{"report_id":"d0d5fe5e-7471-4d58-9b61-06d88824788a","version":0,"status":"done","tags":[],"date":"2026-08-16T15:19:16Z","url":{"schema":"http","addr":"m.loss-dafa.com/","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":0,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"m.loss-dafa.com/","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"title":"实时开奖查询 - 大发彩票官方平台，轻松掌握每一轮精彩结果","dom":{"size":8209,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"9b8aec82c58f44db0e2da822dacba093","sha1":"eefdfd7d9d562be497b46a3340f84e863714e2bf","sha256":"20d91d56e189bcd65f395b82c8aa84f1cd48af613ccd6debf532c54acec37767","sha512":"9759bda4b09593e9305259d6c50675bdc446cd86d481bb119d0acf8e61e823d2913f9d3c93f2c4132110d061428251044770766c298f6d2cfca57e06c3c26a7c","ssdeep":"192:SrnMZjBPCpnDZ0CPBfE/k1mp6rPlyJzmRF4sArtg:1jmX7Artg","tlshash":"5f02871661d3115b2922d1a66fb3171b6664d407c30bc9a97fcc15cdef89ac9c8a738c","dom_hash":"domhash27012197961c49af023d3292681d65a6","first_seen":"2026-03-01T01:18:02.45292Z","last_seen":"2026-08-16T15:19:53.669963Z","times_seen":543,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"m.loss-dafa.com/","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":0,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-20T15:19:16Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"m.loss-dafa.com","ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":92,"request_count":23,"received_data":2121219,"sent_data":11567,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}]},{"fqdn":"156.244.169.211","ip":{"addr":"156.244.169.211","port":44141,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":9,"received_data":294811,"sent_data":5021,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"sdk.51.la","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2005-01-17","domain_rank":347679,"first_seen":"2021-03-08T16:03:51Z","last_seen":"2026-08-11T17:34:05.943368Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":457,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"m.loss-dafa.com/e/dongpo/tz/tz.js","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"cdd51774e8d302e07682e09384b53740","sha1":"a852f9f4dd23af5da2990398fa3c68e8c49ff3ab","sha256":"3bb758e6d57d175c9e965cda74d02359b8816fc8d64254213b4ad5085b8d98b8","sha512":"b10a9f2c24f49203d0a6e07415ad0eb597ec15a46ced2d2c47c868ffddf5fec36f383da050a2397641791fff604f798ee65e6a974f216126eeaafb8d49da5b00","ssdeep":"","tlshash":"23218c7fae231250e01691592bba676c3a3a001b6301cc307abcbe685f42f429447bd4","size":1160,"data":"","first_seen":"2026-08-10T04:17:50.869663Z","last_seen":"2026-08-16T15:19:53.685336Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/bootstrap/js/bootstrap.bundle.min.js","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"21d4551af5cc4ed4d818bdbdfea8c358","sha1":"df272a07ed30eaf8025b699c45736ba9d284e4d4","sha256":"35f4547d9364111aca4850347356bc5660a994f0d8b694d88f995098a7b547fa","sha512":"4dcd22faf4688265f834deedb8b6d07c1c5af0991f512031485573994df59d5747ca21c494f3f2d9c59f15a7260892b0d15aa8bebcca85d7764d24cc740c69da","ssdeep":"1536:/SwJiEbnTl6R2t49CFliFCIg/yWszSraJd5qUFH9tZwcE+iYZMgZdj:6wfs+SSO5q4tZwcEVYZFj","tlshash":"2383b5593244b8730ade85b68037430bf2265998b14b812cb57cadde2a7dcc67277f78","size":80821,"data":"","first_seen":"2025-06-18T01:20:12.005242Z","last_seen":"2026-08-16T15:19:53.67204Z","times_seen":2890,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/swiper/js/swiper-bundle.min.js","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"21b78ba7133b3d67cf8b09cd6a26d386","sha1":"ea59f37b232db6dee2694078bf21e153a09bacdd","sha256":"6f9df49fe12f77b66daba876cb33b7090b2443f570a2a4b9541cddd705440aa5","sha512":"dc48bb38f168f37930ddc3db0cb78b867fd817cb5907b56cf2c7e58b407f2847a4bab78be5ea2c0deb216052020afb782bc8b4c948a5fe52b77128a27365a392","ssdeep":"1536:TIJQfGP7LP8NEuWGKF+IlzholxU/2Bkt+9SD8jv1nTHlU9ymp8Mj0HEOS5hAsVuZ:0JCN+TXD2BkQZFU9tp8Mj0k95h5cpnv","tlshash":"02d3f8896221b57646e316db93e4c221a3b50544b80ac8f470bd4c9f597ec9813feffa","size":140562,"data":"","first_seen":"2023-06-14T11:52:48Z","last_seen":"2026-08-16T17:16:58.154276Z","times_seen":5762,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/bootstrap/js/home.js","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"16c93ef01acd14ec64c07020d638253e","sha1":"9c7b9d1a61977675c7f128bf2e27093d3cfe37f6","sha256":"f0795e9620ff382d585e15e40f303b394863fc5fa3dbdecd140adcbc4e51ffd2","sha512":"218d41ff60e128ff13105f9d376cfac1b80401527884da7b6179bab1fe8e9aa9e5959873bc5385798c8a5c6fb7aedce8e68b17112833cc16c096e0dc214d35ea","ssdeep":"96:6P7fgtAVMsSMCM1vUrp8KtQJQ1l/2o3RV0uRC6v6qyS+KQkIF:6P7fg+VSVAvUr2KaG1Zd3YuRriqyDKQH","tlshash":"91c1551a62b42433447775bb97af57c477212087b8c6ec393dfcc6080f845aa59f1aea","size":5802,"data":"","first_seen":"2025-10-09T23:37:04.756251Z","last_seen":"2026-08-16T15:19:53.695974Z","times_seen":1435,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/e/dongpo/tz/tj.js","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"1bf60b5cf9c764caf9e85228dc7bfc33","sha1":"22b0d1971d7ec1ec3bb55ff4771752db18eab9ef","sha256":"1a32c475f692c3c84f550cc194a92fff3df6368293bbec3b8e67a42bc2d92306","sha512":"681c26eab518649736ea2c6302120b5a61e0b0749375c8933c7c890b6195de0c6e09a4184c9af8c5fd0f5e5eeda63ba803574bee4c44737899ccd18ce14c97c9","ssdeep":"","tlshash":"8601f11f7c25e13463921c2d23bbdadcf5ad2016101dc80654dec4ad6c34ff9042ab4c","size":808,"data":"","first_seen":"2026-03-03T01:17:34.078046Z","last_seen":"2026-08-16T15:19:53.693234Z","times_seen":949,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e534a5cbd2df3aaed4e2bb405780d2a7","sha1":"bd4ac483c7629ef832aaa724291e5f3c97013e14","sha256":"4df2c5608d78458b37f68c0612223902a6b6ea8d31ff8124ed0eff7589fc03be","sha512":"4a5e434560cf6e8e9c071dd0cc5e8c2442dafdfbcba638c0c7e90bdc5a74deee42bbd2a2a1b7452addb1a807443c6c4db4eb30e1cb2629ebe39320e9c7d36662","ssdeep":"","tlshash":"d4f0dcae9c51e178abc338ac9bafda88c16e1026110ecc03a9d9c5ce3c38fc8042134c","size":492,"data":"","first_seen":"2025-05-26T01:34:30.601443Z","last_seen":"2026-08-16T15:19:53.709894Z","times_seen":456,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"156.244.169.211:44141/static/js/link.js","fqdn":"156.244.169.211","domain":"156.244.169.211","tld":""},"ip":{"addr":"156.244.169.211","port":44141,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"6db1674f82a27cc00248d6e9dea55611","sha1":"36bfd3bd55b741b257f091480bb07f82a26791a3","sha256":"0ece0f9bc8449cf4def9b243d291b7d7785a0cab33b2b90b8136d1c11660805d","sha512":"fe267c7f554b320aa550e2721bb3a84fb2541cdec3af7f12c4f5dad8f6fb1be67a9103819b5a13542042125c19eb3a5e4221013c5863a5209c73e835c8af3530","ssdeep":"","tlshash":"65318e5cead038220d270967695b2d14b653400bbd4aed43f69d4ac0dfb172e4b7a9e4","size":1743,"data":"","first_seen":"2026-08-16T06:18:22.98184Z","last_seen":"2026-08-16T15:19:53.704588Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"m.loss-dafa.com/e/dongpo/tz/tj.js","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:40.949Z","timestamp":1786893520949,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /e/dongpo/tz/tj.js HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 808\r\nlast-modified: Fri, 20 Feb 2026 16:18:53 GMT\r\netag: \"6998896d-328\"\r\nexpires: Mon, 17 Aug 2026 03:18:41 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":1327,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (554)","md5":"1bf60b5cf9c764caf9e85228dc7bfc33","sha1":"22b0d1971d7ec1ec3bb55ff4771752db18eab9ef","sha256":"1a32c475f692c3c84f550cc194a92fff3df6368293bbec3b8e67a42bc2d92306","sha512":"681c26eab518649736ea2c6302120b5a61e0b0749375c8933c7c890b6195de0c6e09a4184c9af8c5fd0f5e5eeda63ba803574bee4c44737899ccd18ce14c97c9","ssdeep":"","tlshash":"8601f11f7c25e13463921c2d23bbdadcf5ad2016101dc80654dec4ad6c34ff9042ab4c","first_seen":"2026-03-03T01:17:34.078046Z","last_seen":"2026-08-16T15:19:53.693234Z","times_seen":949,"resource_available":true,"data":null}},"time_used":867,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":645,"receive":222,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/cover/mlossdafacom/departments4-47.webp","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:40.963Z","timestamp":1786893520963,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/cover/mlossdafacom/departments4-47.webp HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 118106\r\nlast-modified: Fri, 30 Jan 2026 14:13:54 GMT\r\netag: \"697cbca2-1cd5a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":118106,"size_decoded":118548,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 821x547, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d6e119c23f06b9dadba7a6ff21a0d755","sha1":"ad0f13c1ab2a87eb8950fb37941892c13185d3ff","sha256":"95d89b1245649dfa4985bf04eb670f8ee3f4b9fc07c138f7dbda0940f19ad0de","sha512":"c3d83c0ceb75a704aab483323026fe4ea2d9c061583a2c0e3b729aa6367a9debcdbcdfab2bcbf7989116832ee07dce0ac2acc8fdd1f95569ddf7349fadeb6ac3","ssdeep":"3072:4hz58hWbgG43W57lnkr0upujL4nxDTwFvFf5ebTc1Y62OScHB9xc8TT:Gz58qkW5hkYupskxDTwPkm2OBc8TT","tlshash":"f1b312d87b79248138d519ea354cc508b2c6dfec66fe8313ef89ac67e7958c090076da","first_seen":"2026-08-16T15:19:22.770873Z","last_seen":"2026-08-16T15:19:53.705232Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1522,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":632,"receive":890,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/cover/mlossdafacom/departments5-47.webp","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:40.964Z","timestamp":1786893520964,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/cover/mlossdafacom/departments5-47.webp HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 142714\r\nlast-modified: Fri, 30 Jan 2026 14:13:55 GMT\r\netag: \"697cbca3-22d7a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":142714,"size_decoded":143156,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 811x540, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a6cf13e3930ead49950d2496ee4091e6","sha1":"ad99a2aa534c5f8915c0296b273d993ef74cd9eb","sha256":"8f82e5a97b782dbfc459913513371e176b81a5659166c103410f15765e347692","sha512":"733250efd34e201d3845eca4036af298fc72cb62b4e7a3a2298c1b5be7c990275256fb9f06f6efa86a1411a70caef00e38e2ff0ac60a4a655448325e4fee3666","ssdeep":"3072:XmcAAeIqs38izcJ9GsjvOjQedJB+ilLMU1IyZlfBHvQykd0j61Y:25ID38iz0KTdJpJMRIlOykdzm","tlshash":"33d31292e5314fe3e637dea851fdde1082eb406e976194be71ad30728ef91013ad86c0","first_seen":"2026-08-16T15:19:22.774868Z","last_seen":"2026-08-16T15:19:53.687024Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1523,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":631,"receive":892,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/cover/mlossdafacom/footer-47.webp","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:41.620Z","timestamp":1786893521620,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/cover/mlossdafacom/footer-47.webp HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 66040\r\nlast-modified: Fri, 30 Jan 2026 14:13:55 GMT\r\netag: \"697cbca3-101f8\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":66040,"size_decoded":66481,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 635x423, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"3a28c11bdd4de68c4181acc613d19ef5","sha1":"5e68a754fe0f6ab5f1d4c6fcc31262c501063439","sha256":"16b5833db876b9d2e4fd346a46f84a701bcecc959f0825dcbdb46e86f3666e53","sha512":"6f390a4b9063bedb7a11f7f11e9a581513596357a3d3bb95b3b859de89cc2c8bd8511c30d3af2b7561092b95a2996c21d6ee6f5ed4262c2a31c69c2b41279635","ssdeep":"1536:5rC6AvIwu/Zy3ql7b5AVPMTvX7JSidb2y9R9:5OhUZy3yAVPMnJSc2yd","tlshash":"1b5312b55291bfd1d9894128ded2451b2b6bb1ce4fff8dbcc2de90370b16a40ca161c2","first_seen":"2026-08-16T15:19:22.779534Z","last_seen":"2026-08-16T15:19:53.693925Z","times_seen":2,"resource_available":false,"data":null}},"time_used":645,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":641,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"156.244.169.211:44141/static/picture/365pc.png","fqdn":"156.244.169.211","domain":"156.244.169.211","tld":""},"ip":{"addr":"156.244.169.211","port":44141,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://156.244.169.211:44141/","date":"2026-08-16T15:18:42.492Z","timestamp":1786893522492,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 15 Aug 2026 04:15:57 GMT","end":"Fri, 21 Aug 2026 20:15:56 GMT"},"fingerprint":{"sha1":"90:1A:05:5B:0B:FC:C9:07:AE:7E:14:04:9C:CB:99:50:3D:58:F2:24","sha256":"83:13:28:D3:16:27:24:E3:86:58:F4:04:4B:77:1D:0C:31:FA:C7:C0:60:ED:F1:15:6D:95:66:76:EA:5C:29:9C"}}},"request":{"raw":"GET /static/picture/365pc.png HTTP/1.1\r\nHost: 156.244.169.211:44141\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://156.244.169.211:44141/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:42 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Feb 2026 09:51:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699d74b1-2255\"\r\nexpires: Tue, 15 Sep 2026 15:18:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8789,"size_decoded":9164,"mime_type":"image/png","magic":"PNG image data, 189 x 44, 8-bit/color