{"report_id":"d8cfbdc0-5b7a-42bb-875f-b294366330f1","version":0,"status":"done","tags":[],"date":"2026-09-26T23:58:22Z","url":{"schema":"http","addr":"dfzzhs.com/","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":0,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"final":{"url":{"schema":"https","addr":"dfzzhs.com/","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"title":"mk体育电子,mk体育娱乐","dom":{"size":151,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"05bf1f2930cb26eb431c27c85e9173c2","sha1":"809ac4aaecdeb01504b6368a794247c84e92e554","sha256":"cf324f9eb205a8e6493c9b903c46498c61ce485ba1d53ef20375910b0cb054cd","sha512":"ba820bdd508aad8a86fedf813269043a1bbd0170609edf6084db195c52e823cc943902618a7ce38b4d5b130a175e2cd2dbe8bb7e283d8de26ae30ebe2a07c02c","ssdeep":"","tlshash":"3fc08c06786f240cab0351c20a873e80d545c332884e48408b82029b70cb427c0c7728","dom_hash":"domhash18da208b3b39949e9ba09528a720f5c0","first_seen":"2025-11-13T13:09:34.198812Z","last_seen":"2026-09-26T23:58:51.29761Z","times_seen":8312,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"dfzzhs.com/","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":0,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-31T23:58:22Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"31pu2ilhjrkmwpf"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"sdk.51.la","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"chat.zyzhan.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"www.zyzhan.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"www.kq52h5.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"www.kq52h5.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"img63.zyzhan.com","ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2006-01-21","domain_rank":0,"first_seen":"2013-10-30T08:45:28Z","last_seen":"2026-09-19T17:26:50.876207Z","alert_count":0,"request_count":4,"received_data":23775,"sent_data":2548,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}]},{"fqdn":"sdk.51.la","ip":{"addr":"43.159.107.113","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"domain_registered":"2005-01-17","domain_rank":347679,"first_seen":"2021-03-08T16:03:51Z","last_seen":"2026-09-22T20:37:33.176088Z","alert_count":1,"request_count":1,"received_data":34775,"sent_data":452,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}]},{"fqdn":"img67.zyzhan.com","ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2006-01-21","domain_rank":0,"first_seen":"2015-04-19T02:02:04Z","last_seen":"2026-05-31T13:13:15.836795Z","alert_count":0,"request_count":5,"received_data":41279,"sent_data":3185,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"www.kq52h5.com","ip":{"addr":"207.57.81.8","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2026-04-14","domain_rank":0,"first_seen":"2026-08-25T06:06:53.812862Z","last_seen":"2026-09-17T02:40:55.210212Z","alert_count":2,"request_count":1,"received_data":314,"sent_data":546,"comment":"","tags":null,"fingerprints":null},{"fqdn":"www.daliguolv.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":19,"received_data":0,"sent_data":10514,"comment":"","tags":null,"fingerprints":null},{"fqdn":"dfzzhs.com","ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":38,"request_count":38,"received_data":232438,"sent_data":26398,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]},{"fqdn":"chat.zyzhan.com","ip":{"addr":"155.102.51.4","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"domain_registered":"2006-01-21","domain_rank":0,"first_seen":"2015-02-28T07:41:25Z","last_seen":"2026-09-19T17:26:50.672867Z","alert_count":2,"request_count":2,"received_data":2034,"sent_data":954,"comment":"","tags":null,"fingerprints":[{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"collect-v6.51.la","ip":{"addr":"43.159.107.113","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"domain_registered":"2005-01-17","domain_rank":348646,"first_seen":"2021-03-08T16:03:54Z","last_seen":"2026-09-22T08:25:05.640931Z","alert_count":0,"request_count":1,"received_data":339,"sent_data":503,"comment":"","tags":null,"fingerprints":[{"name":"EdgeOne","description":"EdgeOne is an edge-service platform that delivers global content distribution, network acceleration, and integrated security protections for distributed applications.","website":"https://edgeone.ai","common_platform_enumeration":"","icon":"EdgeOne.svg","categories":["CDN"]}]},{"fqdn":"www.zyzhan.com","ip":{"addr":"163.181.131.237","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Germany","country_code":"DE"},"domain_registered":"2006-01-21","domain_rank":7308161,"first_seen":"2013-02-06T20:53:34Z","last_seen":"2026-09-19T17:26:50.58684Z","alert_count":3,"request_count":3,"received_data":7044,"sent_data":2215,"comment":"","tags":null,"fingerprints":[{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"img65.zyzhan.com","ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2006-01-21","domain_rank":0,"first_seen":"2015-04-19T02:13:45Z","last_seen":"2026-09-19T19:24:06.541561Z","alert_count":0,"request_count":2,"received_data":21906,"sent_data":1274,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"img53.zyzhan.com","ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2006-01-21","domain_rank":0,"first_seen":"2013-10-30T08:45:31Z","last_seen":"2026-09-20T02:17:28.379207Z","alert_count":0,"request_count":1,"received_data":17335,"sent_data":637,"comment":"","tags":null,"fingerprints":[{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"public.mtnets.com","ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2007-05-21","domain_rank":0,"first_seen":"2019-01-29T13:10:34Z","last_seen":"2026-09-08T18:00:06.378763Z","alert_count":0,"request_count":1,"received_data":85953,"sent_data":476,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft ASP.NET","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}]},{"fqdn":"img68.zyzhan.com","ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2006-01-21","domain_rank":0,"first_seen":"2020-06-02T10:06:36Z","last_seen":"2026-09-19T17:26:50.466032Z","alert_count":0,"request_count":6,"received_data":38983,"sent_data":3822,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"chat.zyzhan.com/chat/KFCenterBox/65392","fqdn":"chat.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"155.102.51.4","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"b936460ba988b30cd79d99ae93c77106","sha1":"a44405ff5b67abf66ef77714e4364e6c3f1e9940","sha256":"6cd604b71e1e21050b6a41602716b9a722e769a5d7cfb3b97152f3d73dcef5c9","sha512":"ad4731faf916fbb7118af38e25fa7e15814294950676fbd4ec41aeba5c7508ed34b7a7a4c98e1834e1096ea92e6301935699ed6df01a7416632e39063c0c9661","ssdeep":"","tlshash":"3990023209b10052711510915943e1456595959129de9915a00004a572529539a06d51","size":49,"data":"","first_seen":"2023-03-07T12:42:46Z","last_seen":"2026-09-26T23:58:51.313872Z","times_seen":731,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chat.zyzhan.com/chat/KFLeftBox/65392","fqdn":"chat.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"155.102.51.4","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"b936460ba988b30cd79d99ae93c77106","sha1":"a44405ff5b67abf66ef77714e4364e6c3f1e9940","sha256":"6cd604b71e1e21050b6a41602716b9a722e769a5d7cfb3b97152f3d73dcef5c9","sha512":"ad4731faf916fbb7118af38e25fa7e15814294950676fbd4ec41aeba5c7508ed34b7a7a4c98e1834e1096ea92e6301935699ed6df01a7416632e39063c0c9661","ssdeep":"","tlshash":"3990023209b10052711510915943e1456595959129de9915a00004a572529539a06d51","size":49,"data":"","first_seen":"2023-03-07T12:42:46Z","last_seen":"2026-09-26T23:58:51.313872Z","times_seen":731,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":true,"md5":"2633552cbd7ea8f06081c27e390c37b1","sha1":"398b353dcedf315a5c9792256f94e6cd62f08e5c","sha256":"2dcf38be9661ad50845d0127a7b2ab41a90d5b835baf838e79062b943d5e461f","sha512":"680fa03d553d4dc611b1f237c5f923dd50780909343a703251e0dfc91510d2b651535d2f8dc1993b92dc8e2bf4fbfbca3703547b4fc891adc7dd73edd310a87a","ssdeep":"","tlshash":"fba012be3190734100010403b297084a276a5030c080803c9a5061c80438c246385c84","size":80,"data":"","first_seen":"2026-09-26T23:58:51.349151Z","last_seen":"2026-09-26T23:58:51.349151Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":true,"md5":"8184fdb4a535060b8c0cd7a3aafa96de","sha1":"c2aab95bac95682ca0a8ae13a03327012e44214b","sha256":"a43bde24344a59d6703af770227c828e444f476d5eb04d43bb95a3191ba92c38","sha512":"a92d06f1cc81dfdc7aacd8aee594a6488be10b26fd8f9cd5665fa1fb19f1ac25661df6274c640fc5dd3051ada31a492195858c2fc6890080828ec1c170aaf2b3","ssdeep":"","tlshash":"43d097b73420be0e08726988e1b1ce6830f6235a6191d6db947a89390911ade1d1c806","size":241,"data":"","first_seen":"2026-01-03T09:11:47.395197Z","last_seen":"2026-09-26T23:58:51.350517Z","times_seen":173,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":true,"md5":"c3b16695fc88734642cc96b464855026","sha1":"38ccf9640a9bff806eb90f048671bb5550dd9a7c","sha256":"0fa0c62e92fb41bd716a91283c795f54dfd4185b447c28aa4332e38c1056cc7c","sha512":"e3446dae06d56e7e7b28252cf6292dd59a68fbca426d97737674d2b3bf607f87192c98cf900e0c3bdf2e2b48141c2f9203ac06619387bc458ae0825719e8ce2b","ssdeep":"","tlshash":"6be0d8ed2c661a746b9004be942ff91cf1d9617c1455e112a58dfc124034eeb1a1aa94","size":354,"data":"","first_seen":"2026-06-06T15:03:02.336033Z","last_seen":"2026-09-26T23:58:51.351242Z","times_seen":35,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":true,"md5":"a427ee51684ff8fdd21c54ddc041978a","sha1":"e75e2e6e0a91330657c7f0b9282169ef9bcef2b8","sha256":"2919a4991b6edb0563583f5ecaa7c18562fb5afac80bbaa62d93f0fc54c4aaab","sha512":"91e29ef95e4fbcb1c61ac4e304d9df442d32093fe710fd1791070ee71b6d2218bf030df13c69444817a17e13c7617944a5bd8689f484cf9857486deae8a36f16","ssdeep":"","tlshash":"17a0121b3a064c305445702202088ad0780062820fa42941a03824248010d814545f54","size":85,"data":"","first_seen":"2026-06-21T23:58:22.691322Z","last_seen":"2026-09-26T23:58:51.351954Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":true,"md5":"ab0597f85e54a0efb3c3c4cb9e677261","sha1":"77c05a5617a6e3b0846f89c58c5c1d021d5014e9","sha256":"87dd0fa16ad42419725075a13f84e5e2f0d5369b3bffb6ea15beb03a8cef3ade","sha512":"e35867fb64fed8145e453424f3f13b89f74ab6eadc305f655d329680f6c6aab6993748032570a998e5f2e8b11cc6dd8d2f5bc4e6d5e93c753fe411489c9ebcf5","ssdeep":"","tlshash":"a4f0fca5f788567020eb723a45ee30c829af85074f498641fb7481b45fdda0b25abd49","size":582,"data":"","first_seen":"2026-07-06T04:32:23.64064Z","last_seen":"2026-09-26T23:58:51.352752Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":true,"md5":"92ba68004452c5341ffd9156e78c6c6b","sha1":"5a64361ad526800041c9a1c104deae36b1a77697","sha256":"40f515834ec91f5d83c6c6899d3acefd797c25104e2b6e5dfdd327cb46ddfe17","sha512":"f256a7ca0e286d67c353a379906b20bbfa4d9bf3c3791e9b190865223c3c667cfe0159d7ea68eb081057ad9948f6b3e35a36d939ed6fa084781866202282b94e","