"772e7cd4bcdb897178cadf50cd8a97f99fcfc39027c02fb4ff20b7fe053d2af3","sha512":"590df323ae2253d2fa56a3b2e0bc579932dc2303e9b090a1e116cce0692fcad546438b78f729681f358d796b0d3c76611b4cee11a65bcea5c4a98a277f9f9f8b","ssdeep":"","tlshash":"0261a47af10136b7661320c5e06f690f76775151b2008800e0e5e1adaafed0ca8bbf5d","first_seen":"2023-03-08T08:53:50Z","last_seen":"2026-09-06T22:54:30.204914Z","times_seen":195,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"sa-zq.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sa-zq.xyz/static/new/0004.png","fqdn":"sa-zq.xyz","domain":"sa-zq.xyz","tld":"xyz"},"ip":{"addr":"172.67.218.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sa-zq.xyz/login/index","date":"2026-09-06T22:53:52.613Z","timestamp":1788735232613,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sa-zq.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 13:07:37 GMT","end":"Wed, 18 Nov 2026 14:06:23 GMT"},"fingerprint":{"sha1":"5F:53:8F:95:62:7B:CE:2D:04:7F:AD:13:89:1C:74:5B:9F:50:2C:80","sha256":"2A:0D:53:67:0B:18:B7:C5:FF:EA:E6:A2:1A:2C:EF:11:9C:77:C1:58:46:8A:93:12:57:CD:63:30:58:7C:2E:0C"}}},"request":{"raw":"GET /static/new/0004.png HTTP/1.1\r\nHost: sa-zq.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sa-zq.xyz/login/index\r\nCookie: sec_session=eyJpdiI6Ik9LVmp2a1lmdXdHNXhqSTl0aERoWlE9PSIsInZhbHVlIjoieTF2dXZLeEx3YlY5SjdiTTE1dE5rNWtpQWpSWHZmUzNjaUxSVXNJdDVzODJRQXdpc1dKbXVkMFJwUUFKWTZFTiIsIm1hYyI6IjFiODU1YWJlZTNlOGZlMDU2OTI2MThlZTM4ZWJlMjQ3ZmU3OTk1ZjFjNDgwODQ0MWRhZjU3ZDEwZWM2NWNlNzMifQ%3D%3D; server_session_2bd7d8c0=1e5b82e34a6e2a8bc4de9e3e36980435\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 06 Sep 2026 22:53:52 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 27 Jun 2026 06:28:37 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a3f6d95-80b\"\r\nexpires: Tue, 06 Oct 2026 22:44:35 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 557\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hxUCImSN1L6g39gjoOKscVvLGUqOvzeNMQcR6wcU31GMzBTnRHIO5ZoVjgVhSS4zC54nCEDSyTPgY4lPlMgmlvCPEct%2BuZN9qzrTCcxEu%2FgBHt7aAQfkMylWjk0%3D\"}]}\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a3710d63de9c0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2059,"size_decoded":2817,"mime_type":"image/png","magic":"PNG image data, 310 x 162, 8-bit colormap, non-interlaced","md5":"99d8b72c3a761c853526b0678af1a35d","sha1":"422dffe1a328be45b6cd8ccc0dccdc624b4ac8c8","sha256":"c953e9625fd1e9dd8057b9f63f33f15deb55c0d46ae810fecae949b2449f696a","sha512":"3c8b1dc30f7f3ef74fb4ec63cb214b463ead856542644a0df581b248846f71a3a2a4092e4cd706d7dcf7aa9de08a5b7fe6bc74df8eed2f299b2f166bc085757d","ssdeep":"","tlshash":"4d41f8afe8c4167acfc35da1e54f767207897bf82121a1e93424d5271d4993e660310e","first_seen":"2026-09-06T22:45:08.503009Z","last_seen":"2026-09-06T22:54:30.207375Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"sa-zq.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sa-zq.xyz/static/new/phone.png","fqdn":"sa-zq.xyz","domain":"sa-zq.xyz","tld":"xyz"},"ip":{"addr":"172.67.218.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sa-zq.xyz/login/index","date":"2026-09-06T22:53:52.615Z","timestamp":1788735232615,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sa-zq.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 13:07:37 GMT","end":"Wed, 18 Nov 2026 14:06:23 GMT"},"fingerprint":{"sha1":"5F:53:8F:95:62:7B:CE:2D:04:7F:AD:13:89:1C:74:5B:9F:50:2C:80","sha256":"2A:0D:53:67:0B:18:B7:C5:FF:EA:E6:A2:1A:2C:EF:11:9C:77:C1:58:46:8A:93:12:57:CD:63:30:58:7C:2E:0C"}}},"request":{"raw":"GET /static/new/phone.png HTTP/1.1\r\nHost: sa-zq.