{"report_id":"d2a08164-57e7-4b4c-a087-b65c8dc52c8d","version":0,"status":"done","tags":[],"date":"2026-08-10T05:38:53Z","url":{"schema":"https","addr":"xn--0lq2j11d.net/","fqdn":"xn--0lq2j11d.net","domain":"xn--0lq2j11d.net","tld":"net"},"ip":{"addr":"38.148.255.16","port":0,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"xn--0lq2j11d.net/#/home","fqdn":"xn--0lq2j11d.net","domain":"xn--0lq2j11d.net","tld":"net"},"title":"花无忧先享","dom":{"size":25563,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (24489)","md5":"1c64eedeadaf3b129948e0cab25de306","sha1":"05d67776c739bf3acb570ab1713713be74937244","sha256":"1a8adc7eca53ecd16cf369357b4ab5c44f822f1fbdaf504b0010278fcd97cc05","sha512":"33c2c4093e2418ce18ce59f3eadb8ee47557271c81a27fe6f90577f54bb76e32c984a134f00fd7dda49a3d214ff7d5c060dac654c8e191acc7b05b0110002e09","ssdeep":"384:f05HoPGsGF/xfgShxKjQiSN1TIFjNRSmv//bYyKlBG55p7wtNh3dn3:cSAF/qShxltTIrRSiHMlXGFwtHJ","tlshash":"6db219a870385ebb247ba6dc64312a573ce07b07f4318149d4ee61360edbdfda962493","dom_hash":"domhashe19e368fb1fde938b50f079a839a23f7","first_seen":"2026-08-10T05:38:55.433347Z","last_seen":"2026-08-10T05:38:55.433347Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"xn--0lq2j11d.net/","fqdn":"xn--0lq2j11d.net","domain":"xn--0lq2j11d.net","tld":"net"},"ip":{"addr":"38.148.255.16","port":0,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-14T05:38:53Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"xn--0lq2j11d.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"xn--0lq2j11d.net","ip":{"addr":"38.148.255.16","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"domain_registered":"2026-08-06","domain_rank":0,"first_seen":"2026-08-10T05:21:12.599141Z","last_seen":"2026-08-10T05:21:12.599141Z","alert_count":7,"request_count":7,"received_data":503506,"sent_data":3489,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"xn--0lq2j11d.net/assets/index-02c064ed.js","fqdn":"xn--0lq2j11d.net","domain":"xn--0lq2j11d.net","tld":"net"},"ip":{"addr":"38.148.255.16","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"ea1877a3636c369928133bd35f93eeb5","sha1":"10484da5b9bde8bcddae7bd24f5ec2978e942078","sha256":"f4eaf6ab8484affe74131332b82a47380da31e46a5a5379c7b366f7b51f9c701","sha512":"644edc23c000e9be24836818517ff8324f0f3652fc548b29bc0ed67a20d8eac0eea340e705d6281b70c72d5eded35f309e4ad8438e9f9c7c6d855d40c3b7e72d","ssdeep":"3072:zS1YvfSUtWPcC9vvbO4jSJY557aIxkSUnQsmTDAvFNM10s:vvfSUtWf9xSJYfznsODAvj80s","tlshash":"e4146c903062b5ba53f71de9107b0201f2396f427419c4d0b1fd9cab3e66c99626bf6e","size":205182,"data":"","first_seen":"2026-08-10T05:21:17.759023Z","last_seen":"2026-08-10T05:38:55.442251Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"xn--0lq2j11d.net/assets/about-us-ba2d9b2b.webp","fqdn":"xn--0lq2j11d.net","domain":"xn--0lq2j11d.net","tld":"net"},"ip":{"addr":"38.148.255.16","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--0lq2j11d.net/","date":"2026-08-10T05:38:27.335Z","timestamp":1786340307335,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--0lq2j11d.net","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 06 Aug 2026 06:00:00 GMT","end":"Wed, 04 Nov 2026 05:59:59 GMT"},"fingerprint":{"sha1":"16:6E:9F:88:D6:86:35:3C:06:87:1E:E8:1E:77:FA:C3:9A:7A:F4:24","sha256":"D5:DA:F2:6A:AB:70:16:40:81:FC:FF:BC:F1:3C:65:2B:B8:0C:DA:ED:D2:FE:99:15:67:AD:01:03:F8:45:D5:88"}}},"request":{"raw":"GET /assets/about-us-ba2d9b2b.webp HTTP/1.1\r\nHost: xn--0lq2j11d.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--0lq2j11d.