ssdeep":"","tlshash":"b011d6c5412850278663f23f1c2f6221aa6b82cbd8ee2c74749d0480cf6916d46fe7b4","size":859,"data":"","first_seen":"2026-07-04T09:35:09.58888Z","last_seen":"2026-09-26T23:58:51.353485Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":true,"md5":"20e61c7d1bc338b358445b23d18305e3","sha1":"8f137855e70644b6c580e4f8b52b7df54e468228","sha256":"67cfa89bd5e06c2e328bb58e9eb4db7d1a1a1d7ffcf6bafe3747b7c3e00c3992","sha512":"b9b1874f221395ee326beb62fbd35a62f1cc38b8ce5cd315402997c3be2e6a1ef8d92b9cd42f8fcf142278a67aee44ee093431f1e4c85a760ca90a911934203b","ssdeep":"","tlshash":"35d0a75973e215c410bb196efa1fc5e00d4cab37c5119944b43d98e14f429a8ba2356f","size":287,"data":"","first_seen":"2026-09-26T23:58:51.355038Z","last_seen":"2026-09-26T23:58:51.355038Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":true,"md5":"c5558387ed1e3e87826f1a970d72b226","sha1":"c4c4396bc5341f433d6ffde501d1c82046df581d","sha256":"7c089be2200347886291429c151eb303c321f3993c010705ef400d6757a81cfe","sha512":"cd9d2cb0d24cf3b3ccba28d71f6a172ff53080c03ba54ba180ecdc573ca83c83c88dcfdd8634a65960e4ed7e8373f36ff0241a44285dc4bd52a961ad6f767a16","ssdeep":"","tlshash":"e7f02481934ca07a83e0822f6d3d63d3894f035ac4db44fb95a6a810c8181b705edfb0","size":520,"data":"","first_seen":"2026-09-26T23:58:51.356505Z","last_seen":"2026-09-26T23:58:51.356505Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"43.159.107.113","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"8fc0b01d35300e8398d6e957987c01e7","sha1":"f1eb32c75b8d8e4b0555ebc2a5f5d1d60296f41e","sha256":"b164aafa0bb83dfe511912ca2ca475880bfffac8d8f098c947fd3d4af440d3a4","sha512":"fab84d067e724d45f35821d8f37c0cd4f608af2975de48a61b905dba89189ca8778b04b4d507e6417a4187193a3da2d0a8939c02bf2d39adb9733cffd2358401","ssdeep":"768:Xzz9qAO+a/y1jaKUiQU5enEU9GMXB0XXQVEXB3CNSPf:Xzz9qnT/c+KUc5enEU9GMXB/EXB3LPf","tlshash":"55f22d9577c0717cc3c782e9361b401ae1a69e810099a8acf345f594bd74e66a33ffa8","size":34329,"data":"","first_seen":"2023-04-05T07:31:50Z","last_seen":"2026-09-27T01:33:43.937619Z","times_seen":10762,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.zyzhan.com/mystat.aspx?u=hzdarlly","fqdn":"www.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"163.181.131.237","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"8f311c9425c7985e87d5bcd3ffb95870","sha1":"cae5fa6a6b81a12c396e80afe7702037bf607a56","sha256":"6e54cd62d0b73204a39b89be4550f385d949a73559db6103acc04f2cdb5af8c1","sha512":"670e40397d5df9372a5c226d1b8daed7e752dbbbca8db46d9585514171ef2942e0ad4f24b519476a315dc884f52f9c6d3dac6413ae172ea4dc9866741ce72e83","ssdeep":"","tlshash":"a5214d541d06c0a4bc36713d89bbc13cd2a51a273865d73678cca9084f78fa525deeea","size":1359,"data":"","first_seen":"2026-09-26T23:58:51.314458Z","last_seen":"2026-09-26T23:58:51.314458Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/aa.js","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":false,"md5":"473be5b01830538ec698a5c3fdaff81b","sha1":"c76d6a589dbd83903f16a4b34ae1b0790d35864d","sha256":"09a72861941c456470f8c4c2f75a0fbb7ba47f4808404e4eb8fdf1b99f6c0085","sha512":"ce298d0760c84c99d13af92fcd1e902ecfffb06a9f6a78939634f3f7d3b7aef00c329862552ad86708bd53804add20e145b40d8bee40153db86c92591cfc4304","ssdeep":"","tlshash":"6f21cb766c13f1280224a478b275caac65ad8034eb06ca1145eed86e585cfec0829d8c","size":1141,"data":"","first_seen":"2026-08-25T06:07:06.152626Z","last_seen":"2026-09-26T23:58:51.321881Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.zyzhan.com/asyncstat.aspx?u=hzdarlly\u0026referer=\u0026title=mk%u4F53%u80B2%u7535%u5B50%2Cmk%u4F53%u80B2%u5A31%u4E50","fqdn":"www.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"163.181.131.237","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"eab59d9555404a97c9679d7571c91c6d","sha1":"adabe4cf6b5058a33f147056ff0020e05d2c9886","sha256":"24681d7240daf01071344891d9ea20e82c0159105ce38316fc8475aefa0cd5a2","sha512":"985545e96f4c007f560d688eddd4184370d7725549f6d5646df41070c5c7adfeec35230ba534afb3ef9ec8659adbd6a84adfc814cc2fd85e3c036b3af77c27b8","ssdeep":"","tlshash":"18f05c634801e2fe8901b4f9ef51e384d11b0f2f31a1da736132018126212b7f1ac9db","size":470,"data":"","first_seen":"2026-09-26T23:58:51.359069Z","last_seen":"2026-09-26T23:58:51.359069Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":false,"md5":"8e006be499dc1638abe39c9dbee4b14b","sha1":"03546bb93a8726c338167f36af5e5fe85ad598e4","sha256":"b9967d9e17e37ecbdf8c0e31a20621aee8849535d63cec82c9f30a6c1aa8532e","sha512":"1ee37814e857091392aec485ef139b6950f308e233f297e4f920483f8e36cf1175b49a26d45f707dbbb68648b81f12b133b83e2a7f6bb4ebeea49f5422816c72","ssdeep":"","tlshash":"00f097af5c41a1581ac635a8ababda88d1ae0424540ec813f8d6c4dd2e3cfc8042134c","size":493,"data":"","first_seen":"2025-10-18T11:02:04.720172Z","last_seen":"2026-09-26T23:58:51.362238Z","times_seen":92,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"public.mtnets.com/Plugins/jQuery/2.2.4/jquery-2.2.4.min.js","fqdn":"public.mtnets.com","domain":"mtnets.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2f6b11a7e914718e0290410e85366fe9","sha1":"69bb69e25ca7d5ef0935317584e6153f3fd9a88c","sha256":"05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e","sha512":"0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db","ssdeep":"1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2","tlshash":"1e83c6d9b2d6706297b734b850bf410bb17a98dab44c8c60f059d4e47eb4a8e507bf2c","size":85578,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-09-27T01:27:54.712136Z","times_seen":298026,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"error","text":"ChatError:202005061528","filename":"https://chat.zyzhan.com/chat/KFCenterBox/65392","line_number":2,"column_number":16},{"level":"error","text":"ChatError:202005061528","filename":"https://chat.zyzhan.com/chat/KFLeftBox/65392","line_number":2,"column_number":16}]},"http":[{"url":{"schema":"https","addr":"img68.zyzhan.com/gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf3719f53579aca020be07fbd3496c45c7e2a96b913a0456252b_284_284_5.jpg","fqdn":"img68.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.231Z","timestamp":1790467066231,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf3719f53579aca020be07fbd3496c45c7e2a96b913a0456252b_284_284_5.jpg HTTP/1.1\r\nHost: img68.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public\r\ncontent-disposition: inline;filename=637939107213294762912.jpg\r\ncontent-type: image/webp\r\ndate: Sat, 26 Sep 2026 00:57:40 GMT\r\netag: \"1790384261\"\r\nexpires: Sun, 26 Sep 2027 00:57:40 GMT\r\nlast-modified: Sat, 26 Sep 2026 03:29:57 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-aspnet-version: 4.0.30319\r\nx-cache: HIT, server, disk\r\nx-powered-by: ASP.NET-img68\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4864,"size_decoded":5362,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 284x284, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"03bc78eb40585f7f39fb0da4ff1c45e2","sha1":"4d3730e9acb6ce749f1d2edfa63ba8e37e7668e2","sha256":"39d81889cfaaa3493cde20e554f5877c0ca29dd1f50cae43c1a8de7227e0ccc4","sha512":"195dfb30cd4425e1edd1a3dc18a27da56bdaf95296b38d2e23a6a25734e077f46a3017ffd53dddf6d85341d7f66a1478bb3ca42f7e80510522b7be6ed6b0d1ef","ssdeep":"96:qo5MAf/L3el332O4uIceQ5MmHjpfTkH7b6bBK77WxXSPjQLWNlUJIzlcXI7EGJBj:FS8el33r1HHFTkHnX7VjjzUazlc4A2ok","tlshash":"eba17efe30344baa476a3f1e3e6bf4b543c056a710c233a1d5c5d1a5a69036df82d09c","first_seen":"2026-09-26T23:58:51.298569Z","last_seen":"2026-09-26T23:58:51.298569Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1036,"timings":{"blocked":935,"dns":1,"connect":25,"send":0,"wait":34,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.daliguolv.com/Skins/65392/images/addr.png","fqdn":"www.daliguolv.com","domain":"daliguolv.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.526Z","timestamp":1790467067526,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /Skins/65392/images/addr.png HTTP/1.1\r\nHost: www.daliguolv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?skins/65392/js/pt_js.js","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.815Z","timestamp":1790467067815,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dfzzhs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:39:12 GMT","end":"Thu, 19 Nov 2026 22:39:11 GMT"},"fingerprint":{"sha1":"5A:71:47:AB:A0:F5:A6:04:56:33:5B:E5:1C:89:E0:29:88:44:89:9E","sha256":"A8:7A:95:05:4C:E7:90:E9:13:57:58:BF:27:FD:E5:67:44:9E:17:B4:4F:09:BC:FF:2B:21:A3:22:81:A6:8C:60"}}},"request":{"raw":"GET /?skins/65392/js/pt_js.js HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr; __vtins__K9hAf3fFNdu885Sn=%7B%22sid%22%3A%20%2266946985-a068-5123-8088-30f42c1f812c%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201790467199999%2C%20%22ct%22%3A%201790467066355%7D; __51uvsct__K9hAf3fFNdu885Sn=1; __51vcke__K9hAf3fFNdu885Sn=5e8d8c22-b55b-5465-91ab-ec6b796594df; __51vuft__K9hAf3fFNdu885Sn=1790467066359\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:48 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\nlocation: http://www.daliguolv.com/skins/65392/js/pt_js.js\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":468,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":468,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.daliguolv.com/skins/65392/images/banner3.jpg","fqdn":"www.daliguolv.com","domain":"daliguolv.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:48.375Z","timestamp":1790467068375,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /skins/65392/images/banner3.jpg HTTP/1.1\r\nHost: www.daliguolv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?skins/65392/images/cf1.jpg","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.184Z","timestamp":1790467066184,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?skins/65392/images/cf1.jpg HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:46 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: http://www.daliguolv.com/skins/65392/images/cf1.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img63.zyzhan.com/gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf37dfc83bb6d2bf0f23fd750c895fc21bf704de439c13e18cc3_284_284_5.jpg","fqdn":"img63.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.229Z","timestamp":1790467066229,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf37dfc83bb6d2bf0f23fd750c895fc21bf704de439c13e18cc3_284_284_5.jpg HTTP/1.1\r\nHost: img63.