RGBA, non-interlaced","md5":"e0c9d379cd4926e815abd7d25c32f5e4","sha1":"e9a1fb55262d96495f14da278c7242cc3fda956b","sha256":"7b50586f667edbeb0c3d573a44d40742354c385a2d7ae1971aa4b0173c11173d","sha512":"519aaeff0baab73e269e86413df78c8563728cb4b1f17e448877c4853a726df366f201b9e869078a4fa460517530a84b5ae9da4290511aeb4d0b93aecb9ac99c","ssdeep":"192:6ZTS99EegUNgEBTJ35PgUUxiKlqSvxV5mG5pqghmCoTHV0:2YzgogEr35Y7cK1YGmAMT+","tlshash":"1e02a0bc5a62079b3d1aa9f8172c54f1fdd070eb411f7c99947d201b0c68a1c83af4a3","first_seen":"2025-01-31T12:39:53.02929Z","last_seen":"2026-08-16T15:19:53.707137Z","times_seen":1046,"resource_available":false,"data":null}},"time_used":411,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":411,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"156.244.169.211:44141/static/picture/xpjpc.png","fqdn":"156.244.169.211","domain":"156.244.169.211","tld":""},"ip":{"addr":"156.244.169.211","port":44141,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://156.244.169.211:44141/","date":"2026-08-16T15:18:42.494Z","timestamp":1786893522494,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 15 Aug 2026 04:15:57 GMT","end":"Fri, 21 Aug 2026 20:15:56 GMT"},"fingerprint":{"sha1":"90:1A:05:5B:0B:FC:C9:07:AE:7E:14:04:9C:CB:99:50:3D:58:F2:24","sha256":"83:13:28:D3:16:27:24:E3:86:58:F4:04:4B:77:1D:0C:31:FA:C7:C0:60:ED:F1:15:6D:95:66:76:EA:5C:29:9C"}}},"request":{"raw":"GET /static/picture/xpjpc.png HTTP/1.1\r\nHost: 156.244.169.211:44141\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://156.244.169.211:44141/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:42 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Feb 2026 09:51:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699d74b1-5800\"\r\nexpires: Tue, 15 Sep 2026 15:18:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22528,"size_decoded":22646,"mime_type":"image/png","magic":"PNG image data, 183 x 55, 8-bit/color RGBA, non-interlaced","md5":"c53d923594566be7e0e41e8d720c0ac0","sha1":"e16a4b701d10291bbff90178e8b0d5f576e00821","sha256":"021994557d1d9642fdc16a0d8f6e471bec81bea7f366de6ef631f536c165418b","sha512":"554f7d6d44d26905610a65e21bd157ec30fef501c356e97787deca22f9089216f59e284f0effab7b18da89134af594d4ffd5eed889b1b5a4d5a5412456b9832e","ssdeep":"384:QfchEzlZmrXTjUDkJe2tERBxq2ceTdr1lFJ3d2Oo+UQSYJshjRHXvcQ:QfchEzrmrXTjUhP42cKpFJ3lo+UHYa//","tlshash":"fba2e0f1f36ff1b54a924d554cf8e2b080978942e088ee6135cb204acade8d31d993e7","first_seen":"2023-05-07T20:04:35Z","last_seen":"2026-08-16T15:19:53.676931Z","times_seen":1185,"resource_available":false,"data":null}},"time_used":544,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":544,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:41.858Z","timestamp":1786893521858,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /js-sdk-pro.min.js HTTP/1.1\r\nHost: sdk.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T19:35:55.306911Z","times_seen":17923256,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"156.244.169.211:44141/static/js/link.js","fqdn":"156.244.169.211","domain":"156.244.169.211","tld":""},"ip":{"addr":"156.244.169.211","port":44141,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://156.244.169.211:44141/","date":"2026-08-16T15:18:42.481Z","timestamp":1786893522481,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 15 Aug 2026 04:15:57 GMT","end":"Fri, 21 Aug 2026 20:15:56 GMT"},"fingerprint":{"sha1":"90:1A:05:5B:0B:FC:C9:07:AE:7E:14:04:9C:CB:99:50:3D:58:F2:24","sha256":"83:13:28:D3:16:27:24:E3:86:58:F4:04:4B:77:1D:0C:31:FA:C7:C0:60:ED:F1:15:6D:95:66:76:EA:5C:29:9C"}}},"request":{"raw":"GET /static/js/link.js HTTP/1.1\r\nHost: 156.244.169.211:44141\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://156.244.169.211:44141/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:42 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 16 Aug 2026 04:10:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a813849-6cf\"\r\nexpires: Mon, 17 Aug 2026 03:18:42 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1743,"size_decoded":1003,"mime_type":"application/javascript","magic":"ASCII text","md5":"6db1674f82a27cc00248d6e9dea55611","sha1":"36bfd3bd55b741b257f091480bb07f82a26791a3","sha256":"0ece0f9bc8449cf4def9b243d291b7d7785a0cab33b2b90b8136d1c11660805d","sha512":"fe267c7f554b320aa550e2721bb3a84fb2541cdec3af7f12c4f5dad8f6fb1be67a9103819b5a13542042125c19eb3a5e4221013c5863a5209c73e835c8af3530","ssdeep":"","tlshash":"65318e5cead038220d270967695b2d14b653400bbd4aed43f69d4ac0dfb172e4b7a9e4","first_seen":"2026-08-16T06:18:22.98184Z","last_seen":"2026-08-16T15:19:53.704588Z","times_seen":5,"resource_available":true,"data":null}},"time_used":181,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":181,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"156.244.169.211:44141/static/picture/1552215839168.png","fqdn":"156.244.169.211","domain":"156.244.169.211","tld":""},"ip":{"addr":"156.244.169.211","port":44141,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://156.244.169.211:44141/","date":"2026-08-16T15:18:42.505Z","timestamp":1786893522505,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 15 Aug 2026 04:15:57 GMT","end":"Fri, 21 Aug 2026 20:15:56 GMT"},"fingerprint":{"sha1":"90:1A:05:5B:0B:FC:C9:07:AE:7E:14:04:9C:CB:99:50:3D:58:F2:24","sha256":"83:13:28:D3:16:27:24:E3:86:58:F4:04:4B:77:1D:0C:31:FA:C7:C0:60:ED:F1:15:6D:95:66:76:EA:5C:29:9C"}}},"request":{"raw":"GET /static/picture/1552215839168.png HTTP/1.1\r\nHost: 156.244.169.211:44141\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://156.244.169.211:44141/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:42 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Feb 2026 09:51:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699d74b1-2a6b0\"\r\nexpires: Tue, 15 Sep 2026 15:18:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":173744,"size_decoded":174162,"mime_type":"image/png","magic":"PNG image data, 488 x 147, 8-bit/color RGBA, non-interlaced","md5":"ce2e5b88612ff5d0c083357995805cb1","sha1":"ee211057d855fb16fcbbc4dd280c54d0e8be9445","sha256":"8d2484ecd64a9270ab446bebd54998c84015ccac62e322332ff027218cc11c54","sha512":"5c3a7cc91ed1cc8f9064538fd154dd31addf4705eea3767bd444c06cc64dfedc9bdccee584936bd2b6a4f142820d0bdd74213497247a59759e89d79fa5bfd896","ssdeep":"3072:7jOt+RYVDFMiydCbjFViIj2qBEn0uzBdtt/jU4SyaguPpoQE3TqtGMFR++gcKiYF:fOARYVFMiyyhViycrTLw4vagkpoQE3T/","tlshash":"c204124c9c4413f186c9f265e2068884e57fc915427c342b37c9e3fb4da6a4927baf32","first_seen":"2023-09-28T01:03:26Z","last_seen":"2026-08-16T15:19:53.703945Z","times_seen":991,"resource_available":false,"data":null}},"time_used":536,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":536,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/ico/favicon47.ico","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:42.604Z","timestamp":1786893522604,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/ico/favicon47.ico HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:42 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 16958\r\nlast-modified: Wed, 09 Jul 2025 03:42:24 GMT\r\netag: \"686de520-423e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16958,"size_decoded":17400,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel","md5":"125b1af4f5a956977eec7fafe1cc85df","sha1":"e28897448a81f16dfd8499cdcebd1e4e14cb2078","sha256":"eb47f0337028c7ed2c948ecb6c1c59d1701368ca1fd198252e86eb631db0f814","sha512":"d7a4a0fa5d205af882fe02ad2cb49af7d494555167f1f3fd8051b2c89b42666600c3da2a0f9e30676a0d6d3c6d1a6ae2c86a2c8a2a3b85ca1204b332ba0994b4","ssdeep":"384:hjrHnobDezsPuByoXmBGvtUSumCk1CU4IfYfSJXhs:lIezsWIoXfumeI4WXhs","tlshash":"c07263cef604afd0ceb7ae35b505c3b60b581695b9628052bcf46a9f36079704d0a7f4","first_seen":"2026-04-28T12:00:56.278625Z","last_seen":"2026-08-16T15:19:53.692559Z","times_seen":7,"resource_available":false,"data":null}},"time_used":223,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":223,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/swiper/css/swiper-bundle.min.css","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:40.927Z","timestamp":1786893520927,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/swiper/css/swiper-bundle.min.css HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 08 Jul 2025 08:36:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"686cd89a-4691\"\r\nexpires: Mon, 17 Aug 2026 03:18:41 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18065,"size_decoded":5358,"mime_type":"text/css","magic":"ASCII text, with very long lines (17812)","md5":"ea28ae0aaf82709381c57d6a7daa7a05","sha1":"a7c528dc9018aeefed9a52337168decb220e2f61","sha256":"af8545de3876815292506711e1369bff9dfe57ec7e04c45c3e1bdac48a11f3b2","sha512":"9c63402a957e06b7c365a6cf5f53baaba991953e7bfda99d8feeaf177db6a2782a28004b1d82df2dcde362d5556e4891f6da300d63cf13d816144dadb1920f66","ssdeep":"192:1VmUJbiKne0JlXZHZ+Sme+jexS4nxep/a2GZb0Q5nfufKlAYfg5fyeesedOJ9A5Q:1gUbe0JdZHZ+W+SFnZ24tlWfF4XYz","tlshash":"d08245a85340282753274f364b71cbb9dd7444d20f9389ae91c0ee48d7f6db9132f6a9","first_seen":"2023-06-14T11:52:48Z","last_seen":"2026-08-16T17:46:51.209445Z","times_seen":6392,"resource_available":false,"data":null}},"time_used":446,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":446,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"156.244.169.211:44141/static/picture/jinshapc.png","fqdn":"156.244.169.211","domain":"156.244.169.211","tld":""},"ip":{"addr":"156.244.169.211","port":44141,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://156.244.169.211:44141/","date":"2026-08-16T15:18:42.487Z","timestamp":1786893522487,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 15 Aug 2026 04:15:57 GMT","end":"Fri, 21 Aug 2026 20:15:56 GMT"},"fingerprint":{"sha1":"90:1A:05:5B:0B:FC:C9:07:AE:7E:14:04:9C:CB:99:50:3D:58:F2:24","sha256":"83:13:28:D3:16:27:24:E3:86:58:F4:04:4B:77:1D:0C:31:FA:C7:C0:60:ED:F1:15:6D:95:66:76:EA:5C:29:9C"}}},"request":{"raw":"GET /static/picture/jinshapc.png HTTP/1.1\r\nHost: 156.244.169.211:44141\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://156.244.169.211:44141/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:42 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Feb 2026 09:51:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699d74b1-a334\"\r\nexpires: Tue, 15 Sep 2026 15:18:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41780,"size_decoded":42160,"mime_type":"image/png","magic":"PNG image data, 295 x 113, 8-bit/color RGBA, non-interlaced","md5":"1d2140363e0fda69f41537010f37ac74","sha1":"9f3791b6ade0a7966dee0253cb698564490e9440","sha256":"65ff8549228320f54f3d93e45194314c43c7cea541241876a57633bb5ac94f92","sha512":"75dd491fe42a57dee94c06e5e389323f0b32a584f3d0223845ea8f945ac9cff401e65cc381f4e8973dd78c14655abfff000186a770df78acddff35e6bb69fa86","ssdeep":"768:fUD/+JUtuV8Sp+uA5mBhYhXXy7I1VzKT26hq34ZhMNg1de0nGtXIIq5y7RYLIXK9:j2SYd1Xy7wVG66BvMNg60KXrsLB","tlshash":"3113f1a116d7074d278849fcda334deec406ab285d19b93ec5f68f34e3846c4d083a66","first_seen":"2025-01-31T12:39:53.036928Z","last_seen":"2026-08-16T15:19:53.696988Z","times_seen":1045,"resource_available":false,"data":null}},"time_used":184,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":184,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/cover/mlossdafacom/departments2-47.webp","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:40.959Z","timestamp":1786893520959,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/cover/mlossdafacom/departments2-47.webp HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 91922\r\nlast-modified: Fri, 30 Jan 2026 14:13:54 GMT\r\netag: \"697cbca2-16712\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":91922,"size_decoded":92363,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 806x537, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5b916c9ea8be244a601780bec7e45ee8","sha1":"867044cd7b66dbdf082f3996013798e2fc2cd311","sha256":"043dbc1de04a4e1b409aedee1102897ceb022ba9d3fe0bd1789ce9202048c881","sha512":"b1078d76d86a2e74aaf8694c825b995e9e4421fc5936235366ad9c54bcbece8a32fceb56c68cf39f6b120985769ce4ecdaaf7bae7e1d4d82e83b7f50a313a5c3","ssdeep":"1536:uHvm1Vd3GKAPrTXS45DzoeJnxm2Z1YPb8KEewUoNpBeCu9S7H70HgMbTpp:Ue3FAPrTXF5DzfJnxPZ1YPAKnYHed9iu","tlshash":"5c9312df5496fdf54526836402fcacbf617e8fe00ca9ed40a6d21c625c4290ff9c66a8","first_seen":"2026-08-16T15:19:22.80903Z","last_seen":"2026-08-16T15:19:53.699149Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1524,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":635,"receive":889,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/cover/mlossdafacom/app1-47.webp","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:40.965Z","timestamp":1786893520965,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/cover/mlossdafacom/app1-47.webp HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 221466\r\nlast-modified: Fri, 30 Jan 2026 14:13:55 GMT\r\netag: \"697cbca3-3611a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":221466,"size_decoded":221908,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 818x613, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"69cbe07f16ef90c80a66887ac9e566a1","sha1":"e1ec10571e43d9d01ebe2248d1df461b0ea1b292","sha256":"0bcd8bc0aacefd5423ff01452f9ac83765d1f9936a2fae00fca4432af451a618","sha512":"54a4980f40fa22f90cc3da5a9a322f816654656693bcec571814c79236b09709b72827e12e546119bc053a3a586938a074859b8d9663f9a168c9cf64b891ac42","ssdeep":"6144:OgS7havEL852PeuHazgaMFoXje/d9Nt38kbPxEnU+:O/UvweqakaMFkjadx5bJoU+","tlshash":"18242347134603cbb052649c9c2e1b9bc3e6b7eaee871541d3788fc25dba198c85d3e6","first_seen":"2026-08-16T15:19:22.811979Z","last_seen":"2026-08-16T15:19:53.683186Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1523,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":630,"receive":893,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/cover/mlossdafacom/app3-47.webp","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:40.967Z","timestamp":1786893520967,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/cover/mlossdafacom/app3-47.webp HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 92216\r\nlast-modified: Fri, 30 Jan 2026 14:13:55 GMT\r\netag: \"697cbca3-16838\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":92216,"size_decoded":92657,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 798x569, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"949a487a164403074151fa6565232fe2","sha1":"e6a153516bdaed6c40d60a7f8f312b65c16540d7","sha256":"45e7ef09bbed6d98e52b4f6cbec5a7aede0bddb8e52576879e16384369870b51","sha512":"d62a3fa94a229541b6524bbc19f4114c39dff136e06269385e8b48235faac902269dffd8fd73a61967b3fe96aa2722d89b53ac01380adc159b189fda78646f28","ssdeep":"1536:W7LFQUQUtnzF0AVn6sSeNQaJjCcnhTYFiJBS8cFj3TIpuMb9XHehxLF8b+qZ6epf:CFQwzKa6JKdRcxIphb9X+yfZ6eRbetJi","tlshash":"d99312de753520877b4ea54fe783851de300ed81308cc06ec5b252bd41eafaad6e6722","first_seen":"2026-08-16T15:19:22.814596Z","last_seen":"2026-08-16T15:19:53.690245Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1521,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":629,"receive":892,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/fontawesome/webfonts/fa-solid-900.woff2","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:41.656Z","timestamp":1786893521656,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/fontawesome/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/skin/fontawesome/css/all.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 158220\r\nlast-modified: Fri, 13 Dec 2024 08:50:06 GMT\r\netag: \"675bf53e-26a0c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":158220,"size_decoded":158662,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 158220, version 775.1280","md5":"4a6591ab5460ae5cbff1ecbd6e52193a","sha1":"7cd8afd6501962fda35d66f0e4c3b8815ac471d8","sha256":"aa75998623a391e61c6901794ace832e3ecdd288b56d608f21bea0411acc0b8e","sha512":"96c5d3283b71613b595b6b0420333bef5d64451af05c59dde27ec5b3e7cfe6e9549c604cddfbcb79cbc0fd4cd6f2e22a130c9a220b1b7ef933ac9df8c8e695d6","ssdeep":"3072:RauSB5FANIRLpsBaBrJGNG3ECNQztRvHHqkqLrlF:guSqN6ptrJGo3POh9KT9F","tlshash":"0ef312a710c6b95684a3a51b336adeb52c3ed363fcb6cd73be340114689da9c2e4d190","first_seen":"2024-12-19T10:41:23.153533Z","last_seen":"2026-08-16T18:27:32.830383Z","times_seen":33786,"resource_available":false,"data":null}},"time_used":830,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":606,"receive":224,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"156.244.169.211:44141/","fqdn":"156.244.169.211","domain":"156.244.169.211","tld":""},"ip":{"addr":"156.244.169.211","port":44141,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:41.670Z","timestamp":1786893521670,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 15 Aug 2026 04:15:57 GMT","end":"Fri, 21 Aug 2026 20:15:56 GMT"},"fingerprint":{"sha1":"90:1A:05:5B:0B:FC:C9:07:AE:7E:14:04:9C:CB:99:50:3D:58:F2:24","sha256":"83:13:28:D3:16:27:24:E3:86:58:F4:04:4B:77:1D:0C:31:FA:C7:C0:60:ED:F1:15:6D:95:66:76:EA:5C:29:9C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 156.244.169.211:44141\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:42 GMT\r\ncontent-type: text/html\r\nlast-modified: Mon, 10 Aug 2026 02:34:11 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a7938a3-2022\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8226,"size_decoded":2882,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"37e7d1f52c08e5cba53549061a088fc5","sha1":"28c3261f8d0f8046ea8bfbcc0ad0e27c80b4dd5f","sha256":"16fe2998b51bd69b9259cb4d1045e4053b99d36368c45efc805240deebc66f0b","sha512":"e64d59f26fc94e14d5b925894cfcdeace55b2bdc48a749ef9b1a7043df551479d55529bf533bc94d68d5f5f071d501c5cfef7fa3eb13fdde26bdcfeb5f3cc85e","ssdeep":"192:irnMZjBPCpnDZ0CPBfE/k1mp6rPlyJzmRF4sArt+:ljmX7Art+","tlshash":"d602761661d3115b292291a66fb3171b6664d407c20bc9a97fcc15cdef89ac9c8a738c","first_seen":"2026-03-01T01:18:02.551716Z","last_seen":"2026-08-16T15:19:53.702593Z","times_seen":588,"resource_available":true,"data":null}},"time_used":731,"timings":{"blocked":0,"dns":0,"connect":180,"send":0,"wait":181,"receive":0,"ssl":369},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"156.244.169.211:44141/static/picture/wnspc.png","fqdn":"156.244.169.211","domain":"156.244.169.211","tld":""},"ip":{"addr":"156.244.169.211","port":44141,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://156.244.169.211:44141/","date":"2026-08-16T15:18:42.497Z","timestamp":1786893522497,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 15 Aug 2026 04:15:57 GMT","end":"Fri, 21 Aug 2026 20:15:56 GMT"},"fingerprint":{"sha1":"90:1A:05:5B:0B:FC:C9:07:AE:7E:14:04:9C:CB:99:50:3D:58:F2:24","sha256":"83:13:28:D3:16:27:24:E3:86:58:F4:04:4B:77:1D:0C:31:FA:C7:C0:60:ED:F1:15:6D:95:66:76:EA:5C:29:9C"}}},"request":{"raw":"GET /static/picture/wnspc.png HTTP/1.1\r\nHost: 156.244.169.211:44141\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://156.244.169.211:44141/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:42 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Feb 2026 09:51:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699d74b1-1eb7\"\r\nexpires: Tue, 15 Sep 2026 15:18:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7863,"size_decoded":8238,"mime_type":"image/png","magic":"PNG image data, 172 x 60, 8-bit/color RGBA, non-interlaced","md5":"6e6f3e6c749737e6c347ec25d39b3eb1","sha1":"076c805bf394c7996a58202e333827837c8b1378","sha256":"391138ddf53bc321563b3d17fe0f37f5b40efba65fc661dbfa239a2b2184ec65","sha512":"b4621a8e30b49a48b1b13e9582c260b02d42ab2cc2509d59e56cf85028eec3dd165e255dff5c61e689ad8b4eaabe74852185efb2764da5c0ec1133a2ccb02a3d","ssdeep":"192:FQSFq7yL2y34yuuSzYUfBY2kCf9pDnA3+O07Zu86U9S0aN:zFjLX3u1YU5sCzA3hEu86sSLN","tlshash":"26f1ae6b1553fcb469dda7e92063af6082136f48b0077a12fb2b29748135fe5f44aa13","first_seen":"2023-09-28T01:03:26Z","last_seen":"2026-08-16T15:19:53.703277Z","times_seen":1069,"resource_available":false,"data":null}},"time_used":543,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":543,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-16T15:18:39.345Z","timestamp":1786893519345,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:40 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19530,"size_decoded":6297,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (14931), with no line