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sa-zq.xyz/login/index\r\nCookie: sec_session=eyJpdiI6Ik9LVmp2a1lmdXdHNXhqSTl0aERoWlE9PSIsInZhbHVlIjoieTF2dXZLeEx3YlY5SjdiTTE1dE5rNWtpQWpSWHZmUzNjaUxSVXNJdDVzODJRQXdpc1dKbXVkMFJwUUFKWTZFTiIsIm1hYyI6IjFiODU1YWJlZTNlOGZlMDU2OTI2MThlZTM4ZWJlMjQ3ZmU3OTk1ZjFjNDgwODQ0MWRhZjU3ZDEwZWM2NWNlNzMifQ%3D%3D; server_session_2bd7d8c0=1e5b82e34a6e2a8bc4de9e3e36980435\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 06 Sep 2026 22:53:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Sun, 26 Apr 2026 04:37:32 GMT\r\netag: \"69ed968c-2e5\"\r\nexpires: Tue, 06 Oct 2026 22:44:35 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 557\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n8ZvpP5UBhEMqaA2IksK2qcck%2F1Pi2iUvW1kvsEemziL3xHWwvZILt%2Bzl8oF4JJHEKbnkHASLirmdkHPo7ol1z%2BrzSoaGT4mXMIoZN9giljydoO2wZEC%2BhAtJhw%3D\"}]}\r\ncf-ray: a3710d63de9d0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 741\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":741,"size_decoded":1517,"mime_type":"image/png","magic":"PNG image data, 44 x 44, 8-bit/color RGBA, non-interlaced","md5":"13a035f4f2bba4abcfe1e6c18e3eec1f","sha1":"b225373428a9130b72b5deddd7ca893d00013b70","sha256":"1399c8f4e9ef5ef78ab425f20039219808915d18f00cfa18d57fde0252e599bf","sha512":"dbcc2de962cc21384f2152733c92ca47cd13459231d15548313a7f1cfa7f537ae9fc15f57062f530ea8af9111f69a72d9493695be1db0c3c07bbe92481d5f48c","ssdeep":"","tlshash":"6d01751f700dbcd4e99436a1d92378a0c6b75498100602045a22f8757d86cdcc60a382","first_seen":"2026-05-20T17:38:06.691766Z","last_seen":"2026-09-06T22:54:30.209029Z","times_seen":3,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"sa-zq.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sa-zq.xyz/static/new/password.png","fqdn":"sa-zq.xyz","domain":"sa-zq.xyz","tld":"xyz"},"ip":{"addr":"172.67.218.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sa-zq.xyz/login/index","date":"2026-09-06T22:53:52.617Z","timestamp":1788735232617,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sa-zq.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 13:07:37 GMT","end":"Wed, 18 Nov 2026 14:06:23 GMT"},"fingerprint":{"sha1":"5F:53:8F:95:62:7B:CE:2D:04:7F:AD:13:89:1C:74:5B:9F:50:2C:80","sha256":"2A:0D:53:67:0B:18:B7:C5:FF:EA:E6:A2:1A:2C:EF:11:9C:77:C1:58:46:8A:93:12:57:CD:63:30:58:7C:2E:0C"}}},"request":{"raw":"GET /static/new/password.png HTTP/1.1\r\nHost: sa-zq.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sa-zq.xyz/login/index\r\nCookie: sec_session=eyJpdiI6Ik9LVmp2a1lmdXdHNXhqSTl0aERoWlE9PSIsInZhbHVlIjoieTF2dXZLeEx3YlY5SjdiTTE1dE5rNWtpQWpSWHZmUzNjaUxSVXNJdDVzODJRQXdpc1dKbXVkMFJwUUFKWTZFTiIsIm1hYyI6IjFiODU1YWJlZTNlOGZlMDU2OTI2MThlZTM4ZWJlMjQ3ZmU3OTk1ZjFjNDgwODQ0MWRhZjU3ZDEwZWM2NWNlNzMifQ%3D%3D; server_session_2bd7d8c0=1e5b82e34a6e2a8bc4de9e3e36980435\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 06 Sep 2026 22:53:52 GMT\r\ncontent-type: image/png\r\nlast-modified: Sun, 26 Apr 2026 04:37:32 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ed968c-4fe\"\r\nexpires: Tue, 06 Oct 2026 22:44:35 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 557\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=J0tVEi8oQjhPSN%2BzAt8JgptrFwawmmT05Q4XzPCekaQm7xJRSS8FsrLFE4mW9h2PGZbPLVRY4RaYjB2fN2LIY9EwxWAlv%2BIHb0c75A9XxJRzTVx2ojtYCE2Sxoc%3D\"}]}\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a3710d63dea10883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1278,"size_decoded":2084,"mime_type":"image/png","magic":"PNG image data, 44 x 44, 8-bit/color RGBA, non-interlaced","md5":"115e3d18ed257eb88e8a66fc526d07f4","sha1":"a30637a806252324d758fd70e5ded5c58d09b78d","sha256":"6c18e40b38c43d1a35b1903c129df39c473db5e635599594f820750155f1e55b","sha512":"41db5ec9f534383995b12cd059b6be12a59e3620012d410c88a7efa8f0665edc6f23ff0dcc24346746ff7cca1904bcb50602671184bb39653a5325fa38a4f515","ssdeep":"","tlshash":"d021c8577cd432b4ce611e5791582d8dc0aa691a014b56d60b0b54a9cae3cd8caef0c9","first_seen":"2025-09-27T06:12:28.931175Z","last_seen":"2026-09-06T22:54:30.210508Z","times_seen":4,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"sa-zq.