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public\r\ncontent-disposition: inline;filename=637939109819915390107.jpg\r\ncontent-type: image/webp\r\ndate: Sat, 26 Sep 2026 00:57:39 GMT\r\netag: \"1790384259_webp\"\r\nexpires: Sun, 26 Sep 2027 00:57:39 GMT\r\nlast-modified: Sat, 26 Sep 2026 00:57:39 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-aspnet-version: 4.0.30319\r\nx-cache: HIT, server, disk\r\nx-powered-by: ASP.NET-img63\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}],"data":{"size":7254,"size_decoded":7757,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 284x284, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"86f187f7c65407f4d0198495d43e27c4","sha1":"060d55cfd0b52ca031da066c724b77393172dd45","sha256":"4bcb43d08c303e195fd908b6fceb76ed08201611a92daae2dd13864ce75c06a9","sha512":"23540d15370d47ed7343cac816fbfc8223c44ae311a67b4a14689f76b9d1ed433befa94151212cc16f3854ff69cdfc9ce7dd3c7d3dd5141f35e3ed70c8a1e7ac","ssdeep":"192:oXA5rzs+2FMrnxHlYiWcWqv3GShCb3JLCNkuHa:sA5n1XrnXDv3/h4L6ku6","tlshash":"d0e1afd211647850dfc2eea2f497e9457afa5c203320117459226534dc6b71baea0aaf","first_seen":"2026-09-26T23:58:51.301635Z","last_seen":"2026-09-26T23:58:51.301635Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1014,"timings":{"blocked":935,"dns":1,"connect":20,"send":0,"wait":20,"receive":0,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"43.159.107.113","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.248Z","timestamp":1790467066248,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.51.la","organization":""},"issuer":{"commonName":"Keymatic Secure Domain RSA CA G1","organization":"PKI(Chongqing) Limited"},"validity":{"start":"Wed, 01 Apr 2026 06:48:26 GMT","end":"Fri, 16 Oct 2026 15:59:59 GMT"},"fingerprint":{"sha1":"F0:4F:0E:62:84:89:BD:2B:8E:53:1E:AC:20:70:16:C2:F7:E9:C1:C0","sha256":"54:9F:ED:D0:8F:D4:0A:5F:31:95:55:FD:E0:E6:13:F2:09:8C:39:E1:01:31:98:FA:1D:DC:20:CD:20:19:7C:F5"}}},"request":{"raw":"GET /js-sdk-pro.min.js HTTP/1.1\r\nHost: sdk.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Sat, 10 Jun 2023 08:47:40 GMT\r\ncontent-encoding: gzip\r\netag: W/\"648438ac-861a\"\r\nserver: openresty\r\ncontent-type: application/javascript; charset=utf-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\ncache-control: max-age=1296000\r\ncontent-length: 12853\r\naccept-ranges: bytes\r\ndate: Sat, 26 Sep 2026 23:57:46 GMT\r\neo-log-uuid: 15841003240919002782\r\neo-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":34330,"size_decoded":13298,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (34109)","md5":"8fc0b01d35300e8398d6e957987c01e7","sha1":"f1eb32c75b8d8e4b0555ebc2a5f5d1d60296f41e","sha256":"b164aafa0bb83dfe511912ca2ca475880bfffac8d8f098c947fd3d4af440d3a4","sha512":"fab84d067e724d45f35821d8f37c0cd4f608af2975de48a61b905dba89189ca8778b04b4d507e6417a4187193a3da2d0a8939c02bf2d39adb9733cffd2358401","ssdeep":"768:Xzz9qAO+a/y1jaKUiQU5enEU9GMXB0XXQVEXB3CNSPf:Xzz9qnT/c+KUc5enEU9GMXB/EXB3LPf","tlshash":"55f22d9577c0717cc3c782e9361b401ae1a69e810099a8acf345f594bd74e66a33ffa8","first_seen":"2023-04-05T07:31:50Z","last_seen":"2026-09-27T01:33:43.937619Z","times_seen":10762,"resource_available":true,"data":null}},"time_used":78,"timings":{"blocked":-1,"dns":5,"connect":20,"send":0,"wait":25,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"sdk.51.la","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.daliguolv.com/Skins/65392/images/email.png","fqdn":"www.daliguolv.com","domain":"daliguolv.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.387Z","timestamp":1790467067387,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /Skins/65392/images/email.png HTTP/1.1\r\nHost: www.daliguolv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?skins/65392/Css/style.css","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:45.970Z","timestamp":1790467065970,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dfzzhs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:39:12 GMT","end":"Thu, 19 Nov 2026 22:39:11 GMT"},"fingerprint":{"sha1":"5A:71:47:AB:A0:F5:A6:04:56:33:5B:E5:1C:89:E0:29:88:44:89:9E","sha256":"A8:7A:95:05:4C:E7:90:E9:13:57:58:BF:27:FD:E5:67:44:9E:17:B4:4F:09:BC:FF:2B:21:A3:22:81:A6:8C:60"}}},"request":{"raw":"GET /?skins/65392/Css/style.css HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:46 GMT\r\ncontent-type: text/css;charset=gbk\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136672,"size_decoded":23726,"mime_type":"text/css; charset=gbk","magic":"troff or preprocessor input, Unicode text, UTF-8 text, with very long lines (378), with CRLF line terminators","md5":"b5c3a5e6033c972584ea556121d1312d","sha1":"183950676563fddc188afb5c18f1701f90329abc","sha256":"3c85f6077d383e7aa4d8eda1ddf632cbf16f789e33d9e38b445a80549e693ebc","sha512":"a0e1f06a80d2dbb17ee35477f9e012b03d79b12600f15b9f90bbe43421191c252102aeadc748c19f6f624fe1798ee04fa776bb84ce91dace8a73d9ae939af3b6","ssdeep":"1536:Hi2h4JqmPIDPICncC+avgX3wmKWv24eepec227/wv6KhFwgQM4IJqxc9jWdiht79:AcT","tlshash":"94d35432ab91311cf1279265bba3aaae7b1bc017b38306fdee543634c18f49745b2745","first_seen":"2026-09-26T23:58:51.304171Z","last_seen":"2026-09-26T23:58:51.304171Z","times_seen":1,"resource_available":true,"data":null}},"time_used":512,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":512,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?index_cache.html","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.198Z","timestamp":1790467066198,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dfzzhs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:39:12 GMT","end":"Thu, 19 Nov 2026 22:39:11 GMT"},"fingerprint":{"sha1":"5A:71:47:AB:A0:F5:A6:04:56:33:5B:E5:1C:89:E0:29:88:44:89:9E","sha256":"A8:7A:95:05:4C:E7:90:E9:13:57:58:BF:27:FD:E5:67:44:9E:17:B4:4F:09:BC:FF:2B:21:A3:22:81:A6:8C:60"}}},"request":{"raw":"GET /?index_cache.html HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:46 GMT\r\ncontent-type: text/html; charset=gbk\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1896,"size_decoded":1371,"mime_type":"text/html; charset=gbk","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (769), with CRLF line terminators","md5":"c25c07028b4a9dec29a9263db9bb8522","sha1":"79c5da839e15baa96e63596450901af311a95880","sha256":"f3fe4bae082ec25832f745af224bf554e019eb804f5c536eee95689d0a7cc5e2","sha512":"31687c08de9c2a70301f8fe6f5ac97bcc3a6d60dc42cc47f6f03a985787491898dcac768a068a5cd88ebd08ce48d1491dc39d8d1c5ded5baaa4092a071df3f7f","ssdeep":"","tlshash":"2c41248945a3b68d0965c7b8f4e5db9bc81222c46df1f1e4d0a36e45aed073c720a3cb","first_seen":"2026-09-26T23:58:51.306983Z","last_seen":"2026-09-26T23:58:51.306983Z","times_seen":1,"resource_available":true,"data":null}},"time_used":796,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":796,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img67.zyzhan.com/gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf37c15856a23d8a576fcc82daa9a524df558ffa55dc1ce746dc_284_284_5.jpg","fqdn":"img67.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.220Z","timestamp":1790467066220,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf37c15856a23d8a576fcc82daa9a524df558ffa55dc1ce746dc_284_284_5.jpg HTTP/1.1\r\nHost: img67.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public\r\ncontent-disposition: inline;filename=637939110598931662311.jpg\r\ncontent-type: image/webp\r\ndate: Sat, 26 Sep 2026 00:57:36 GMT\r\netag: \"1790384257_webp\"\r\nexpires: Sun, 26 Sep 2027 00:57:36 GMT\r\nlast-modified: Sat, 26 Sep 2026 00:57:37 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-aspnet-version: 4.0.30319\r\nx-cache: HIT, server, disk\r\nx-powered-by: ASP.NET-img67\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8042,"size_decoded":8545,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 284x284, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4c7f2194442337fc091cd77d64609ac6","sha1":"0180753a6ff3293aa727716272d5a52e50df7d3b","sha256":"7769de1f1cef7e77f7f4e9b353189e7158bb1221812e64cad7797e3fe4f87ac0","sha512":"a9384cda83389925029a0d89d5b2efe68cd1623e15c2b36fd8a6a76e92365883b401a2771892222cf7096f7856fd36539aae2d7e036759dcd92659a80e75c5f4","ssdeep":"192:qeVD0bjI1M6QB+5jQH7ad0FqjVnNz8+gtfBUh1oeZ:qeC3AQBbad0EjLP4i1oeZ","tlshash":"98f1bfc002f9a1bcd57bfa9c42453e14e35ec112aad56efc40c83b4099c0b56e57ac8e","first_seen":"2026-09-26T23:58:51.308698Z","last_seen":"2026-09-26T23:58:51.308698Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1001,"timings":{"blocked":937,"dns":0,"connect":18,"send":0,"wait":19,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:48.716Z","timestamp":1790467068716,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dfzzhs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:39:12 GMT","end":"Thu, 19 Nov 2026 22:39:11 GMT"},"fingerprint":{"sha1":"5A:71:47:AB:A0:F5:A6:04:56:33:5B:E5:1C:89:E0:29:88:44:89:9E","sha256":"A8:7A:95:05:4C:E7:90:E9:13:57:58:BF:27:FD:E5:67:44:9E:17:B4:4F:09:BC:FF:2B:21:A3:22:81:A6:8C:60"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://dfzzhs.com/?skins/65392/Css/style.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr; __vtins__K9hAf3fFNdu885Sn=%7B%22sid%22%3A%20%2266946985-a068-5123-8088-30f42c1f812c%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201790467199999%2C%20%22ct%22%3A%201790467066355%7D; __51uvsct__K9hAf3fFNdu885Sn=1; __51vcke__K9hAf3fFNdu885Sn=5e8d8c22-b55b-5465-91ab-ec6b796594df; __51vuft__K9hAf3fFNdu885Sn=1790467066359\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:48 GMT\r\ncontent-type: text/html; charset=gbk\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":39014,"size_decoded":11146,"mime_type":"text/html; charset=gbk","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (803), with CRLF line terminators","md5":"57f2a1a6af51566b782f57d3bf9a6d5e","sha1":"5fae6e5f511678755a50a0f6a98d602419a2ea00","sha256":"427ac57fe13e260115146476165b8501029ef55bd0b214f6c881cf2368f89f3f","sha512":"8381154d530995ec25efe47ef5f9b5e0262b6572c9414b0a8d61121eb24c6cfacbaf8942ce313547053cbb436d40e96d46ca022e16ef5cd9d9a68f5ba7de6df7","ssdeep":"768:SZCO+gu55fi8L65EPDqOqluzLDf++K+HGzgrIku:SZCOXu55fi8L6Zuzn++JHqgrIn","tlshash":"d013b312c9d528260477a2d865b467aefda6d267a2538f4572fc2bcbdff2f508d03104","first_seen":"2026-09-26T23:58:51.310476Z","last_seen":"2026-09-26T23:58:51.310476Z","times_seen":1,"resource_available":true,"data":null}},"time_used":308,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?js/JSChat.js","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:45.972Z","timestamp":1790467065972,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dfzzhs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:39:12 GMT","end":"Thu, 19 Nov 2026 22:39:11 GMT"},"fingerprint":{"sha1":"5A:71:47:AB:A0:F5:A6:04:56:33:5B:E5:1C:89:E0:29:88:44:89:9E","sha256":"A8:7A:95:05:4C:E7:90:E9:13:57:58:BF:27:FD:E5:67:44:9E:17:B4:4F:09:BC:FF:2B:21:A3:22:81:A6:8C:60"}}},"request":{"raw":"GET /?js/JSChat.js HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:46 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\nlocation: http://www.daliguolv.com/js/JSChat.js\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":403,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":403,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?Skins/65392/images/qq1.png","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.192Z","timestamp":1790467066192,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?Skins/65392/images/qq1.png HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:47 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: http://www.daliguolv.com/Skins/65392/images/qq1.