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 10 Aug 2026 05:38:27 GMT\r\ncontent-type: image/webp\r\ncontent-length: 14280\r\nlast-modified: Tue, 12 May 2026 00:45:59 GMT\r\netag: \"6a027847-37c8\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14280,"size_decoded":14552,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1185x513, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"e09607190e9b9d4810a474d0cd95ad1d","sha1":"5e64328ba3013c16514e535e75fe1207b9e49a3d","sha256":"ba2d9b2b436d928cd0a143eeac10dd85130f8cf52a9749a078c93c0bbda701de","sha512":"741ad0b2038df6423aa71bc4272afc80be434d5092a379399b87f92b444b9fdadd7b463141342818e743450ff39618d0dec5869de95fb62bf879a79e26ce231e","ssdeep":"192:bsrg4i8zQy0NygFx+1MHk0XyUicWmE83aM7Lx548sfFt5X//hLCSqAjobomlu+TI:bacFx+1sk0GrmBaMvI5X/5j0oh+M4W","tlshash":"34529e8f162d88ab9d3bd9f0c7d96d700c639dd2dca6702c112949321be6db84c35eb5","first_seen":"2025-12-28T15:25:21.602665Z","last_seen":"2026-08-10T05:38:55.436331Z","times_seen":4,"resource_available":false,"data":null}},"time_used":451,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":451,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"xn--0lq2j11d.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--0lq2j11d.net/","fqdn":"xn--0lq2j11d.net","domain":"xn--0lq2j11d.net","tld":"net"},"ip":{"addr":"38.148.255.16","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-10T05:38:24.918Z","timestamp":1786340304918,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--0lq2j11d.net","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 06 Aug 2026 06:00:00 GMT","end":"Wed, 04 Nov 2026 05:59:59 GMT"},"fingerprint":{"sha1":"16:6E:9F:88:D6:86:35:3C:06:87:1E:E8:1E:77:FA:C3:9A:7A:F4:24","sha256":"D5:DA:F2:6A:AB:70:16:40:81:FC:FF:BC:F1:3C:65:2B:B8:0C:DA:ED:D2:FE:99:15:67:AD:01:03:F8:45:D5:88"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: xn--0lq2j11d.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 10 Aug 2026 05:38:26 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\nlast-modified: Tue, 12 May 2026 00:45:59 GMT\r\netag: \"6a027847-1df\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":747,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF, LF line terminators","md5":"7ec0015af0242bcab5cee797f5329c84","sha1":"31375c03f7ce9db871741356ea2c77cd8c77c37e","sha256":"67b1e7e1b8dacabac9b4e9c548ec6216a087149c46fc851701c4aa07ecc43579","sha512":"1b5c450ec71142c8bb53cf99580dfb51ca4deb162ef660c97de322aee7620b7989a12b554a2584ab8bc128538ec914d63099cdea493eeb499f064210f556ecaf","ssdeep":"","tlshash":"10f05c8194d14c19033052153ce1f619c893e65357065e5475ed537f6fb9a0acd9f86c","first_seen":"2026-08-10T05:21:17.756382Z","last_seen":"2026-08-10T05:38:55.437592Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1432,"timings":{"blocked":-1,"dns":773,"connect":161,"send":0,"wait":167,"receive":1,"ssl":330},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"xn--0lq2j11d.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--0lq2j11d.net/assets/tiger-c3f54c1b.webp","fqdn":"xn--0lq2j11d.net","domain":"xn--0lq2j11d.net","tld":"net"},"ip":{"addr":"38.148.255.16","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--0lq2j11d.net/","date":"2026-08-10T05:38:27.325Z","timestamp":1786340307325,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--0lq2j11d.net","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 06 Aug 2026 06:00:00 GMT","end":"Wed, 04 Nov 2026 05:59:59 GMT"},"fingerprint":{"sha1":"16:6E:9F:88:D6:86:35:3C:06:87:1E:E8:1E:77:FA:C3:9A:7A:F4:24","sha256":"D5:DA:F2:6A:AB:70:16:40:81:FC:FF:BC:F1:3C:65:2B:B8:0C:DA:ED:D2:FE:99:15:67:AD:01:03:F8:45:D5:88"}}},"request":{"raw":"GET /assets/tiger-c3f54c1b.webp HTTP/1.1\r\nHost: xn--0lq2j11d.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--0lq2j11d.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 10 Aug 2026 05:38:27 GMT\r\ncontent-type: image/webp\r\ncontent-length: 224824\r\nlast-modified: Tue, 12 May 2026 00:45:59 GMT\r\netag: \"6a027847-36e38\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":224824,"size_decoded":225098,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a98ef05c06e1bb2f47848af388a2c5e4","sha1":"0e28dd8e4b4bf60d7d2aebe9b1b7e05071ea7f65","sha256":"c3f54c1ba6908c5aaa35c4d9c1b4a04342a6561d98c99a2f73b78b924a902fe7","sha512":"8cc1aa2818c3c63b23b0cfc9333d9557f145ffa8543f492608490a8f64aab81220a14cecc507b7e1d4d03b7edf56ba1649c45a7bc22f2a8782d32e6de7ddf88b","ssdeep":"6144:xZdA3X+jcaxVZ88tHbotKzz67/ocYq9XJ:zd48VZ8GHb6KzGMcYyXJ","tlshash":"72241228753d6f6bf70cf932619a1189bfafd030692014fa426b73416b936396cb5b1c","first_seen":"2026-05-03T10:17:37.488146Z","last_seen":"2026-08-10T05:38:55.440158Z","times_seen":3,"resource_available":false,"data":null}},"time_used":442,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":175,"receive":267,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"xn--0lq2j11d.