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sa-zq.xyz/","fqdn":"sa-zq.xyz","domain":"sa-zq.xyz","tld":"xyz"},"ip":{"addr":"172.67.218.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-06T22:53:51.184Z","timestamp":1788735231184,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sa-zq.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 13:07:37 GMT","end":"Wed, 18 Nov 2026 14:06:23 GMT"},"fingerprint":{"sha1":"5F:53:8F:95:62:7B:CE:2D:04:7F:AD:13:89:1C:74:5B:9F:50:2C:80","sha256":"2A:0D:53:67:0B:18:B7:C5:FF:EA:E6:A2:1A:2C:EF:11:9C:77:C1:58:46:8A:93:12:57:CD:63:30:58:7C:2E:0C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: sa-zq.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\ndate: Sun, 06 Sep 2026 22:53:52 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://sa-zq.xyz/login/index\r\nserver: cloudflare\r\ncache-control: no-cache, private\r\nset-cookie: sec_session=eyJpdiI6InM0TkhMdUJqbGk1T3BCU2JHMWlyckE9PSIsInZhbHVlIjoiMXl1bkJhQWVkcDhoNlVCM1h1WGZxV0twUFYySmZ6VjVcL1hXc0RoR0h6Y3VaQlF3OTIxWERsUGlYcUoyXC9BMnFVIiwibWFjIjoiZjgxNTAwZGU5N2NmMTBlZmFjYTdmNzlmZGRkMzdmNWY5MTQ3NGU3MjYwMWVlYTM5YTNjODQ4MzI3ZmIwMTNhOCJ9; expires=Mon, 07-Sep-2026 00:53:51 GMT; Max-Age=7200; path=/; httponly\nserver_session_2bd7d8c0=1e5b82e34a6e2a8bc4de9e3e36980435; Max-Age=864000; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=H0m%2Fvp6kTdMQzMZjgR6naA0M%2FHFaAMNDHQGJGXzrVd%2F8th99oWMsuTvtQPesbNkChPgJ7q3CzSOiIwKyRtyhzC0fUk%2B%2FsvmVhKbyvVQ95ixceER5ipszpek%2Flas%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3710d5b0c193181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"sec_session","value":"eyJpdiI6InM0TkhMdUJqbGk1T3BCU2JHMWlyckE9PSIsInZhbHVlIjoiMXl1bkJhQWVkcDhoNlVCM1h1WGZxV0twUFYySmZ6VjVcL1hXc0RoR0h6Y3VaQlF3OTIxWERsUGlYcUoyXC9BMnFVIiwibWFjIjoiZjgxNTAwZGU5N2NmMTBlZmFjYTdmNzlmZGRkMzdmNWY5MTQ3NGU3MjYwMWVlYTM5YTNjODQ4MzI3ZmIwMTNhOCJ9","quoted":false,"path":"/","expires":"2026-09-07T00:53:51Z","raw_expires":"Mon, 07-Sep-2026 00:53:51 GMT","max_age":7200,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"sec_session=eyJpdiI6InM0TkhMdUJqbGk1T3BCU2JHMWlyckE9PSIsInZhbHVlIjoiMXl1bkJhQWVkcDhoNlVCM1h1WGZxV0twUFYySmZ6VjVcL1hXc0RoR0h6Y3VaQlF3OTIxWERsUGlYcUoyXC9BMnFVIiwibWFjIjoiZjgxNTAwZGU5N2NmMTBlZmFjYTdmNzlmZGRkMzdmNWY5MTQ3NGU3MjYwMWVlYTM5YTNjODQ4MzI3ZmIwMTNhOCJ9; expires=Mon, 07-Sep-2026 00:53:51 GMT; Max-Age=7200; path=/; httponly"},{"name":"server_session_2bd7d8c0","value":"1e5b82e34a6e2a8bc4de9e3e36980435","quoted":false,"path":"/","max_age":864000,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"server_session_2bd7d8c0=1e5b82e34a6e2a8bc4de9e3e36980435; Max-Age=864000; httponly; path=/"}],"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-07T00:13:55.061548Z","times_seen":18319651,"resource_available":true,"data":null}},"time_used":832,"timings":{"blocked":-1,"dns":5,"connect":1,"send":0,"wait":816,"receive":0,"ssl":10},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"sa-zq.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sa-zq.xyz/static/home/css/framework7.ios.min.css","fqdn":"sa-zq.xyz","domain":"sa-zq.xyz","tld":"xyz"},"ip":{"addr":"172.67.218.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sa-zq.xyz/login/index","date":"2026-09-06T22:53:52.593Z","timestamp":1788735232593,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sa-zq.