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.daliguolv.com/skins/65392/Images/logo.png","fqdn":"www.daliguolv.com","domain":"daliguolv.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.725Z","timestamp":1790467066725,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /skins/65392/Images/logo.png HTTP/1.1\r\nHost: www.daliguolv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/images/abg.jpg","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.221Z","timestamp":1790467067221,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dfzzhs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:39:12 GMT","end":"Thu, 19 Nov 2026 22:39:11 GMT"},"fingerprint":{"sha1":"5A:71:47:AB:A0:F5:A6:04:56:33:5B:E5:1C:89:E0:29:88:44:89:9E","sha256":"A8:7A:95:05:4C:E7:90:E9:13:57:58:BF:27:FD:E5:67:44:9E:17:B4:4F:09:BC:FF:2B:21:A3:22:81:A6:8C:60"}}},"request":{"raw":"GET /images/abg.jpg HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/?skins/65392/Css/style.css\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr; __vtins__K9hAf3fFNdu885Sn=%7B%22sid%22%3A%20%2266946985-a068-5123-8088-30f42c1f812c%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201790467199999%2C%20%22ct%22%3A%201790467066355%7D; __51uvsct__K9hAf3fFNdu885Sn=1; __51vcke__K9hAf3fFNdu885Sn=5e8d8c22-b55b-5465-91ab-ec6b796594df; __51vuft__K9hAf3fFNdu885Sn=1790467066359\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:47 GMT\r\ncontent-type: text/html\r\ncontent-length: 138\r\netag: \"6a03ff34-8a\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":138,"size_decoded":292,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7389d931c86b3d7bb6b8af46d8c4172b","sha1":"8d2a4760aa0b47984d11cd1a66448719177fb791","sha256":"301bd9f16f94feedfae7a946a14bac38cb73c43efe6117bc5586835af03d7d6f","sha512":"dd6d1511e4fcd5bc09d821ffe091fb5946ac9654c48664aed504e479e9ac20c1cad44b6df90f42190d47e28f5f96bfb09d24056df6b950243d68ee8100a9a889","ssdeep":"","tlshash":"d9c09b5d755366449913155167c33641d196837f689a84510941c593f0cf69ac4c73a9","first_seen":"2023-03-13T12:56:15Z","last_seen":"2026-09-27T01:35:45.991709Z","times_seen":332539,"resource_available":true,"data":null}},"time_used":244,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":244,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?Skins/65392/js/qq.js","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.169Z","timestamp":1790467066169,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dfzzhs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:39:12 GMT","end":"Thu, 19 Nov 2026 22:39:11 GMT"},"fingerprint":{"sha1":"5A:71:47:AB:A0:F5:A6:04:56:33:5B:E5:1C:89:E0:29:88:44:89:9E","sha256":"A8:7A:95:05:4C:E7:90:E9:13:57:58:BF:27:FD:E5:67:44:9E:17:B4:4F:09:BC:FF:2B:21:A3:22:81:A6:8C:60"}}},"request":{"raw":"GET /?Skins/65392/js/qq.js HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:46 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\nlocation: http://www.daliguolv.com/Skins/65392/js/qq.js\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":461,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":461,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?skins/65392/images/cf2.jpg","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.185Z","timestamp":1790467066185,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?skins/65392/images/cf2.jpg HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:46 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: http://www.daliguolv.com/skins/65392/images/cf2.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.daliguolv.com/skins/65392/images/nav_line.jpg","fqdn":"www.daliguolv.com","domain":"daliguolv.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.645Z","timestamp":1790467067645,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /skins/65392/images/nav_line.jpg HTTP/1.1\r\nHost: www.daliguolv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?index_cache.html","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:48.288Z","timestamp":1790467068288,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dfzzhs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:39:12 GMT","end":"Thu, 19 Nov 2026 22:39:11 GMT"},"fingerprint":{"sha1":"5A:71:47:AB:A0:F5:A6:04:56:33:5B:E5:1C:89:E0:29:88:44:89:9E","sha256":"A8:7A:95:05:4C:E7:90:E9:13:57:58:BF:27:FD:E5:67:44:9E:17:B4:4F:09:BC:FF:2B:21:A3:22:81:A6:8C:60"}}},"request":{"raw":"GET /?index_cache.html HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr; __vtins__K9hAf3fFNdu885Sn=%7B%22sid%22%3A%20%2266946985-a068-5123-8088-30f42c1f812c%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201790467199999%2C%20%22ct%22%3A%201790467066355%7D; __51uvsct__K9hAf3fFNdu885Sn=1; __51vcke__K9hAf3fFNdu885Sn=5e8d8c22-b55b-5465-91ab-ec6b796594df; __51vuft__K9hAf3fFNdu885Sn=1790467066359\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:48 GMT\r\ncontent-type: text/html; charset=gbk\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1874,"size_decoded":1355,"mime_type":"text/html; charset=gbk","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (753), with CRLF line terminators","md5":"14509b2ce0da01edd59e034a22d76315","sha1":"ecb78a89e069bf1bfc7b29a89e404f4a5198cc8a","sha256":"ba2872d8b392cd8e12356deb61575c1b8c85d0b54c6a824591d98c288ff772da","sha512":"a35909a5f2b138fc8da860fa5111b7b9061bdf014768c03b688e2ab1754983700e9a5fdb9fce3bd981accc29eb6f7af40a72601f7ee479c70c2d2c687f733bcd","ssdeep":"","tlshash":"d3410185959277490922c774f4a1e79acc2222c069f2f2a4a4a36e54adc073c96096cb","first_seen":"2026-09-26T23:58:51.312679Z","last_seen":"2026-09-26T23:58:51.312679Z","times_seen":1,"resource_available":true,"data":null}},"time_used":366,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":366,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"chat.zyzhan.com/chat/KFCenterBox/65392","fqdn":"chat.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"155.102.51.4","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.158Z","timestamp":1790467066158,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /chat/KFCenterBox/65392 HTTP/1.1\r\nHost: chat.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: ESA\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 49\r\nConnection: keep-alive\r\nSet-Cookie: acw_tc=9b66334c17904670662501612e237b2b0d5d9920aef111ac7b810f5e18;path=/;HttpOnly;Max-Age=3600\ncdn_sec_tc=9b66334c17904670662501612e237b2b0d5d9920aef111ac7b810f5e18;path=/;HttpOnly;Max-Age=3600\nASP.NET_SessionId=armv2ezhnabwukqeuq2n0oy0; path=/; HttpOnly; SameSite=Lax\nmtcached_mtsession_armv2ezhnabwukqeuq2n0oy0=10.115.3.125:9719; domain=chat.zyzhan.com; path=/; HttpOnly\r\nStrict-Transport-Security: max-age=15552000; includeSubDomains\r\nCache-Control: private\r\nDate: Sat, 26 Sep 2026 23:57:46 GMT\r\nvia: ens-cache31.l2eo166-17[59,0,DP], ens-cache21.de7[881,0,DP], ens-cache21.de7[887,0]\r\nx-site-cache-status: DYNAMIC\r\nX-AspNet-Version: 4.0.30319\r\nX-AspNetMvc-Version: 3.0\r\nX-Powered-By: ASP.NET-hg4.93\r\nContent-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval' data:;\r\nTiming-Allow-Origin: *\r\nEagleId: 9b66334c17904670662501612e\r\n\r\n","headers":null,"cookies":[{"name":"acw_tc","value":"9b66334c17904670662501612e237b2b0d5d9920aef111ac7b810f5e18","quoted":false,"path":"/","max_age":3600,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"acw_tc=9b66334c17904670662501612e237b2b0d5d9920aef111ac7b810f5e18;path=/;HttpOnly;Max-Age=3600"},{"name":"cdn_sec_tc","value":"9b66334c17904670662501612e237b2b0d5d9920aef111ac7b810f5e18","quoted":false,"path":"/","max_age":3600,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"cdn_sec_tc=9b66334c17904670662501612e237b2b0d5d9920aef111ac7b810f5e18;path=/;HttpOnly;Max-Age=3600"},{"name":"ASP.NET_SessionId","value":"armv2ezhnabwukqeuq2n0oy0","quoted":false,"path":"/","secure":false,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"ASP.NET_SessionId=armv2ezhnabwukqeuq2n0oy0; path=/; HttpOnly; SameSite=Lax"},{"name":"mtcached_mtsession_armv2ezhnabwukqeuq2n0oy0","value":"10.115.3.125:9719","quoted":false,"path":"/","domain":"chat.zyzhan.com","secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"mtcached_mtsession_armv2ezhnabwukqeuq2n0oy0=10.115.3.125:9719; domain=chat.zyzhan.com; path=/; HttpOnly"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":49,"size_decoded":1018,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with CRLF line terminators","md5":"b936460ba988b30cd79d99ae93c77106","sha1":"a44405ff5b67abf66ef77714e4364e6c3f1e9940","sha256":"6cd604b71e1e21050b6a41602716b9a722e769a5d7cfb3b97152f3d73dcef5c9","sha512":"ad4731faf916fbb7118af38e25fa7e15814294950676fbd4ec41aeba5c7508ed34b7a7a4c98e1834e1096ea92e6301935699ed6df01a7416632e39063c0c9661","ssdeep":"","tlshash":"3990023209b10052711510915943e1456595959129de9915a00004a572529539a06d51","first_seen":"2023-03-07T12:42:46Z","last_seen":"2026-09-26T23:58:51.313872Z","times_seen":731,"resource_available":true,"data":null}},"time_used":1014,"timings":{"blocked":-1,"dns":52,"connect":24,"send":0,"wait":911,"receive":0,"ssl":27},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"chat.zyzhan.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"collect-v6.51.la/v6/collect?dt=4","fqdn":"collect-v6.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"43.159.107.113","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.397Z","timestamp":1790467066397,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.51.la","organization":""},"issuer":{"commonName":"Keymatic Secure Domain RSA CA G1","organization":"PKI(Chongqing) Limited"},"validity":{"start":"Wed, 01 Apr 2026 06:48:26 GMT","end":"Fri, 16 Oct 2026 15:59:59 GMT"},"fingerprint":{"sha1":"F0:4F:0E:62:84:89:BD:2B:8E:53:1E:AC:20:70:16:C2:F7:E9:C1:C0","sha256":"54:9F:ED:D0:8F:D4:0A:5F:31:95:55:FD:E0:E6:13:F2:09:8C:39:E1:01:31:98:FA:1D:DC:20:CD:20:19:7C:F5"}}},"request":{"raw":"POST /v6/collect?dt=4 HTTP/1.1\r\nHost: collect-v6.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Length: 391\r\nOrigin: https://dfzzhs.com\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":564,"data":"\u001f‹\b\u0000ú[¸j\u0000\u0003…QËNÂ@\u0014ý\u0015Ó¥a¤-aÊ΍\u001b\u00137Ä\u000f€–Š\u0001\n¡\u0014\u0012Œ\u001b¢ò\u0010\u0001#1*¸Ð\u0015j4QA\u0001ů郮ü\u0005{ËÃč»{Ï9÷̝s÷˜]™\t­0›b|]\t(\u001b[²N)\u000e«Œo…Éæ\\†\u000bŠ¬@‚,!