terminators","md5":"3479965e2f8367a94c72bd6d9212a49e","sha1":"0e985a6c8d937db3b41fa795d6f4cd634c3ff1a6","sha256":"e11cdec805656bf4fa2f7955be300c0eafa2a6b4b486f4c86b3a05fde2fe1df5","sha512":"c1af1918dbc972e690efeac0082a02dd05b4d8f0a63a84a7ced27e0879ce9c88f14b438ca1cdff416dd4a8f5769131369a332279f15f96244dbc63a69e6a5ca8","ssdeep":"192:0zjzt/OyzwWueeavlKTxl76QbVb2xyLQZ+3YUzuJ58D75xMFuHqZzCrTl:0v9j8Wue8fsUqL8DHMkKZu3l","tlshash":"d482a63670443aab0777d9ecba18a34ee1d3920dc5f7d846baf947c43bc5c968c6025a","first_seen":"2026-08-16T15:19:22.821314Z","last_seen":"2026-08-16T15:19:53.700317Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1298,"timings":{"blocked":-1,"dns":374,"connect":222,"send":0,"wait":254,"receive":0,"ssl":448},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/bootstrap/css/module.css","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:40.925Z","timestamp":1786893520925,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/bootstrap/css/module.css HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 24 Jul 2025 20:07:14 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68829272-28112\"\r\nexpires: Mon, 17 Aug 2026 03:18:41 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":164114,"size_decoded":32530,"mime_type":"text/css","magic":"ASCII text, with very long lines (65518)","md5":"67e45932bedd92dd7bc2a7de1653677e","sha1":"b15f3b2e370d9a7c2c40ea991c8f4a839617702d","sha256":"6e25cdc64273a412026df8a7b3510d9ba7dd6cd75653dd3eb884371b4ace73e8","sha512":"d6130c594f82eefca5109421095dc8c0603b44c4c714bdb8956e64278c9c1625263a531a1ad401fa344f180c2f1cbe95af8246c9e33dc6a28316ab243f448591","ssdeep":"1536:qiVj2AhHm0CfrtrPr7AhhTQbdS6U8H2GXVxICl1gGqotJFFp4L/Xzbv9ALVTFCew:sAhhTQg6U8p45s5Q","tlshash":"c6f397309984202cf11bc5eae5d0abef32649801f663077ef66370a6d6c21ef577674a","first_seen":"2025-10-09T23:37:04.753197Z","last_seen":"2026-08-16T15:19:53.708406Z","times_seen":1409,"resource_available":false,"data":null}},"time_used":447,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":447,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/fontawesome/css/all.min.css","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:40.938Z","timestamp":1786893520938,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/fontawesome/css/all.min.css HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 01 Jul 2025 22:17:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68645e64-1907e\"\r\nexpires: Mon, 17 Aug 2026 03:18:41 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":102526,"size_decoded":23308,"mime_type":"text/css","magic":"ASCII text, with very long lines (52276)","md5":"c43cd173eeeba2f72aa6b431d06b8c07","sha1":"427a692f7f39eabb3d5b8510aee2743025daf813","sha256":"c880eb3d25c765d399840aa204fec22b3230310991089f14781f09a35ed80b8a","sha512":"02f6f6422b83104bc1e1b64961d7edda63635528417ed2dd3c6f0527457b8ab4cb43c528d2a70fc61e0f96aec6e6d1a6d2b53ed523e1568b6d78ba41111c1393","ssdeep":"1536:vwMCMPMCMjMCM4MCMwMCM3sVMX709gbPMfjSFOTyPG9ZpgmLCq:P709gMGFiyPG9ZimLCq","tlshash":"4fa3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2024-01-04T18:36:36Z","last_seen":"2026-08-16T18:36:02.200869Z","times_seen":14715,"resource_available":false,"data":null}},"time_used":656,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":656,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/e/dongpo/tz/tz.js","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:40.942Z","timestamp":1786893520942,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /e/dongpo/tz/tz.js HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 10 Aug 2026 02:43:33 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a793ad5-488\"\r\nexpires: Mon, 17 Aug 2026 03:18:41 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1160,"size_decoded":1020,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"cdd51774e8d302e07682e09384b53740","sha1":"a852f9f4dd23af5da2990398fa3c68e8c49ff3ab","sha256":"3bb758e6d57d175c9e965cda74d02359b8816fc8d64254213b4ad5085b8d98b8","sha512":"b10a9f2c24f49203d0a6e07415ad0eb597ec15a46ced2d2c47c868ffddf5fec36f383da050a2397641791fff604f798ee65e6a974f216126eeaafb8d49da5b00","ssdeep":"","tlshash":"23218c7fae231250e01691592bba676c3a3a001b6301cc307abcbe685f42f429447bd4","first_seen":"2026-08-10T04:17:50.869663Z","last_seen":"2026-08-16T15:19:53.685336Z","times_seen":14,"resource_available":true,"data":null}},"time_used":652,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":652,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/cover/mlossdafacom/hero-47.webp","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:40.957Z","timestamp":1786893520957,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/cover/mlossdafacom/hero-47.webp HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 110850\r\nlast-modified: Fri, 30 Jan 2026 14:13:54 GMT\r\netag: \"697cbca2-1b102\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":110850,"size_decoded":111292,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 825x550, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"3a4279e294e8d5f7a1c0b6446c3fd55a","sha1":"9027d73e0ea4e96cbd7aaea1a6160a502ea8e956","sha256":"09eeeb6654714c6c7ba99038fbff90eb72f65ac5d98967398e9aeb6e11f891cd","sha512":"e71225e75d158bce3b061b08fdf9887f1580c4f2676e1d1598c7a192cad212ab56db1291399cd86f9b1d30e5430b88ca69c39141cb879c40e397bdc623ab8d7f","ssdeep":"1536:Bh80u396naqRpBnu3TG4uENZ43ze6iGIq9iscILBOUJa75E1HhLtvhlg:By0uN6nfni3uK0vitBIBpJa0XZC","tlshash":"d0b312fe83135bbd1ebe6bbffe019cb08a2e009ed1f304459706cd162695a99c521f91","first_seen":"2026-08-16T15:19:22.8265Z","last_seen":"2026-08-16T15:19:53.680596Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1308,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":637,"receive":671,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/cover/mlossdafacom/departments1-47.webp","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:40.958Z","timestamp":1786893520958,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/cover/mlossdafacom/departments1-47.webp HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 152712\r\nlast-modified: Fri, 30 Jan 2026 14:13:54 GMT\r\netag: \"697cbca2-25488\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":152712,"size_decoded":153154,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 823x548, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7c798258a398a9b5941b2c42647e9459","sha1":"1ebd036153b0fa3255bbe10e17d83790bdbd4834","sha256":"4db459f625ef1ed234f7bd057e27a138aacf91aa6e0b52fde97e20c8df221c2b","sha512":"d627f19ed4de5e04cc8eefae1cd47e646c054524547311fe8f7bc1402f3faf59c07f12ea2fdf17acb5595e4a321747d5d2e594137f6b24ecf54a5b96d9a165c6","ssdeep":"3072:3B95WBBicI5uak6ldm7zA0naJydYdeVRimwXzBwkkdIw6mSg0E5eG:3BeBAcITk6ADn7dns/X1fDmohG","tlshash":"60e312903f1157e0c1b420e4f15f97176f9226f22b5a5e637c65290dce0dab1d687ca8","first_seen":"2026-08-16T15:19:22.828772Z","last_seen":"2026-08-16T15:19:53.697656Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1529,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":636,"receive":893,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"156.244.169.211:44141/static/picture/dfpc.png","fqdn":"156.244.169.211","domain":"156.244.169.211","tld":""},"ip":{"addr":"156.244.169.211","port":44141,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://156.244.169.211:44141/","date":"2026-08-16T15:18:42.504Z","timestamp":1786893522504,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 