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 13:07:37 GMT","end":"Wed, 18 Nov 2026 14:06:23 GMT"},"fingerprint":{"sha1":"5F:53:8F:95:62:7B:CE:2D:04:7F:AD:13:89:1C:74:5B:9F:50:2C:80","sha256":"2A:0D:53:67:0B:18:B7:C5:FF:EA:E6:A2:1A:2C:EF:11:9C:77:C1:58:46:8A:93:12:57:CD:63:30:58:7C:2E:0C"}}},"request":{"raw":"GET /static/home/css/framework7.ios.min.css HTTP/1.1\r\nHost: sa-zq.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sa-zq.xyz/login/index\r\nCookie: sec_session=eyJpdiI6Ik9LVmp2a1lmdXdHNXhqSTl0aERoWlE9PSIsInZhbHVlIjoieTF2dXZLeEx3YlY5SjdiTTE1dE5rNWtpQWpSWHZmUzNjaUxSVXNJdDVzODJRQXdpc1dKbXVkMFJwUUFKWTZFTiIsIm1hYyI6IjFiODU1YWJlZTNlOGZlMDU2OTI2MThlZTM4ZWJlMjQ3ZmU3OTk1ZjFjNDgwODQ0MWRhZjU3ZDEwZWM2NWNlNzMifQ%3D%3D; server_session_2bd7d8c0=1e5b82e34a6e2a8bc4de9e3e36980435\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 06 Sep 2026 22:53:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 26 Apr 2026 04:25:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ed93ad-29422\"\r\nexpires: Mon, 07 Sep 2026 10:44:35 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 557\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5%2BK5SbNRsGjCnDFQw3lahmAjgba6Doc7ZzFmI5NHoES2cEH3BqG0AkiPMKVBJC5tuMMUUGOI%2Bkv90et2MDw63NOdGpGTi87QJbbVmjm9aYSOK%2B2BMwsr1vKBjjM%3D\"}]}\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncf-ray: a3710d63be950883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":168994,"size_decoded":23911,"mime_type":"text/css","magic":"ASCII text, with very long lines (65262)","md5":"eda30e2bf7b00275e09cc52bd1d59a9d","sha1":"344920a32d2ebc77452130238d69e7ea6500b4d6","sha256":"b9c035f80cb823ac85db49e3602a9b74f23830db9230f082bf856fd5a134bd2e","sha512":"12614453cf9b48372ada3ee7be2ab8e865742475efd54d75b75356661b70795667b69ade0a11f83183ab235012e5034ab4f7ef4a2941418403883456b6df3a2b","ssdeep":"1536:HyMySmN3OE3dlV0CEsfMIC8f3dlfwfEIqfgS/zSxsocYqA:MJf7fwfEjfgScsRs","tlshash":"b3f3d86b8551328cb227c9166bc42d58522dc453e7231cffa1167e1ecbcbe4612f6b8b","first_seen":"2023-09-18T22:33:47Z","last_seen":"2026-09-06T22:54:30.212409Z","times_seen":15,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"sa-zq.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sa-zq.xyz/static/new/common.css","fqdn":"sa-zq.xyz","domain":"sa-zq.xyz","tld":"xyz"},"ip":{"addr":"172.67.218.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sa-zq.xyz/login/index","date":"2026-09-06T22:53:52.598Z","timestamp":1788735232598,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sa-zq.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 13:07:37 GMT","end":"Wed, 18 Nov 2026 14:06:23 GMT"},"fingerprint":{"sha1":"5F:53:8F:95:62:7B:CE:2D:04:7F:AD:13:89:1C:74:5B:9F:50:2C:80","sha256":"2A:0D:53:67:0B:18:B7:C5:FF:EA:E6:A2:1A:2C:EF:11:9C:77:C1:58:46:8A:93:12:57:CD:63:30:58:7C:2E:0C"}}},"request":{"raw":"GET /static/new/common.css HTTP/1.1\r\nHost: sa-zq.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sa-zq.xyz/login/index\r\nCookie: sec_session=eyJpdiI6Ik9LVmp2a1lmdXdHNXhqSTl0aERoWlE9PSIsInZhbHVlIjoieTF2dXZLeEx3YlY5SjdiTTE1dE5rNWtpQWpSWHZmUzNjaUxSVXNJdDVzODJRQXdpc1dKbXVkMFJwUUFKWTZFTiIsIm1hYyI6IjFiODU1YWJlZTNlOGZlMDU2OTI2MThlZTM4ZWJlMjQ3ZmU3OTk1ZjFjNDgwODQ0MWRhZjU3ZDEwZWM2NWNlNzMifQ%3D%3D; server_session_2bd7d8c0=1e5b82e34a6e2a8bc4de9e3e36980435\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 06 Sep 2026 22:53:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 28 Apr 2026 10:29:09 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69f08bf5-d04d\"\r\nexpires: Mon, 07 Sep 2026 10:44:35 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 