\u0001Œ]0\u0007 “J\u0018“³iéÅn\u000fÌǖoњ½gcԂÙDá_Ùoۙ8—‡ËÖª\u001e[ݱ=9un\u0006vµ\u0002n²\u0006nf·g·{VåÝÕ9÷uë|ä\\ß~֗ƒ¯=§|b\u001cMk%\u0017ž–ûf­cŒ\u001bÆpl7î̧7«Ù2¾:ÎÃÅ´ï*›öՁ5\u001c‚¿6\u000b\u0010Q \"Å(Â\u0012Š0Ç\u0007\u0010e)E\u0001V\u0011x‰S(ÇK —tPÇs¹Œ\u0016òûe¥XŒkkR:å\u00072ã‘^~I¨8ž²«\u001cË\u000b\u0000%#ê\u000e€1\u0015m‡=+/N]M¨é‚·I\u001e6ဉ-\n@x\u0001H/|\u0016\u0002ÉÎ\u000b=¯Is\u003eû\u0004ŽQ™J\u003c¢\u0018G\u0011\u0016\bF\"\u0017‰¢˜D¢A‘`Q\u0015xIWþžWÜÿ\u0001\u0006‚¥\u001e\u000e\u0002\u0000\u0000"}},"response":{"raw":"HTTP/2 210 \r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://dfzzhs.com\r\naccess-control-allow-credentials: true\r\nserver: TencentEdgeOne\r\ncontent-length: 0\r\ndate: Sat, 26 Sep 2026 23:57:46 GMT\r\neo-log-uuid: 11312309614034002504\r\neo-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"210","status_text":"","fingerprints":[{"name":"EdgeOne","description":"EdgeOne is an edge-service platform that delivers global content distribution, network acceleration, and integrated security protections for distributed applications.","website":"https://edgeone.ai","common_platform_enumeration":"","icon":"EdgeOne.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":1233,"mime_type":"text/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":308,"timings":{"blocked":-1,"dns":4,"connect":21,"send":0,"wait":304,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.daliguolv.com/skins/65392/images/cf1.jpg","fqdn":"www.daliguolv.com","domain":"daliguolv.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.585Z","timestamp":1790467066585,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /skins/65392/images/cf1.jpg HTTP/1.1\r\nHost: www.daliguolv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.daliguolv.com/skins/65392/images/cf3.jpg","fqdn":"www.daliguolv.com","domain":"daliguolv.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.757Z","timestamp":1790467066757,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /skins/65392/images/cf3.jpg HTTP/1.1\r\nHost: www.daliguolv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?Skins/65392/js/qq.js","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.198Z","timestamp":1790467067198,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dfzzhs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:39:12 GMT","end":"Thu, 19 Nov 2026 22:39:11 GMT"},"fingerprint":{"sha1":"5A:71:47:AB:A0:F5:A6:04:56:33:5B:E5:1C:89:E0:29:88:44:89:9E","sha256":"A8:7A:95:05:4C:E7:90:E9:13:57:58:BF:27:FD:E5:67:44:9E:17:B4:4F:09:BC:FF:2B:21:A3:22:81:A6:8C:60"}}},"request":{"raw":"GET /?Skins/65392/js/qq.js HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr; __vtins__K9hAf3fFNdu885Sn=%7B%22sid%22%3A%20%2266946985-a068-5123-8088-30f42c1f812c%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201790467199999%2C%20%22ct%22%3A%201790467066355%7D; __51uvsct__K9hAf3fFNdu885Sn=1; __51vcke__K9hAf3fFNdu885Sn=5e8d8c22-b55b-5465-91ab-ec6b796594df; __51vuft__K9hAf3fFNdu885Sn=1790467066359\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:47 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\nlocation: http://www.daliguolv.com/Skins/65392/js/qq.js\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":610,"timings":{"blocked":5,"dns":0,"connect":0,"send":0,"wait":605,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?skins/65392/images/banner3.jpg","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.216Z","timestamp":1790467067216,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?skins/65392/images/banner3.jpg HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr; __vtins__K9hAf3fFNdu885Sn=%7B%22sid%22%3A%20%2266946985-a068-5123-8088-30f42c1f812c%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201790467199999%2C%20%22ct%22%3A%201790467066355%7D; __51uvsct__K9hAf3fFNdu885Sn=1; __51vcke__K9hAf3fFNdu885Sn=5e8d8c22-b55b-5465-91ab-ec6b796594df; __51vuft__K9hAf3fFNdu885Sn=1790467066359\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:48 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: http://www.daliguolv.com/skins/65392/images/banner3.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/images/arrows2.png","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.217Z","timestamp":1790467067217,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dfzzhs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:39:12 GMT","end":"Thu, 19 Nov 2026 22:39:11 GMT"},"fingerprint":{"sha1":"5A:71:47:AB:A0:F5:A6:04:56:33:5B:E5:1C:89:E0:29:88:44:89:9E","sha256":"A8:7A:95:05:4C:E7:90:E9:13:57:58:BF:27:FD:E5:67:44:9E:17:B4:4F:09:BC:FF:2B:21:A3:22:81:A6:8C:60"}}},"request":{"raw":"GET /images/arrows2.png HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/?skins/65392/Css/style.css\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr; __vtins__K9hAf3fFNdu885Sn=%7B%22sid%22%3A%20%2266946985-a068-5123-8088-30f42c1f812c%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201790467199999%2C%20%22ct%22%3A%201790467066355%7D; __51uvsct__K9hAf3fFNdu885Sn=1; __51vcke__K9hAf3fFNdu885Sn=5e8d8c22-b55b-5465-91ab-ec6b796594df; __51vuft__K9hAf3fFNdu885Sn=1790467066359\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:47 GMT\r\ncontent-type: text/html\r\ncontent-length: 138\r\netag: \"6a03ff34-8a\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":138,"size_decoded":292,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7389d931c86b3d7bb6b8af46d8c4172b","sha1":"8d2a4760aa0b47984d11cd1a66448719177fb791","sha256":"301bd9f16f94feedfae7a946a14bac38cb73c43efe6117bc5586835af03d7d6f","sha512":"dd6d1511e4fcd5bc09d821ffe091fb5946ac9654c48664aed504e479e9ac20c1cad44b6df90f42190d47e28f5f96bfb09d24056df6b950243d68ee8100a9a889","ssdeep":"","tlshash":"d9c09b5d755366449913155167c33641d196837f689a84510941c593f0cf69ac4c73a9","first_seen":"2023-03-13T12:56:15Z","last_seen":"2026-09-27T01:35:45.991709Z","times_seen":332539,"resource_available":true,"data":null}},"time_used":244,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":244,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/images/arrows1.png","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.218Z","timestamp":1790467067218,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dfzzhs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:39:12 GMT","end":"Thu, 19 Nov 2026 22:39:11 GMT"},"fingerprint":{"sha1":"5A:71:47:AB:A0:F5:A6:04:56:33:5B:E5:1C:89:E0:29:88:44:89:9E","sha256":"A8:7A:95:05:4C:E7:90:E9:13:57:58:BF:27:FD:E5:67:44:9E:17:B4:4F:09:BC:FF:2B:21:A3:22:81:A6:8C:60"}}},"request":{"raw":"GET /images/arrows1.png HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/?skins/65392/Css/style.css\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr; __vtins__K9hAf3fFNdu885Sn=%7B%22sid%22%3A%20%2266946985-a068-5123-8088-30f42c1f812c%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201790467199999%2C%20%22ct%22%3A%201790467066355%7D; __51uvsct__K9hAf3fFNdu885Sn=1; __51vcke__K9hAf3fFNdu885Sn=5e8d8c22-b55b-5465-91ab-ec6b796594df; __51vuft__K9hAf3fFNdu885Sn=1790467066359\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:47 GMT\r\ncontent-type: text/html\r\ncontent-length: 138\r\netag: \"6a03ff34-8a\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":138,"size_decoded":292,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7389d931c86b3d7bb6b8af46d8c4172b","sha1":"8d2a4760aa0b47984d11cd1a66448719177fb791","sha256":"301bd9f16f94feedfae7a946a14bac38cb73c43efe6117bc5586835af03d7d6f","sha512":"dd6d1511e4fcd5bc09d821ffe091fb5946ac9654c48664aed504e479e9ac20c1cad44b6df90f42190d47e28f5f96bfb09d24056df6b950243d68ee8100a9a889","ssdeep":"","tlshash":"d9c09b5d755366449913155167c33641d196837f689a84510941c593f0cf69ac4c73a9","first_seen":"2023-03-13T12:56:15Z","last_seen":"2026-09-27T01:35:45.991709Z","times_seen":332539,"resource_available":true,"data":null}},"time_used":244,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":244,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zyzhan.com/mystat.aspx?u=hzdarlly","fqdn":"www.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"163.181.131.237","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.162Z","timestamp":1790467066162,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /mystat.aspx?u=hzdarlly HTTP/1.1\r\nHost: www.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ESA\r\ncontent-type: text/html; charset=utf-8\r\nset-cookie: acw_tc=a3b5839517904670662311056eab3592825262fb1ab2f96e6b93935449;path=/;HttpOnly;Max-Age=3600\ncdn_sec_tc=a3b5839517904670662311056eab3592825262fb1ab2f96e6b93935449;path=/;HttpOnly;Max-Age=3600\nASP.NET_SessionId=z3k0i4bwmro5ao1fsc1wniiv; path=/; HttpOnly; SameSite=Lax\nmtcached_mtsession_z3k0i4bwmro5ao1fsc1wniiv=10.115.3.123:9720; domain=.zyzhan.com; path=/; HttpOnly\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\ncache-control: no-cache\r\ncontent-encoding: gzip\r\ndate: Sat, 26 Sep 2026 23:57:46 GMT\r\nexpires: -1\r\nvary: Accept-Encoding\r\nvia: ens-cache9.l2eo166-17[43,0,DP], ens-cache3.l2de3[296,0,DP], ens-cache1.de7[298,0,DP], ens-cache1.de7[299,0]\r\nx-site-cache-status: DYNAMIC\r\npragma: no-cache\r\nx-aspnet-version: 4.0.30319\r\nx-powered-by: ASP.NET-4.93\r\ntiming-allow-origin: *\r\neagleid: a3b5839517904670662311056e\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"acw_tc","value":"a3b5839517904670662311056eab3592825262fb1ab2f96e6b93935449","quoted":false,"path":"/","max_age":3600,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"acw_tc=a3b5839517904670662311056eab3592825262fb1ab2f96e6b93935449;path=/;HttpOnly;Max-Age=3600"},{"name":"cdn_sec_tc","value":"a3b5839517904670662311056eab3592825262fb1ab2f96e6b93935449","quoted":false,"path":"/","max_age":3600,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"cdn_sec_tc=a3b5839517904670662311056eab3592825262fb1ab2f96e6b93935449;path=/;HttpOnly;Max-Age=3600"},{"name":"ASP.NET_SessionId","value":"z3k0i4bwmro5ao1fsc1wniiv","quoted":false,"path":"/","secure":false,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"ASP.NET_SessionId=z3k0i4bwmro5ao1fsc1wniiv; path=/; HttpOnly; SameSite=Lax"},{"name":"mtcached_mtsession_z3k0i4bwmro5ao1fsc1wniiv","value":"10.115.3.123:9720","quoted":false,"path":"/","domain":".zyzhan.com","secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"mtcached_mtsession_z3k0i4bwmro5ao1fsc1wniiv=10.115.3.123:9720; domain=.zyzhan.com; path=/; HttpOnly"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1359,"size_decoded":1547,"mime_type":"text/html; charset=utf-8","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"8f311c9425c7985e87d5bcd3ffb95870","sha1":"cae5fa6a6b81a12c396e80afe7702037bf607a56","sha256":"6e54cd62d0b73204a39b89be4550f385d949a73559db6103acc04f2cdb5af8c1","sha512":"670e40397d5df9372a5c226d1b8daed7e752dbbbca8db46d9585514171ef2942e0ad4f24b519476a315dc884f52f9c6d3dac6413ae172ea4dc9866741ce72e83","ssdeep":"","tlshash":"a5214d541d06c0a4bc36713d89bbc13cd2a51a273865d73678cca9084f78fa525deeea","first_seen":"2026-09-26T23:58:51.314458Z","last_seen":"2026-09-26T23:58:51.314458Z","times_seen":1,"resource_available":true,"data":null}},"time_used":403,"timings":{"blocked":-1,"dns":29,"connect":22,"send":0,"wait":323,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"www.zyzhan.