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--0lq2j11d.net/assets/cooperation-99725176.webp","fqdn":"xn--0lq2j11d.net","domain":"xn--0lq2j11d.net","tld":"net"},"ip":{"addr":"38.148.255.16","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--0lq2j11d.net/","date":"2026-08-10T05:38:27.345Z","timestamp":1786340307345,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--0lq2j11d.net","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 06 Aug 2026 06:00:00 GMT","end":"Wed, 04 Nov 2026 05:59:59 GMT"},"fingerprint":{"sha1":"16:6E:9F:88:D6:86:35:3C:06:87:1E:E8:1E:77:FA:C3:9A:7A:F4:24","sha256":"D5:DA:F2:6A:AB:70:16:40:81:FC:FF:BC:F1:3C:65:2B:B8:0C:DA:ED:D2:FE:99:15:67:AD:01:03:F8:45:D5:88"}}},"request":{"raw":"GET /assets/cooperation-99725176.webp HTTP/1.1\r\nHost: xn--0lq2j11d.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--0lq2j11d.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 10 Aug 2026 05:38:27 GMT\r\ncontent-type: image/webp\r\ncontent-length: 25608\r\nlast-modified: Tue, 12 May 2026 00:45:59 GMT\r\netag: \"6a027847-6408\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25608,"size_decoded":25880,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1083x759, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c90d82c81ec83563e5221a26b9f132bd","sha1":"250ef97838e99d55f141c0aa5449bb9b09dd9695","sha256":"99725176c6ac6e41dcde3a94e5c8212705c65822c253af7c3a278c8423d26385","sha512":"80cbe08aff69580aabde4cb7a13e8c5d15f6bb2cf572713a7170b5c6d848a6ef686fdca0792a6fad492804180c00b78ceca2a98408f9917c60e30d80618af700","ssdeep":"768:C5PvIdoZ7glK2m8SnUk7d+SukFDAh06aEE1qg9yRg:cZ+ZWJ+SuqDA6rVqK","tlshash":"78b2e0d973ae56d6f298173c750c6fecf4757a489e87713830c426620914cc4abbc6c2","first_seen":"2025-12-03T07:35:59.881679Z","last_seen":"2026-08-10T05:38:55.44118Z","times_seen":6,"resource_available":false,"data":null}},"time_used":464,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":457,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"xn--0lq2j11d.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--0lq2j11d.net/favicon.ico","fqdn":"xn--0lq2j11d.net","domain":"xn--0lq2j11d.net","tld":"net"},"ip":{"addr":"38.148.255.16","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--0lq2j11d.net/","date":"2026-08-10T05:38:27.684Z","timestamp":1786340307684,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--0lq2j11d.net","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 06 Aug 2026 06:00:00 GMT","end":"Wed, 04 Nov 2026 05:59:59 GMT"},"fingerprint":{"sha1":"16:6E:9F:88:D6:86:35:3C:06:87:1E:E8:1E:77:FA:C3:9A:7A:F4:24","sha256":"D5:DA:F2:6A:AB:70:16:40:81:FC:FF:BC:F1:3C:65:2B:B8:0C:DA:ED:D2:FE:99:15:67:AD:01:03:F8:45:D5:88"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: xn--0lq2j11d.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--0lq2j11d.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 10 Aug 2026 05:38:27 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\nlast-modified: Tue, 12 May 2026 00:45:59 GMT\r\netag: \"6a027847-1df\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":479,"size_decoded":747,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF, LF line terminators","md5":"7ec0015af0242bcab5cee797f5329c84","sha1":"31375c03f7ce9db871741356ea2c77cd8c77c37e","sha256":"67b1e7e1b8dacabac9b4e9c548ec6216a087149c46fc851701c4aa07ecc43579","sha512":"1b5c450ec71142c8bb53cf99580dfb51ca4deb162ef660c97de322aee7620b7989a12b554a2584ab8bc128538ec914d63099cdea493eeb499f064210f556ecaf","ssdeep":"","tlshash":"10f05c8194d14c19033052153ce1f619c893e65357065e5475ed537f6fb9a0acd9f86c","first_seen":"2026-08-10T05:21:17.756382Z","last_seen":"2026-08-10T05:38:55.437592Z","times_seen":2,"resource_available":false,"data":null}},"time_used":161,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":161,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"xn--0lq2j11d.