557\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Er0YQaaz4MSCxjQzxY79epXLA2%2F5G5yXxjHVjwGynZ9J2RmkTGUUjphrx5Y6WunAEnK0sIFIb0v5BIwPwh1FQ4IZHeDffm6zuY%2BUq6wShwA0t7umjMlruDtdU7Q%3D\"}]}\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncf-ray: a3710d63be980883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":53325,"size_decoded":8750,"mime_type":"text/css","magic":"ASCII text","md5":"332697a7674bf75a57566a5305f7f6c0","sha1":"7723ed4c1ff91eee1dbafb9087c18b29ad51254a","sha256":"0e17710ec07aa06ad5006400a74b9754db54128f58db0359b4b22f8e4cca09cb","sha512":"f9536bf8f8f394299255ea26af95088bd567d79876704537dece822dc2ce22e1f0f31b826de3abf6b5bba4ca95a8435faed0833a7b361169d8fd436725c625ed","ssdeep":"768:53FhFZs+Qpj8CQLD22TQZQ4jQ4BBFWGFKC+TNi5HrFheTo05KsyD4hfMG:5Df3QBkGUC+TNi5HrPeTo05KsyD4hfMG","tlshash":"3933eca6977b5482b815c8a97f376b93134c5007904ee638bfd13a0ccfc51e5a6b1b8e","first_seen":"2026-09-06T22:45:08.477309Z","last_seen":"2026-09-06T22:54:30.213124Z","times_seen":2,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"sa-zq.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sa-zq.xyz/static/home/js/jquery-1.11.3.min.js","fqdn":"sa-zq.xyz","domain":"sa-zq.xyz","tld":"xyz"},"ip":{"addr":"172.67.218.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sa-zq.xyz/login/index","date":"2026-09-06T22:53:52.603Z","timestamp":1788735232603,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sa-zq.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 13:07:37 GMT","end":"Wed, 18 Nov 2026 14:06:23 GMT"},"fingerprint":{"sha1":"5F:53:8F:95:62:7B:CE:2D:04:7F:AD:13:89:1C:74:5B:9F:50:2C:80","sha256":"2A:0D:53:67:0B:18:B7:C5:FF:EA:E6:A2:1A:2C:EF:11:9C:77:C1:58:46:8A:93:12:57:CD:63:30:58:7C:2E:0C"}}},"request":{"raw":"GET /static/home/js/jquery-1.11.3.min.js HTTP/1.1\r\nHost: sa-zq.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sa-zq.xyz/login/index\r\nCookie: sec_session=eyJpdiI6Ik9LVmp2a1lmdXdHNXhqSTl0aERoWlE9PSIsInZhbHVlIjoieTF2dXZLeEx3YlY5SjdiTTE1dE5rNWtpQWpSWHZmUzNjaUxSVXNJdDVzODJRQXdpc1dKbXVkMFJwUUFKWTZFTiIsIm1hYyI6IjFiODU1YWJlZTNlOGZlMDU2OTI2MThlZTM4ZWJlMjQ3ZmU3OTk1ZjFjNDgwODQ0MWRhZjU3ZDEwZWM2NWNlNzMifQ%3D%3D; server_session_2bd7d8c0=1e5b82e34a6e2a8bc4de9e3e36980435\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 06 Sep 2026 22:53:52 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 20 Aug 2026 13:33:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a870214-176d6\"\r\nexpires: Mon, 07 Sep 2026 10:44:35 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 557\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jc1dJu4UIc13WTH9IsplqpdWcKOXpamaK%2Fi1QY9l2SelxQ9hUufO%2Fy2JjrvOSTDTHmkDacDdw3AsjB6IN6sDG7L2IlcmqoDrJfHjBfg%2BwfUN8RaTnu2kTq3LPQ4%3D\"}]}\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a3710d63ce9a0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":95958,"size_decoded":34346,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32038)","md5":"e73e73f10b0074aeb269444ce5e3f9b6","sha1":"ea877268850e9b9f0bd43fe667345d5091d0997d","sha256":"7e8a507ae93c58221a2d97d062019443e63992699980aa27535d804d2b2cceca","sha512":"25e4bc43cc350f38cab68b422101b528781bcd271a299cad39aaf64aa331ed0a35b9dfed3938ddccaa08c31161ee2c472acf297aabea334315758e128487b0fb","ssdeep":"1536:OP10iSi65U/dXXeyhzeBuG+HYE0WEeLDFoNqLTW8+S5VRZIVI6xSb8xh2ZbQnRme:R+41ZqLTW8xRrqSb8qGH77da98HrH","tlshash":"d993d8d9b7d67162977730b850bf510bb13a98eab80c4ca0f0a4d8e47d74a89507bf2d","first_seen":"2023-03-13T22:46:41Z","last_seen":"2026-09-06T22:54:30.21465Z","times_seen":40,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"sa-zq.