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?js/JSChat.js","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.513Z","timestamp":1790467066513,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dfzzhs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:39:12 GMT","end":"Thu, 19 Nov 2026 22:39:11 GMT"},"fingerprint":{"sha1":"5A:71:47:AB:A0:F5:A6:04:56:33:5B:E5:1C:89:E0:29:88:44:89:9E","sha256":"A8:7A:95:05:4C:E7:90:E9:13:57:58:BF:27:FD:E5:67:44:9E:17:B4:4F:09:BC:FF:2B:21:A3:22:81:A6:8C:60"}}},"request":{"raw":"GET /?js/JSChat.js HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr; __vtins__K9hAf3fFNdu885Sn=%7B%22sid%22%3A%20%2266946985-a068-5123-8088-30f42c1f812c%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201790467199999%2C%20%22ct%22%3A%201790467066355%7D; __51uvsct__K9hAf3fFNdu885Sn=1; __51vcke__K9hAf3fFNdu885Sn=5e8d8c22-b55b-5465-91ab-ec6b796594df; __51vuft__K9hAf3fFNdu885Sn=1790467066359\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:46 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\nlocation: http://www.daliguolv.com/js/JSChat.js\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":538,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":538,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.daliguolv.com/Skins/65392/images/fax.png","fqdn":"www.daliguolv.com","domain":"daliguolv.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.896Z","timestamp":1790467066896,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /Skins/65392/images/fax.png HTTP/1.1\r\nHost: www.daliguolv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?skins/65392/images/banner1.jpg","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.212Z","timestamp":1790467067212,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?skins/65392/images/banner1.jpg HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr; __vtins__K9hAf3fFNdu885Sn=%7B%22sid%22%3A%20%2266946985-a068-5123-8088-30f42c1f812c%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201790467199999%2C%20%22ct%22%3A%201790467066355%7D; __51uvsct__K9hAf3fFNdu885Sn=1; __51vcke__K9hAf3fFNdu885Sn=5e8d8c22-b55b-5465-91ab-ec6b796594df; __51vuft__K9hAf3fFNdu885Sn=1790467066359\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:47 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: http://www.daliguolv.com/skins/65392/images/banner1.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?skins/65392/images/fx.png","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.224Z","timestamp":1790467067224,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?skins/65392/images/fx.png HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/?skins/65392/Css/style.css\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr; __vtins__K9hAf3fFNdu885Sn=%7B%22sid%22%3A%20%2266946985-a068-5123-8088-30f42c1f812c%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201790467199999%2C%20%22ct%22%3A%201790467066355%7D; __51uvsct__K9hAf3fFNdu885Sn=1; __51vcke__K9hAf3fFNdu885Sn=5e8d8c22-b55b-5465-91ab-ec6b796594df; __51vuft__K9hAf3fFNdu885Sn=1790467066359\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:47 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: http://www.daliguolv.com/skins/65392/images/fx.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.daliguolv.com/Skins/65392/images/qq1.png","fqdn":"www.daliguolv.com","domain":"daliguolv.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.306Z","timestamp":1790467067306,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /Skins/65392/images/qq1.png HTTP/1.1\r\nHost: www.daliguolv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.daliguolv.com/skins/65392/images/fx.png","fqdn":"www.daliguolv.com","domain":"daliguolv.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.597Z","timestamp":1790467067597,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /skins/65392/images/fx.png HTTP/1.1\r\nHost: www.daliguolv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.daliguolv.com/skins/65392/images/cf4.jpg","fqdn":"www.daliguolv.com","domain":"daliguolv.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.879Z","timestamp":1790467067879,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /skins/65392/images/cf4.jpg HTTP/1.1\r\nHost: www.daliguolv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img67.zyzhan.com/gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf375a2f5b1d94ab32e48b03717ed5dcf3ce32599eba0421de17_284_284_5.jpg","fqdn":"img67.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.216Z","timestamp":1790467066216,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf375a2f5b1d94ab32e48b03717ed5dcf3ce32599eba0421de17_284_284_5.jpg HTTP/1.1\r\nHost: img67.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public\r\ncontent-disposition: inline;filename=637939110605181789609.jpg\r\ncontent-type: image/webp\r\ndate: Sat, 26 Sep 2026 00:57:36 GMT\r\netag: \"1790384257\"\r\nexpires: Sun, 26 Sep 2027 00:57:36 GMT\r\nlast-modified: Sat, 26 Sep 2026 02:53:20 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-aspnet-version: 4.0.30319\r\nx-cache: HIT, server, disk\r\nx-powered-by: ASP.NET-img67\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9742,"size_decoded":10240,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 284x284, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"91a1f7521087d2b49f6f7a2e4869d9ee","sha1":"68c5c95531d4cc8fb48c069ed04892eba4336dd4","sha256":"9069de30dbf87221c8d93d3cf567fd645147b18d3a5ab14aaf39a51d7f89e08a","sha512":"cc9b92efb1ed6e8a9ac14266b0d70ee97d48cd8a7571f8b5bbc8c304d01ce90377c9cf5a7c09abd05c83f24748760b5107fc18c4def5b710f765c7dc4eb96219","ssdeep":"192:aK3rf5dpUwYH3rvyTgRGnb0Bz9oVewh7gxTudwkrd0ZjCJc1AOTs0rq:h3rT6wYHonuWhh8x8CZ2Jc1AOTs0rq","tlshash":"6112af4646c27833447f03f63d3d1da27499b8f02b0a235a3256df54258df7a31d85ca","first_seen":"2026-09-26T23:58:51.315983Z","last_seen":"2026-09-26T23:58:51.315983Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1029,"timings":{"blocked":949,"dns":0,"connect":24,"send":0,"wait":18,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?Skins/65392/images/email.png","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.193Z","timestamp":1790467066193,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?Skins/65392/images/email.png HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:47 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: http://www.daliguolv.com/Skins/65392/images/email.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img65.zyzhan.com/gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf37e2d14a3f0f8b641fde69ea2d673f136807455619989346ee_284_284_5.jpg","fqdn":"img65.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.224Z","timestamp":1790467066224,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf37e2d14a3f0f8b641fde69ea2d673f136807455619989346ee_284_284_5.jpg HTTP/1.1\r\nHost: img65.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public\r\ncontent-disposition: inline;filename=637939108625326063844.jpg\r\ncontent-type: image/webp\r\ndate: Sat, 26 Sep 2026 00:57:38 GMT\r\netag: \"1790384259\"\r\nexpires: Sun, 26 Sep 2027 00:57:38 GMT\r\nlast-modified: Sat, 26 Sep 2026 02:53:23 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-aspnet-version: 4.0.30319\r\nx-cache: HIT, server, disk\r\nx-powered-by: ASP.NET-img65\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9594,"size_decoded":10092,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 284x284, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"cdf4031588aaced9786d9551af94c481","sha1":"5d871da229bfde9a45a6438730bbcc41ac9f849e","sha256":"b44ac54b27154583afc5a6c86c4e9b55b47bdead4241354e72e1510f1bf8db42","sha512":"7590448f52000b44502ab25e40cb1714e7325234382ee863a6f1b16a319feaf7d03ca5dfa2981548208442c2cefed73ebe03b4f0e9b3b5989413efc258de72b7","ssdeep":"192:NTTbTWHq6kP+64N8k6yquRYoLI9Dol3IN4qU+UAsdTb4Rycad0:9TWHq6G+lfXNz3IN4qU8sdXeycad0","tlshash":"0212c0a1856b714a2acbc1378979893f66970697f5a0d834e3b38cb371d5043885e09b","first_seen":"2026-09-26T23:58:51.317832Z","last_seen":"2026-09-26T23:58:51.317832Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1020,"timings":{"blocked":936,"dns":0,"connect":23,"send":0,"wait":20,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?skins/65392/images/ariblk.ttf","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.230Z","timestamp":1790467067230,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dfzzhs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:39:12 GMT","end":"Thu, 19 Nov 2026 22:39:11 GMT"},"fingerprint":{"sha1":"5A:71:47:AB:A0:F5:A6:04:56:33:5B:E5:1C:89:E0:29:88:44:89:9E","sha256":"A8:7A:95:05:4C:E7:90:E9:13:57:58:BF:27:FD:E5:67:44:9E:17:B4:4F:09:BC:FF:2B:21:A3:22:81:A6:8C:60"}}},"request":{"raw":"GET /?skins/65392/images/ariblk.ttf HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/?skins/65392/Css/style.css\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr; __vtins__K9hAf3fFNdu885Sn=%7B%22sid%22%3A%20%2266946985-a068-5123-8088-30f42c1f812c%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201790467199999%2C%20%22ct%22%3A%201790467066355%7D; __51uvsct__K9hAf3fFNdu885Sn=1; __51vcke__K9hAf3fFNdu885Sn=5e8d8c22-b55b-5465-91ab-ec6b796594df; __51vuft__K9hAf3fFNdu885Sn=1790467066359\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:48 GMT\r\ncontent-type: text/html; charset=gbk\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nlocation: /\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=gbk","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":1482,"timings":{"blocked":3,"dns":0,"connect":0,"send":0,"wait":1479,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?skins/65392/images/cf4.jpg","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.187Z","timestamp":1790467066187,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?skins/65392/images/cf4.jpg HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:47 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: http://www.daliguolv.com/skins/65392/images/cf4.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img65.zyzhan.com/gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf37558febbab43057d7d9f11c76c4ab9fdfeb3d36e32789b9c2_284_284_5.jpg","fqdn":"img65.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.234Z","timestamp":1790467066234,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf37558febbab43057d7d9f11c76c4ab9fdfeb3d36e32789b9c2_284_284_5.jpg HTTP/1.1\r\nHost: img65.