15 Aug 2026 04:15:57 GMT","end":"Fri, 21 Aug 2026 20:15:56 GMT"},"fingerprint":{"sha1":"90:1A:05:5B:0B:FC:C9:07:AE:7E:14:04:9C:CB:99:50:3D:58:F2:24","sha256":"83:13:28:D3:16:27:24:E3:86:58:F4:04:4B:77:1D:0C:31:FA:C7:C0:60:ED:F1:15:6D:95:66:76:EA:5C:29:9C"}}},"request":{"raw":"GET /static/picture/dfpc.png HTTP/1.1\r\nHost: 156.244.169.211:44141\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://156.244.169.211:44141/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:42 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Feb 2026 11:38:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699d8daa-1c49\"\r\nexpires: Tue, 15 Sep 2026 15:18:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7241,"size_decoded":7616,"mime_type":"image/png","magic":"PNG image data, 200 x 50, 8-bit/color RGBA, non-interlaced","md5":"9ca63936da71d994267413c9b4d62583","sha1":"0083b92ce28904d8c01cca591a852d218c944d3e","sha256":"909c9c1f9b2ee3b6ebe305b395b454cb597ae2b4ad8ec0db3a57c2e678bb685a","sha512":"2c01f6e39b4f8c4ff7d8c2d20640c9d80b50ebb49351d32c4e0263b11abbb721b6af3c4d27c308f6e26d4f9e0c5f08045c0d235b3ef1a587eaa1df578c7c333b","ssdeep":"192:FxLpy98iKPdw9eYyJIoxrBG3GFQVnpq1fw5qDQ/7os:F1pyNIq9e1Zrg3GFQVnp2YsQ/j","tlshash":"78e18e3b8e8c2754c1551385a136fab4d8791ef331f4923e9a257c22dd52ab2c921386","first_seen":"2026-03-01T01:18:02.55958Z","last_seen":"2026-08-16T15:19:53.678505Z","times_seen":693,"resource_available":false,"data":null}},"time_used":537,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":537,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/bootstrap/css/bootstrap.min.css","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:40.923Z","timestamp":1786893520923,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/bootstrap/css/bootstrap.min.css HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 01 Jul 2025 22:17:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68645e64-38a52\"\r\nexpires: Mon, 17 Aug 2026 03:18:41 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":232018,"size_decoded":32331,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65342)","md5":"50c95aae1a6c1e089c11681d1e1906f8","sha1":"a65e4fd8db9bd0440de2d6d73c9e7cd00fce4a8d","sha256":"cd1826581e4f2b80af4f1e05897b316c7698441063cffaefbbdeec382ee4cd72","sha512":"7f0edff9370c8d36fb6e96cb25994ff20d98e17702c85656f2ecbc1ec459b07fd2c1b330d2994a1c51ebf7d0cdde5d3856c60dc2fce27145ffeaababbc8c5bc7","ssdeep":"1536:v9xnXGi9GfJkfvq5wlP7cQZDR9uvV982sYRElV6V6pz600I41r:HnXp9GfrV98II6V6pz600I41r","tlshash":"d03482d6f590317d9ca7c1499681fefd896fa985cb120aa6f003776807cabd30962dcc","first_seen":"2025-06-19T07:12:41.126365Z","last_seen":"2026-08-16T15:19:53.707768Z","times_seen":2898,"resource_available":false,"data":null}},"time_used":226,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":226,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/bootstrap/js/bootstrap.bundle.min.js","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:40.943Z","timestamp":1786893520943,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/bootstrap/js/bootstrap.bundle.min.js HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 01 Jul 2025 23:41:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6864723c-13bb5\"\r\nexpires: Mon, 17 Aug 2026 03:18:41 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":80821,"size_decoded":24588,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65299)","md5":"21d4551af5cc4ed4d818bdbdfea8c358","sha1":"df272a07ed30eaf8025b699c45736ba9d284e4d4","sha256":"35f4547d9364111aca4850347356bc5660a994f0d8b694d88f995098a7b547fa","sha512":"4dcd22faf4688265f834deedb8b6d07c1c5af0991f512031485573994df59d5747ca21c494f3f2d9c59f15a7260892b0d15aa8bebcca85d7764d24cc740c69da","ssdeep":"1536:/SwJiEbnTl6R2t49CFliFCIg/yWszSraJd5qUFH9tZwcE+iYZMgZdj:6wfs+SSO5q4tZwcEVYZFj","tlshash":"2383b5593244b8730ade85b68037430bf2265998b14b812cb57cadde2a7dcc67277f78","first_seen":"2025-06-18T01:20:12.005242Z","last_seen":"2026-08-16T15:19:53.67204Z","times_seen":2890,"resource_available":true,"data":null}},"time_used":650,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":650,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/bootstrap/js/home.js","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:40.948Z","timestamp":1786893520948,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/bootstrap/js/home.js HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 14 Jul 2025 11:49:58 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6874eee6-16aa\"\r\nexpires: Mon, 17 Aug 2026 03:18:41 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5802,"size_decoded":2266,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"16c93ef01acd14ec64c07020d638253e","sha1":"9c7b9d1a61977675c7f128bf2e27093d3cfe37f6","sha256":"f0795e9620ff382d585e15e40f303b394863fc5fa3dbdecd140adcbc4e51ffd2","sha512":"218d41ff60e128ff13105f9d376cfac1b80401527884da7b6179bab1fe8e9aa9e5959873bc5385798c8a5c6fb7aedce8e68b17112833cc16c096e0dc214d35ea","ssdeep":"96:6P7fgtAVMsSMCM1vUrp8KtQJQ1l/2o3RV0uRC6v6qyS+KQkIF:6P7fg+VSVAvUr2KaG1Zd3YuRriqyDKQH","tlshash":"91c1551a62b42433447775bb97af57c477212087b8c6ec393dfcc6080f845aa59f1aea","first_seen":"2025-10-09T23:37:04.756251Z","last_seen":"2026-08-16T15:19:53.695974Z","times_seen":1435,"resource_available":true,"data":null}},"time_used":646,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":646,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/cover/mlossdafacom/departments3-47.webp","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:40.961Z","timestamp":1786893520961,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/cover/mlossdafacom/departments3-47.webp HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 130700\r\nlast-modified: Fri, 30 Jan 2026 14:13:54 GMT\r\netag: \"697cbca2-1fe8c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":130700,"size_decoded":131142,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 625x414, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d8e934d1169d0d4c91032a0f72d5b43f","sha1":"d88c28a0e2a639bb72569a3f21302fc5360a09ad","sha256":"60dd8ca14164c7fae199319eccb65f454edb67f36040e7da1db6b9aa3b43a5ac","sha512":"41450a175972526b12245307a7fd49730a639d8cd63f4ae5edd04bcb95fb1545c2d44913eb1a3f3c955bccadc241e05449d814367592cf93b65e9ca203a16a31","ssdeep":"1536:XSz6p6myjilDo1LSspkEceDYZ1B+t956Mh0qJpjLvw+vih6dH4z9mPlLMJLow8ZL:wOsjR7gaiv+2ks+WiCMlLMR+5xlQZvVg","tlshash":"e8d3128d442e70d73de8ac592b484d14506a30fc4428edbbac634b9be14f92fa55cf67","first_seen":"2026-08-16T15:19:22.83443Z","last_seen":"2026-08-16T15:19:53.701466Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1524,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":634,"receive":890,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/swiper/js/swiper-bundle.min.js","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:40.946Z","timestamp":1786893520946,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/swiper/js/swiper-bundle.min.js HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 02 Jul 2025 23:58:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6865c79e-22512\"\r\nexpires: Mon, 17 Aug 2026 03:18:41 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":140562,"size_decoded":40121,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65283)","md5":"21b78ba7133b3d67cf8b09cd6a26d386","sha1":"ea59f37b232db6dee2694078bf21e153a09bacdd","sha256":"6f9df49fe12f77b66daba876cb33b7090b2443f570a2a4b9541cddd705440aa5","sha512":"dc48bb38f168f37930ddc3db0cb78b867fd817cb5907b56cf2c7e58b407f2847a4bab78be5ea2c0deb216052020afb782bc8b4c948a5fe52b77128a27365a392","ssdeep":"1536:TIJQfGP7LP8NEuWGKF+IlzholxU/2Bkt+9SD8jv1nTHlU9ymp8Mj0HEOS5hAsVuZ:0JCN+TXD2BkQZFU9tp8Mj0k95h5cpnv","tlshash":"02d3f8896221b57646e316db93e4c221a3b50544b80ac8f470bd4c9f597ec9813feffa","first_seen":"2023-06-14T11:52:48Z","last_seen":"2026-08-16T17:16:58.154276Z","times_seen":5762,"resource_available":true,"data":null}},"time_used":648,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":648,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/logo/mlossdafacom/logo.webp","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:40.956Z","timestamp":1786893520956,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/logo/mlossdafacom/logo.webp HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3850\r\nlast-modified: Fri, 30 Jan 2026 14:13:54 GMT\r\netag: \"697cbca2-f0a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3850,"size_decoded":4288,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 400x140, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c31f765f7ef23f3db73bb21fd3cb9a0e","sha1":"0fb23d491b278242ee7f1e6bf1df91fecd94a51f","sha256":"846aba0e6a1935c03c3729371d2de3c73dc9a8ea8f8939466b87e7d5b4a23b43","sha512":"b3eae7b194cdb2def685e3c3f4a397e7efe8695cdf8ba526e3900aadee550b3445a80b6a2e5199a4343ba03a2f820b3ae0d913c1f1cecbffd5dc1059bd36758a","ssdeep":"","tlshash":"10813a2d1764c302ed5524cbe1bf36b4a2a05456983c0b4e6b29d6bb27b93169bb0232","first_seen":"2026-08-16T15:19:22.839138Z","last_seen":"2026-08-16T15:19:53.673741Z","times_seen":2,"resource_available":false,"data":null}},"time_used":860,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":638,"receive":222,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"m.loss-dafa.com/skin/cover/mlossdafacom/app2-47.webp","fqdn":"m.loss-dafa.com","domain":"loss-dafa.com","tld":"com"},"ip":{"addr":"154.89.79.88","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://m.loss-dafa.com/","date":"2026-08-16T15:18:40.966Z","timestamp":1786893520966,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"url-dafa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 07:32:12 GMT","end":"Tue, 29 Sep 2026 07:32:11 GMT"},"fingerprint":{"sha1":"79:86:9C:98:40:AA:59:4F:22:85:74:5A:1F:8E:3D:63:22:23:94:71","sha256":"E2:A0:7C:AD:F6:55:76:7A:5A:1A:1D:C9:07:E5:C0:E8:00:AD:59:A6:DE:BB:04:93:A7:C5:10:12:E7:35:AD:03"}}},"request":{"raw":"GET /skin/cover/mlossdafacom/app2-47.webp HTTP/1.1\r\nHost: m.loss-dafa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://m.loss-dafa.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 39260\r\nlast-modified: Fri, 30 Jan 2026 14:13:55 GMT\r\netag: \"697cbca3-995c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":39260,"size_decoded":39700,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 616x410, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d201523addd5bb90d6f8c4b0bd1dbea4","sha1":"436f80d4905e45a8ce2857b96981d13dde2d9db9","sha256":"af26956387ed0e64e04e553224a2aedaca36a52a2d729b759115013ec429a641","sha512":"d29626f8bed753aca71cb2e8f6c8f67a95856511aa7d659736948a954e11267f8f505f73654e799c4a18e93dd06cfe18213bd73afd6c7661d08a66f543763aeb","ssdeep":"768:13WvqYttlhqIS4F35eP/cUrH6JtSAhdUIw/BibspAkAnOt8+Q0k+JgcwnvNcpu:13WCYtt4495QkUr6J5TwSskOt8+Q0k+6","tlshash":"a303f202a7470ea891517ad4fda13c0968d610fa4e64b357b5e0ef4dccd81dba0b7f98","first_seen":"2026-08-16T15:19:22.841456Z","last_seen":"2026-08-16T15:19:53.688526Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1299,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":630,"receive":669,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"m.loss-dafa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"m.loss-dafa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"156.244.169.211:44141/static/picture/tycpc.png","fqdn":"156.244.169.211","domain":"156.244.169.211","tld":""},"ip":{"addr":"156.244.169.211","port":44141,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://156.244.169.211:44141/","date":"2026-08-16T15:18:42.502Z","timestamp":1786893522502,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 15 Aug 2026 04:15:57 GMT","end":"Fri, 21 Aug 2026 20:15:56 GMT"},"fingerprint":{"sha1":"90:1A:05:5B:0B:FC:C9:07:AE:7E:14:04:9C:CB:99:50:3D:58:F2:24","sha256":"83:13:28:D3:16:27:24:E3:86:58:F4:04:4B:77:1D:0C:31:FA:C7:C0:60:ED:F1:15:6D:95:66:76:EA:5C:29:9C"}}},"request":{"raw":"GET /static/picture/tycpc.png HTTP/1.1\r\nHost: 156.244.169.211:44141\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://156.244.169.211:44141/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 15:18:42 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Feb 2026 09:51:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699d74b1-4d7b\"\r\nexpires: Tue, 15 Sep 2026 15:18:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19835,"size_decoded":20210,"mime_type":"image/png","magic":"PNG image data, 162 x 60, 8-bit/color RGBA, non-interlaced","md5":"9cccfc8ca4e4f50e4155a906a42666cb","sha1":"6687ef39ed3ba532124b8155234e819655ac0827","sha256":"38fa753bd6894fd8b0fdd94ba7e7bd9da32cb1e58017c44ce0147afba97b4841","sha512":"4e5e74b92841a16efc4cad516894bdaa1eca4ccdca290bcb36bbaa68cbe2011a6d12005f5bc2946532bbddc4e73161589ab3a296a734b78ad12aaa540bed9cca","ssdeep":"384:nC4JlgpsDv49JmGFnsvbCU5jAEVzJ0smbzRgZGme584WLMM0tq5PHcMV:Ccw9J9FybCUTzJ0smbZhwPH5","tlshash":"ba92e1cc99b518a51940f1dc2f338a48cfe9112c29e58776b1d377a2d94ae6f307c60b","first_seen":"2025-02-07T02:11:03.006958Z","last_seen":"2026-08-16T15:19:53.695173Z","times_seen":1041,"resource_available":false,"data":null}},"time_used":538,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":538,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}