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sa-zq.xyz/static/home/js/need/layer.css?2.0","fqdn":"sa-zq.xyz","domain":"sa-zq.xyz","tld":"xyz"},"ip":{"addr":"172.67.218.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sa-zq.xyz/login/index","date":"2026-09-06T22:53:52.685Z","timestamp":1788735232685,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sa-zq.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 13:07:37 GMT","end":"Wed, 18 Nov 2026 14:06:23 GMT"},"fingerprint":{"sha1":"5F:53:8F:95:62:7B:CE:2D:04:7F:AD:13:89:1C:74:5B:9F:50:2C:80","sha256":"2A:0D:53:67:0B:18:B7:C5:FF:EA:E6:A2:1A:2C:EF:11:9C:77:C1:58:46:8A:93:12:57:CD:63:30:58:7C:2E:0C"}}},"request":{"raw":"GET /static/home/js/need/layer.css?2.0 HTTP/1.1\r\nHost: sa-zq.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sa-zq.xyz/login/index\r\nCookie: sec_session=eyJpdiI6Ik9LVmp2a1lmdXdHNXhqSTl0aERoWlE9PSIsInZhbHVlIjoieTF2dXZLeEx3YlY5SjdiTTE1dE5rNWtpQWpSWHZmUzNjaUxSVXNJdDVzODJRQXdpc1dKbXVkMFJwUUFKWTZFTiIsIm1hYyI6IjFiODU1YWJlZTNlOGZlMDU2OTI2MThlZTM4ZWJlMjQ3ZmU3OTk1ZjFjNDgwODQ0MWRhZjU3ZDEwZWM2NWNlNzMifQ%3D%3D; server_session_2bd7d8c0=1e5b82e34a6e2a8bc4de9e3e36980435\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 06 Sep 2026 22:53:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 28 Apr 2026 11:12:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69f0960c-148a\"\r\nexpires: Mon, 07 Sep 2026 10:44:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 556\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zzKlUerRCEI94buajM8QHMSe%2BjPtQAA%2FL0l%2FhF8%2FugYxUfZ2s4B%2Bi3UFoWCkgoOejh60vM6Q4P9MLkFkZI4BSC5ayDBFQerjn3tkRVL8VfOP7essqLJNTJkwlfk%3D\"}]}\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncf-ray: a3710d644eab0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5258,"size_decoded":2106,"mime_type":"text/css","magic":"ASCII text, with very long lines (5258), with no line terminators","md5":"780aa91da211135bf9770e4b9cf73e35","sha1":"f653d6eefdca02ab217a282b3969469bfde5cae0","sha256":"ccdaea9aeadb419137a30fecf95fb0eabff8a25a21ed37584420fe738cf9534a","sha512":"ebb270db9e5687fff797cb1ecd6d16397de0f7480a953a118d3b5aeb4026c6225b3201ee63f1cda23a9fd72c4bac67145b9435bc63a6b79d8a4346349a95edb2","ssdeep":"96:tJA7fs72CFMf26B6ZtbXBh+Bcw0iZRfcSNHIFSf:J72D5YZtbXucwlrESNoa","tlshash":"86b1d896989303e8b027c51796dc5efe70388d43915209aef557382fc34bdd9b1b260b","first_seen":"2026-09-06T22:45:08.485488Z","last_seen":"2026-09-06T22:54:30.216212Z","times_seen":2,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"sa-zq.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sa-zq.xyz/favicon.ico","fqdn":"sa-zq.xyz","domain":"sa-zq.xyz","tld":"xyz"},"ip":{"addr":"172.67.218.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sa-zq.xyz/login/index","date":"2026-09-06T22:53:52.746Z","timestamp":1788735232746,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sa-zq.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 13:07:37 GMT","end":"Wed, 18 Nov 2026 14:06:23 GMT"},"fingerprint":{"sha1":"5F:53:8F:95:62:7B:CE:2D:04:7F:AD:13:89:1C:74:5B:9F:50:2C:80","sha256":"2A:0D:53:67:0B:18:B7:C5:FF:EA:E6:A2:1A:2C:EF:11:9C:77:C1:58:46:8A:93:12:57:CD:63:30:58:7C:2E:0C"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: sa-zq.