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public\r\ncontent-disposition: inline;filename=637939108613294596976.jpg\r\ncontent-type: image/webp\r\ndate: Sat, 26 Sep 2026 00:57:40 GMT\r\netag: \"1790384261\"\r\nexpires: Sun, 26 Sep 2027 00:57:40 GMT\r\nlast-modified: Sat, 26 Sep 2026 02:53:25 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-aspnet-version: 4.0.30319\r\nx-cache: HIT, server, disk\r\nx-powered-by: ASP.NET-img65\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11316,"size_decoded":11814,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 284x284, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"acb3b76ad16061a1ac33b0e8e5ba294c","sha1":"075720727b1d30f6734cf2ff41b746c2cba1ca63","sha256":"541b488936f44b61d2aefbf9daa6b16c733ac3dc0d0ed53b8a00573e8ed2688d","sha512":"8ae2f59921cfce79d5567fc2142aedbba90149b4e7f640579d6c144579556c62a8c5804f78878addce8423dbec82db136dffd85f3b9c9023293c55671c1a0956","ssdeep":"192:DOMRF9Tg75pBWsr+63TD4EXoWSKTVuR/78By35NA/1HgPd3IVpkRUwNHlg:6y5sr+Ef4cXRTVK8BrAPdaKRU/","tlshash":"de32d06abf7b797c498051ed2edd20e39295ad8290013049d4d2fcf1d44e790aaec18c","first_seen":"2026-09-26T23:58:51.319781Z","last_seen":"2026-09-26T23:58:51.319781Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1028,"timings":{"blocked":933,"dns":0,"connect":24,"send":0,"wait":31,"receive":0,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.kq52h5.com/","fqdn":"www.kq52h5.com","domain":"kq52h5.com","tld":"com"},"ip":{"addr":"207.57.81.8","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.247Z","timestamp":1790467066247,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kq52h5.com","organization":""},"issuer":{"commonName":"ZeroSSL RSA DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Fri, 04 Sep 2026 00:00:00 GMT","end":"Thu, 03 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"DC:8A:49:77:66:2B:4F:55:F3:7C:0A:72:A2:C2:72:1C:9A:13:D7:34","sha256":"FA:0F:2F:C6:97:C2:3E:2D:9E:84:23:7D:B8:7C:6B:B2:CA:23:9B:22:FF:A7:7D:B7:32:EE:E1:39:76:6B:35:E9"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.kq52h5.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html; charset=utf-8\r\ndate: Sat, 26 Sep 2026 23:57:47 GMT\r\nserver: Bobby'Server\r\ncontent-length: 159\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":null,"data":{"size":159,"size_decoded":314,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"07f36d44d48e2d2cf2d780aa6495f804","sha1":"3e90020ec732a1bbb0cd23e949266f81c98f7624","sha256":"8caff164cd30f36a8f13fcc423a5500a8fce33ce603883090d91f3c085700f8a","sha512":"e7c713b2eeac20e9178f8ee66245de1deff5de391e764e19823351be4911aeb44207b85c336925518f78e5ae78ba6bc93eaf556571e1d79f2ce89c4ae1ddbd57","ssdeep":"","tlshash":"a2c08c26381e2c0c97a321ba16c36ea0d182c330895e19008780025730cb0168ac3729","first_seen":"2024-08-21T12:55:46.175776Z","last_seen":"2026-09-26T23:58:51.321223Z","times_seen":14428,"resource_available":true,"data":null}},"time_used":1521,"timings":{"blocked":-1,"dns":619,"connect":295,"send":0,"wait":295,"receive":0,"ssl":311},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"www.kq52h5.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"www.kq52h5.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?skins/65392/images/nav_line.jpg","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.210Z","timestamp":1790467067210,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?skins/65392/images/nav_line.jpg HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/?skins/65392/Css/style.css\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr; __vtins__K9hAf3fFNdu885Sn=%7B%22sid%22%3A%20%2266946985-a068-5123-8088-30f42c1f812c%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201790467199999%2C%20%22ct%22%3A%201790467066355%7D; __51uvsct__K9hAf3fFNdu885Sn=1; __51vcke__K9hAf3fFNdu885Sn=5e8d8c22-b55b-5465-91ab-ec6b796594df; __51vuft__K9hAf3fFNdu885Sn=1790467066359\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:47 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: http://www.daliguolv.com/skins/65392/images/nav_line.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.daliguolv.com/skins/65392/images/aCont.png","fqdn":"www.daliguolv.com","domain":"daliguolv.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:48.012Z","timestamp":1790467068012,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /skins/65392/images/aCont.png HTTP/1.1\r\nHost: www.daliguolv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/aa.js","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:45.966Z","timestamp":1790467065966,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dfzzhs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:39:12 GMT","end":"Thu, 19 Nov 2026 22:39:11 GMT"},"fingerprint":{"sha1":"5A:71:47:AB:A0:F5:A6:04:56:33:5B:E5:1C:89:E0:29:88:44:89:9E","sha256":"A8:7A:95:05:4C:E7:90:E9:13:57:58:BF:27:FD:E5:67:44:9E:17:B4:4F:09:BC:FF:2B:21:A3:22:81:A6:8C:60"}}},"request":{"raw":"GET /aa.js HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:46 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sat, 22 Aug 2026 07:35:39 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a89514b-475\"\r\nexpires: Sun, 27 Sep 2026 11:57:46 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1141,"size_decoded":1033,"mime_type":"application/javascript","magic":"HTML document, ASCII text, with very long lines (554)","md5":"473be5b01830538ec698a5c3fdaff81b","sha1":"c76d6a589dbd83903f16a4b34ae1b0790d35864d","sha256":"09a72861941c456470f8c4c2f75a0fbb7ba47f4808404e4eb8fdf1b99f6c0085","sha512":"ce298d0760c84c99d13af92fcd1e902ecfffb06a9f6a78939634f3f7d3b7aef00c329862552ad86708bd53804add20e145b40d8bee40153db86c92591cfc4304","ssdeep":"","tlshash":"6f21cb766c13f1280224a478b275caac65ad8034eb06ca1145eed86e585cfec0829d8c","first_seen":"2026-08-25T06:07:06.152626Z","last_seen":"2026-09-26T23:58:51.321881Z","times_seen":6,"resource_available":true,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?Skins/65392/images/ewm.jpg","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.196Z","timestamp":1790467066196,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?Skins/65392/images/ewm.jpg HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:47 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: http://www.daliguolv.com/Skins/65392/images/ewm.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img67.zyzhan.com/gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf374648254efba785a22ea1d302248ff3231bc4475b55626918_284_284_5.jpg","fqdn":"img67.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.212Z","timestamp":1790467066212,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf374648254efba785a22ea1d302248ff3231bc4475b55626918_284_284_5.jpg HTTP/1.1\r\nHost: img67.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public\r\ncontent-disposition: inline;filename=637939110592212917314.jpg\r\ncontent-type: image/webp\r\ndate: Sat, 26 Sep 2026 00:57:36 GMT\r\netag: \"1790384256\"\r\nexpires: Sun, 26 Sep 2027 00:57:36 GMT\r\nlast-modified: Sat, 26 Sep 2026 02:53:19 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-aspnet-version: 4.0.30319\r\nx-cache: HIT, server, disk\r\nx-powered-by: ASP.NET-img67\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6944,"size_decoded":7442,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 284x284, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f7c4f4d2befaf9aa40786917fff96e97","sha1":"b2217ba00e2e6e071a157cf3fae5ca77c19b6419","sha256":"6c448d7f07cb57b0c426eb1d2ed84e979533d9fa61c69482f0d9311d37620e05","sha512":"79b60ea7eed79660e4926bace9452032b24a249b2a34a507926837c7501a8cd03c0b448a5cf496b9cfa6da4a8bda2e0c0def4fd81776d2913a2f8abfb6f5b114","ssdeep":"192:gPTOGcj6l6Wzyjrtwlzwt1CuwwpX+qkrr:2cjv6y1u0t1RPOqqr","tlshash":"b6e1afcaa338a2ab464d6587f5109044195388f5b1c9bda37be002e5b097a2fe27544d","first_seen":"2026-09-26T23:58:51.322516Z","last_seen":"2026-09-26T23:58:51.322516Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1016,"timings":{"blocked":953,"dns":0,"connect":18,"send":0,"wait":18,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img68.zyzhan.com/gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf371e341343b61ce07099c3924dd503c7ee8fce63c09d8dd48e_284_284_5.jpg","fqdn":"img68.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.227Z","timestamp":1790467066227,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf371e341343b61ce07099c3924dd503c7ee8fce63c09d8dd48e_284_284_5.jpg HTTP/1.1\r\nHost: img68.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public\r\ncontent-disposition: inline;filename=637939107210169925990.jpg\r\ncontent-type: image/webp\r\ndate: Sat, 26 Sep 2026 00:57:38 GMT\r\netag: \"1790384259_webp\"\r\nexpires: Sun, 26 Sep 2027 00:57:38 GMT\r\nlast-modified: Sat, 26 Sep 2026 00:57:39 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-aspnet-version: 4.0.30319\r\nx-cache: HIT, server, disk\r\nx-powered-by: ASP.NET-img68\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7320,"size_decoded":7823,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 284x284, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c51824c53337ddc1204b53048bf39207","sha1":"762c283393a8df127984490a8be51fc0d07c1557","sha256":"e137a875ba60c996a20cf8c23556fe84b42e98ccf521cdd92f1254dc24140228","sha512":"f7b9b71ef5b6238fd96c4ebb23e0f2d88fe4c5d56e4c3a02c7bcfdafc5aebdcba1ffb779f9a81fa208ef13217cb8d2fcd3d95c8097afd649e3ca17354f5872a5","ssdeep":"192:3yTeoYrEUsxTXi7WyzSGA/yyxEgDK0poXO:3w9Usxe7WyeGOxQJXO","tlshash":"61e19ea5d5fe217b3285b73504206528907e0cb20f22463beeea3abe5d54623ec5478d","first_seen":"2026-09-26T23:58:51.324213Z","last_seen":"2026-09-26T23:58:51.324213Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1036,"timings":{"blocked":935,"dns":0,"connect":24,"send":0,"wait":30,"receive":0,"ssl":35},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img68.zyzhan.com/gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf377b2cc051aa605a9d57f57741bc45aa01fd8414f493252d19_284_284_5.jpg","fqdn":"img68.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.233Z","timestamp":1790467066233,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf377b2cc051aa605a9d57f57741bc45aa01fd8414f493252d19_284_284_5.jpg HTTP/1.1\r\nHost: img68.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public\r\ncontent-disposition: inline;filename=637939107201888496742.jpg\r\ncontent-type: image/webp\r\ndate: Sat, 26 Sep 2026 00:57:41 GMT\r\netag: \"1790384261\"\r\nexpires: Sun, 26 Sep 2027 00:57:41 GMT\r\nlast-modified: Sat, 26 Sep 2026 02:53:27 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-aspnet-version: 4.0.30319\r\nx-cache: HIT, server, disk\r\nx-powered-by: ASP.NET-img68\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4426,"size_decoded":4924,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 284x284, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f9ca1da50b09ca19b6551e0b48e416d3","sha1":"e804ae26d0fa5ca76be099f998f46468f1669926","sha256":"6d8df03b140fa4aa0630a488c05537e17cd84b07353eaa3b8ac6700f1f2a2988","sha512":"8de7c1503f640c5d82690ce8c9d4887a1609cbacedaab8ad61a791dda505ea08c21a2a19f0f4bba7237b9c165ae5fe10da125c74275e25acbce73e2c52242344","ssdeep":"96:xtMFqDc7A20ozrjdv013u7RfFeWIM3mORjjNqogwrflBX86Fm:xtluA27rN013Af/gOFZffldV4","tlshash":"86916b88526f525ec9abb1a3cc222e4c7fa36b0087fde50f3554593f5165368a28cd9c","first_seen":"2026-09-26T23:58:51.325679Z","last_seen":"2026-09-26T23:58:51.325679Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1025,"timings":{"blocked":934,"dns":0,"connect":22,"send":0,"wait":28,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.zyzhan.com/asyncstat.aspx?u=hzdarlly\u0026referer=\u0026title=mk%u4F53%u80B2%u7535%u5B50%2Cmk%u4F53%u80B2%u5A31%u4E50","fqdn":"www.