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--0lq2j11d.net/assets/index-02c064ed.js","fqdn":"xn--0lq2j11d.net","domain":"xn--0lq2j11d.net","tld":"net"},"ip":{"addr":"38.148.255.16","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--0lq2j11d.net/","date":"2026-08-10T05:38:26.581Z","timestamp":1786340306581,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--0lq2j11d.net","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 06 Aug 2026 06:00:00 GMT","end":"Wed, 04 Nov 2026 05:59:59 GMT"},"fingerprint":{"sha1":"16:6E:9F:88:D6:86:35:3C:06:87:1E:E8:1E:77:FA:C3:9A:7A:F4:24","sha256":"D5:DA:F2:6A:AB:70:16:40:81:FC:FF:BC:F1:3C:65:2B:B8:0C:DA:ED:D2:FE:99:15:67:AD:01:03:F8:45:D5:88"}}},"request":{"raw":"GET /assets/index-02c064ed.js HTTP/1.1\r\nHost: xn--0lq2j11d.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--0lq2j11d.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 10 Aug 2026 05:38:26 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 12 May 2026 00:45:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a027847-3217e\"\r\nexpires: Mon, 10 Aug 2026 17:38:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":205182,"size_decoded":85434,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (40338)","md5":"ea1877a3636c369928133bd35f93eeb5","sha1":"10484da5b9bde8bcddae7bd24f5ec2978e942078","sha256":"f4eaf6ab8484affe74131332b82a47380da31e46a5a5379c7b366f7b51f9c701","sha512":"644edc23c000e9be24836818517ff8324f0f3652fc548b29bc0ed67a20d8eac0eea340e705d6281b70c72d5eded35f309e4ad8438e9f9c7c6d855d40c3b7e72d","ssdeep":"3072:zS1YvfSUtWPcC9vvbO4jSJY557aIxkSUnQsmTDAvFNM10s:vvfSUtWf9xSJYfznsODAvj80s","tlshash":"e4146c903062b5ba53f71de9107b0201f2396f427419c4d0b1fd9cab3e66c99626bf6e","first_seen":"2026-08-10T05:21:17.759023Z","last_seen":"2026-08-10T05:38:55.442251Z","times_seen":2,"resource_available":true,"data":null}},"time_used":219,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":219,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"xn--0lq2j11d.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--0lq2j11d.net/assets/index-20b41b17.css","fqdn":"xn--0lq2j11d.net","domain":"xn--0lq2j11d.net","tld":"net"},"ip":{"addr":"38.148.255.16","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xn--0lq2j11d.net/","date":"2026-08-10T05:38:26.582Z","timestamp":1786340306582,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--0lq2j11d.net","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 06 Aug 2026 06:00:00 GMT","end":"Wed, 04 Nov 2026 05:59:59 GMT"},"fingerprint":{"sha1":"16:6E:9F:88:D6:86:35:3C:06:87:1E:E8:1E:77:FA:C3:9A:7A:F4:24","sha256":"D5:DA:F2:6A:AB:70:16:40:81:FC:FF:BC:F1:3C:65:2B:B8:0C:DA:ED:D2:FE:99:15:67:AD:01:03:F8:45:D5:88"}}},"request":{"raw":"GET /assets/index-20b41b17.css HTTP/1.1\r\nHost: xn--0lq2j11d.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--0lq2j11d.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 10 Aug 2026 05:38:26 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 12 May 2026 00:45:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a027847-7785\"\r\nexpires: Mon, 10 Aug 2026 17:38:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":30597,"size_decoded":5679,"mime_type":"text/css","magic":"ASCII text, with very long lines (30596)","md5":"a2e017d65efcdfa68dfc9fd3b3e75e63","sha1":"136ae85a851e585f78cc176a1d3f4dccf10705f9","sha256":"20b41b1714374470009a9032b7bef6565cb5706dbc160052b3ea07c2792bfccd","sha512":"109e2617f5182e8c22dcbb47dff81fe25685a9352e5901faf2f64119a4b40fd26954b1548644263e413110806afea053e5126f279f8dc270f6abab55a9eeb55c","ssdeep":"768:Jg0Tp7HxGJi9rDmFYxgkjFZ/JslyweCjwY:Z7HxGYdholrMY","tlshash":"22d20f22372c2439f23bf55170d1b65bb291b313e8a345aaead0b035cdc75a336296c9","first_seen":"2026-08-10T05:21:17.763056Z","last_seen":"2026-08-10T05:38:55.444455Z","times_seen":2,"resource_available":false,"data":null}},"time_used":536,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":536,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"xn--0lq2j11d.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}