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sa-zq.xyz/login/index\r\nCookie: sec_session=eyJpdiI6Ik9LVmp2a1lmdXdHNXhqSTl0aERoWlE9PSIsInZhbHVlIjoieTF2dXZLeEx3YlY5SjdiTTE1dE5rNWtpQWpSWHZmUzNjaUxSVXNJdDVzODJRQXdpc1dKbXVkMFJwUUFKWTZFTiIsIm1hYyI6IjFiODU1YWJlZTNlOGZlMDU2OTI2MThlZTM4ZWJlMjQ3ZmU3OTk1ZjFjNDgwODQ0MWRhZjU3ZDEwZWM2NWNlNzMifQ%3D%3D; server_session_2bd7d8c0=1e5b82e34a6e2a8bc4de9e3e36980435\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 06 Sep 2026 22:53:52 GMT\r\ncontent-type: image/x-icon\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ugsgUxwTctxYyMh4LkEuRxnrHamVEMcxxfMFjRo0pCtU46IeDrXUPVmHR76UWsbUVOW4AiqmVkECPLWQolLpw9KFXEJGnezrCF40vWLCFrqtD5uGt3S%2FThC65E4%3D\"}]}\r\nlast-modified: Sat, 27 Jun 2026 06:26:29 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000\r\npriority: u=6,i=?0\r\nage: 556\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\netag: W/\"6a3f6d15-e48\"\r\ncf-ray: a3710d64aeb00883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3656,"size_decoded":4382,"mime_type":"image/x-icon","magic":"PNG image data, 166 x 148, 8-bit colormap, non-interlaced","md5":"99d4f462b942df6c089fd746010be1cd","sha1":"f2ab726e18014c4f4322773805c1856b61a43195","sha256":"fbe393ed731a23feaf4353f9d88ef9bfd3ed6fdf5a6d4d614adff8891ffda5fb","sha512":"006520ab6d7c8c986d65406f295300f00c3dc94b55c84f8cf714987033edc7c64abecafb1a1e4d73c06bfe3ae77e470fea3c8ecc4b4e474974aa4f0bdb9ae6db","ssdeep":"","tlshash":"e1716eb345f618116ec11112ffd990f18566ce8d3dab959c1213ef76e1807c13a353c5","first_seen":"2026-09-06T22:45:08.488548Z","last_seen":"2026-09-06T22:54:30.217409Z","times_seen":2,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"sa-zq.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sa-zq.xyz/login/index","fqdn":"sa-zq.xyz","domain":"sa-zq.xyz","tld":"xyz"},"ip":{"addr":"172.67.218.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-06T22:53:52.058Z","timestamp":1788735232058,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sa-zq.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 13:07:37 GMT","end":"Wed, 18 Nov 2026 14:06:23 GMT"},"fingerprint":{"sha1":"5F:53:8F:95:62:7B:CE:2D:04:7F:AD:13:89:1C:74:5B:9F:50:2C:80","sha256":"2A:0D:53:67:0B:18:B7:C5:FF:EA:E6:A2:1A:2C:EF:11:9C:77:C1:58:46:8A:93:12:57:CD:63:30:58:7C:2E:0C"}}},"request":{"raw":"GET /login/index HTTP/1.1\r\nHost: sa-zq.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: sec_session=eyJpdiI6InM0TkhMdUJqbGk1T3BCU2JHMWlyckE9PSIsInZhbHVlIjoiMXl1bkJhQWVkcDhoNlVCM1h1WGZxV0twUFYySmZ6VjVcL1hXc0RoR0h6Y3VaQlF3OTIxWERsUGlYcUoyXC9BMnFVIiwibWFjIjoiZjgxNTAwZGU5N2NmMTBlZmFjYTdmNzlmZGRkMzdmNWY5MTQ3NGU3MjYwMWVlYTM5YTNjODQ4MzI3ZmIwMTNhOCJ9; server_session_2bd7d8c0=1e5b82e34a6e2a8bc4de9e3e36980435\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 06 Sep 2026 22:53:52 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\ncache-control: no-cache, private\r\nset-cookie: sec_session=eyJpdiI6Ik9LVmp2a1lmdXdHNXhqSTl0aERoWlE9PSIsInZhbHVlIjoieTF2dXZLeEx3YlY5SjdiTTE1dE5rNWtpQWpSWHZmUzNjaUxSVXNJdDVzODJRQXdpc1dKbXVkMFJwUUFKWTZFTiIsIm1hYyI6IjFiODU1YWJlZTNlOGZlMDU2OTI2MThlZTM4ZWJlMjQ3ZmU3OTk1ZjFjNDgwODQ0MWRhZjU3ZDEwZWM2NWNlNzMifQ%3D%3D; expires=Mon, 07-Sep-2026 00:53:52 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=e%2F9RIstz9DAw9r5FFiuWmg5B3ntl7en2wppBkl3%2FwT%2FUy%2FhWVWsFFGyTR3hXOvSv%2FU%2Bg700NKuPDCNspirzkaOXPWnrCBvyEkIOffu21%2BBvIJsohR%2B%2B7XmPk8Iw%3D\"}]}\r\ncontent-encoding: zstd\r\ncf-ray: a3710d605bda3181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"sec_session","value":"eyJpdiI6Ik9LVmp2a1lmdXdHNXhqSTl0aERoWlE9PSIsInZhbHVlIjoieTF2dXZLeEx3YlY5SjdiTTE1dE5rNWtpQWpSWHZmUzNjaUxSVXNJdDVzODJRQXdpc1dKbXVkMFJwUUFKWTZFTiIsIm1hYyI6IjFiODU1YWJlZTNlOGZlMDU2OTI2MThlZTM4ZWJlMjQ3ZmU3OTk1ZjFjNDgwODQ0MWRhZjU3ZDEwZWM2NWNlNzMifQ%3D%3D","quoted":false,"path":"/","expires":"2026-09-07T00:53:52Z","raw_expires":"Mon, 07-Sep-2026 00:53:52 GMT","max_age":7200,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"sec_session=eyJpdiI6Ik9LVmp2a1lmdXdHNXhqSTl0aERoWlE9PSIsInZhbHVlIjoieTF2dXZLeEx3YlY5SjdiTTE1dE5rNWtpQWpSWHZmUzNjaUxSVXNJdDVzODJRQXdpc1dKbXVkMFJwUUFKWTZFTiIsIm1hYyI6IjFiODU1YWJlZTNlOGZlMDU2OTI2MThlZTM4ZWJlMjQ3ZmU3OTk1ZjFjNDgwODQ0MWRhZjU3ZDEwZWM2NWNlNzMifQ%3D%3D; expires=Mon, 07-Sep-2026 00:53:52 GMT; Max-Age=7200; path=/; httponly"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery:1.11.3","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8534,"size_decoded":3824,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"616b87997a6df10fd9529101009c5735","sha1":"0f6b009e318733a352d88ae9340cf5bccc723d68","sha256":"d8cf28173e489da33736442a5f1651a915bf18b401ad630cb55b76eab103f78e","sha512":"1a28ac42405f917d89aca61092714b2b712d6beeed46a1f1aa9f8cb303cc816187064867fb4ee56a659ce97608d5d8a82fe39338c32ddd2ee463de6e8e69ed9f","ssdeep":"192:flbRJ4JipBFLIHfwsf0CgD2Pf2ktk8eSsjguaF3QZ0EVphxk:VM02HI8sSPGjU1AZ0E1i","tlshash":"7302771468e24916752395245fef9a1cbcd0d003860acc04bbfc67e4bfc7e5a89b769e","first_seen":"2026-09-06T22:54:30.219005Z","last_seen":"2026-09-06T22:54:30.219005Z","times_seen":1,"resource_available":false,"data":null}},"time_used":339,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":339,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"sa-zq.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sa-zq.xyz/static/home/css/app.css?v=5.8","fqdn":"sa-zq.xyz","domain":"sa-zq.xyz","tld":"xyz"},"ip":{"addr":"172.67.218.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sa-zq.xyz/login/index","date":"2026-09-06T22:53:52.595Z","timestamp":1788735232595,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sa-zq.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 13:07:37 GMT","end":"Wed, 18 Nov 2026 14:06:23 GMT"},"fingerprint":{"sha1":"5F:53:8F:95:62:7B:CE:2D:04:7F:AD:13:89:1C:74:5B:9F:50:2C:80","sha256":"2A:0D:53:67:0B:18:B7:C5:FF:EA:E6:A2:1A:2C:EF:11:9C:77:C1:58:46:8A:93:12:57:CD:63:30:58:7C:2E:0C"}}},"request":{"raw":"GET /static/home/css/app.css?v=5.8 HTTP/1.1\r\nHost: sa-zq.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sa-zq.xyz/login/index\r\nCookie: sec_session=eyJpdiI6Ik9LVmp2a1lmdXdHNXhqSTl0aERoWlE9PSIsInZhbHVlIjoieTF2dXZLeEx3YlY5SjdiTTE1dE5rNWtpQWpSWHZmUzNjaUxSVXNJdDVzODJRQXdpc1dKbXVkMFJwUUFKWTZFTiIsIm1hYyI6IjFiODU1YWJlZTNlOGZlMDU2OTI2MThlZTM4ZWJlMjQ3ZmU3OTk1ZjFjNDgwODQ0MWRhZjU3ZDEwZWM2NWNlNzMifQ%3D%3D; server_session_2bd7d8c0=1e5b82e34a6e2a8bc4de9e3e36980435\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 06 Sep 2026 22:53:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 26 Apr 2026 04:25:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ed93ad-12722\"\r\nexpires: Mon, 07 Sep 2026 10:44:35 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 557\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=swjnaLT1tMU2%2FCzs5brQHgsbVEMS4ZOmbbW59WldvKn9FAJVMzXpmsQObnwjspIQWy5f8GuMYkgGD8FSGUv%2FvAcnptARKlMyx1hJzWa3d9PPAzOsVxE9qhFWizY%3D\"}]}\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncf-ray: a3710d63be960883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":75554,"size_decoded":12758,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (359)","md5":"268f389665cc982973b1fb1e1bb0615c","sha1":"e78998fd11d218d4ecd5c4385c7a738cbff8b891","sha256":"9887c8d33704416ed8664a5c5d8f1f7b33c29d9b80a5e35d6e332aa92a9f887f","sha512":"d07606435d821ddfb879c49fb748011d332b3196ca07b4a79d9fbcd5877cb2e6d25f08773a8239add73e1ff5d877676a7802c4f3d467e90ae80279215f184ef1","ssdeep":"768:OPuyVFeFMF0NGFdFMFF5MFFFyF2FWBbFj7xYvq8zY3QLP2Pkv4D+gtEsb0tUg:OPuyVU6RHmvMHUMIBbVb8zYJG/tUg","tlshash":"e373fd115b730d85f8aac0e56f665bc1230e408b4e0bca2dbfc2b6589f4e15578e6f8d","first_seen":"2026-09-06T22:45:08.473402Z","last_seen":"2026-09-06T22:54:30.22051Z","times_seen":2,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"sa-zq.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}