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"163.181.131.237","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.194Z","timestamp":1790467067194,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /asyncstat.aspx?u=hzdarlly\u0026referer=\u0026title=mk%u4F53%u80B2%u7535%u5B50%2Cmk%u4F53%u80B2%u5A31%u4E50 HTTP/1.1\r\nHost: www.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: acw_tc=a3b5839517904670662311056eab3592825262fb1ab2f96e6b93935449; cdn_sec_tc=a3b5839517904670662311056eab3592825262fb1ab2f96e6b93935449; mtcached_mtsession_z3k0i4bwmro5ao1fsc1wniiv=10.115.3.123:9720\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ESA\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 512\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\ncache-control: no-cache\r\ndate: Sat, 26 Sep 2026 23:57:47 GMT\r\nexpires: -1\r\nset-cookie: ASP.NET_SessionId=usirydqiclkfr0vcb34f4ncg; path=/; HttpOnly; SameSite=Lax\nmtcached_mtsession_usirydqiclkfr0vcb34f4ncg=10.115.3.121:9711; domain=.zyzhan.com; path=/; HttpOnly\r\nvia: ens-cache23.l2eo166-17[38,0,DP], ens-cache17.l2de3[289,0,DP], ens-cache1.de7[292,0,DP], ens-cache1.de7[293,0]\r\nx-site-cache-status: DYNAMIC\r\npragma: no-cache\r\nx-aspnet-version: 4.0.30319\r\nx-powered-by: ASP.NET-4.94\r\ntiming-allow-origin: *\r\neagleid: a3b5839517904670671821260e\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"ASP.NET_SessionId","value":"usirydqiclkfr0vcb34f4ncg","quoted":false,"path":"/","secure":false,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"ASP.NET_SessionId=usirydqiclkfr0vcb34f4ncg; path=/; HttpOnly; SameSite=Lax"},{"name":"mtcached_mtsession_usirydqiclkfr0vcb34f4ncg","value":"10.115.3.121:9711","quoted":false,"path":"/","domain":".zyzhan.com","secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"mtcached_mtsession_usirydqiclkfr0vcb34f4ncg=10.115.3.121:9711; domain=.zyzhan.com; path=/; HttpOnly"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":512,"size_decoded":1230,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (494), with CRLF line terminators","md5":"528a3dd24d26a3ee531d95f4cf486105","sha1":"f15eb4562b502dc1aaadac5fc8a4c464defe8934","sha256":"e334563871444bed2f06bd4027d8155affec3dce2f88fc37477b9f419cfc6057","sha512":"7314ba762760dbb608eac503137054b0d578cf0fbe1ad43d7bb67806a1f0b7094d8d9b417c0ef5e3d06f1fe500ac9a6826a9ccabe49b3863b2ad274de5bc00a3","ssdeep":"","tlshash":"64f09e634c01d2fa8d00a4e8df61e388d01b0f2b31a1da736162008136106b7b1acadb","first_seen":"2026-09-26T23:58:51.327715Z","last_seen":"2026-09-26T23:58:51.327715Z","times_seen":1,"resource_available":true,"data":null}},"time_used":316,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":316,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"www.zyzhan.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?skins/65392/images/ewm.jpg","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.197Z","timestamp":1790467066197,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?skins/65392/images/ewm.jpg HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:47 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: http://www.daliguolv.com/skins/65392/images/ewm.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.daliguolv.com/skins/65392/images/ewm.jpg","fqdn":"www.daliguolv.com","domain":"daliguolv.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.471Z","timestamp":1790467067471,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /skins/65392/images/ewm.jpg HTTP/1.1\r\nHost: www.daliguolv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.daliguolv.com/skins/65392/images/banner1.jpg","fqdn":"www.daliguolv.com","domain":"daliguolv.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.729Z","timestamp":1790467067729,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /skins/65392/images/banner1.jpg HTTP/1.1\r\nHost: www.daliguolv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.daliguolv.com/Skins/65392/images/ewm.jpg","fqdn":"www.daliguolv.com","domain":"daliguolv.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:48.074Z","timestamp":1790467068074,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /Skins/65392/images/ewm.jpg HTTP/1.1\r\nHost: www.daliguolv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/favicon.ico","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:50.924Z","timestamp":1790467070924,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dfzzhs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:39:12 GMT","end":"Thu, 19 Nov 2026 22:39:11 GMT"},"fingerprint":{"sha1":"5A:71:47:AB:A0:F5:A6:04:56:33:5B:E5:1C:89:E0:29:88:44:89:9E","sha256":"A8:7A:95:05:4C:E7:90:E9:13:57:58:BF:27:FD:E5:67:44:9E:17:B4:4F:09:BC:FF:2B:21:A3:22:81:A6:8C:60"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr; __vtins__K9hAf3fFNdu885Sn=%7B%22sid%22%3A%20%2266946985-a068-5123-8088-30f42c1f812c%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201790467199999%2C%20%22ct%22%3A%201790467066355%7D; __51uvsct__K9hAf3fFNdu885Sn=1; __51vcke__K9hAf3fFNdu885Sn=5e8d8c22-b55b-5465-91ab-ec6b796594df; __51vuft__K9hAf3fFNdu885Sn=1790467066359\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:51 GMT\r\ncontent-type: text/html\r\ncontent-length: 138\r\netag: \"6a03ff34-8a\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":138,"size_decoded":292,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7389d931c86b3d7bb6b8af46d8c4172b","sha1":"8d2a4760aa0b47984d11cd1a66448719177fb791","sha256":"301bd9f16f94feedfae7a946a14bac38cb73c43efe6117bc5586835af03d7d6f","sha512":"dd6d1511e4fcd5bc09d821ffe091fb5946ac9654c48664aed504e479e9ac20c1cad44b6df90f42190d47e28f5f96bfb09d24056df6b950243d68ee8100a9a889","ssdeep":"","tlshash":"d9c09b5d755366449913155167c33641d196837f689a84510941c593f0cf69ac4c73a9","first_seen":"2023-03-13T12:56:15Z","last_seen":"2026-09-27T01:35:45.991709Z","times_seen":332539,"resource_available":true,"data":null}},"time_used":244,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":244,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?skins/65392/js/jquery.min.js","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:45.968Z","timestamp":1790467065968,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dfzzhs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:39:12 GMT","end":"Thu, 19 Nov 2026 22:39:11 GMT"},"fingerprint":{"sha1":"5A:71:47:AB:A0:F5:A6:04:56:33:5B:E5:1C:89:E0:29:88:44:89:9E","sha256":"A8:7A:95:05:4C:E7:90:E9:13:57:58:BF:27:FD:E5:67:44:9E:17:B4:4F:09:BC:FF:2B:21:A3:22:81:A6:8C:60"}}},"request":{"raw":"GET /?skins/65392/js/jquery.min.js HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:46 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\nlocation: http://www.daliguolv.com/skins/65392/js/jquery.min.js\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":359,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":359,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?Skins/65392/images/addr.png","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.195Z","timestamp":1790467066195,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?Skins/65392/images/addr.png HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:47 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: http://www.daliguolv.com/Skins/65392/images/addr.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img53.zyzhan.com/gxhpic_e8a41187a6/df293c85a2d9f0fb9e655601d17580aa49aa47fc1bd1e5606b8bf02b5727e1321525054f3a5c6522_284_284_5.jpg","fqdn":"img53.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.227Z","timestamp":1790467066227,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /gxhpic_e8a41187a6/df293c85a2d9f0fb9e655601d17580aa49aa47fc1bd1e5606b8bf02b5727e1321525054f3a5c6522_284_284_5.jpg HTTP/1.1\r\nHost: img53.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public\r\ncontent-disposition: inline;filename=636486796797778847471.jpg\r\ncontent-type: image/webp\r\ndate: Sat, 26 Sep 2026 00:57:41 GMT\r\netag: \"1790384261_webp\"\r\nexpires: Sun, 26 Sep 2027 00:57:41 GMT\r\nlast-modified: Sat, 26 Sep 2026 00:57:41 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-aspnet-version: 4.0.30319\r\nx-cache: HIT, server, disk\r\nx-powered-by: ASP.NET-img53\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16832,"size_decoded":17335,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 284x284, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"8051d76a5df8520d3a3b6c9dd82480f7","sha1":"d8c72da9d3f5086740f9fddcdd77fd9ae9114325","sha256":"cffd2b86502985a551fb857ae6640cb1d44d534fbfc847a73198d88e18e1fba3","sha512":"75f0e21227bf786b1d5e5ebef513535f405ca7d3df23dab5293f050d45f01885268431d73d02914511fd6eee62a68dbe085a206482b7c833e2406bc648c7cff8","ssdeep":"384:AqrBgr9dwp/DX9ODxspO6GYA+3bLaRrSeDFbT1ks6VRIGmfHu:AKBgxdwdtWkGyLWrSexinhWO","tlshash":"aa72c0963e1a4f2c296e1d51efbcb95b02bfaed9045f46ada7f460c20c400a7d1ce431","first_seen":"2026-09-26T23:58:51.3291Z","last_seen":"2026-09-26T23:58:51.3291Z","times_seen":1,"resource_available":false,"data":null}},"time_used":997,"timings":{"blocked":935,"dns":0,"connect":18,"send":0,"wait":21,"receive":0,"ssl":23},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/images/Send.png","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.209Z","timestamp":1790467067209,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dfzzhs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:39:12 GMT","end":"Thu, 19 Nov 2026 22:39:11 GMT"},"fingerprint":{"sha1":"5A:71:47:AB:A0:F5:A6:04:56:33:5B:E5:1C:89:E0:29:88:44:89:9E","sha256":"A8:7A:95:05:4C:E7:90:E9:13:57:58:BF:27:FD:E5:67:44:9E:17:B4:4F:09:BC:FF:2B:21:A3:22:81:A6:8C:60"}}},"request":{"raw":"GET /images/Send.png HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/?skins/65392/Css/style.css\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr; __vtins__K9hAf3fFNdu885Sn=%7B%22sid%22%3A%20%2266946985-a068-5123-8088-30f42c1f812c%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201790467199999%2C%20%22ct%22%3A%201790467066355%7D; __51uvsct__K9hAf3fFNdu885Sn=1; __51vcke__K9hAf3fFNdu885Sn=5e8d8c22-b55b-5465-91ab-ec6b796594df; __51vuft__K9hAf3fFNdu885Sn=1790467066359\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:47 GMT\r\ncontent-type: text/html\r\ncontent-length: 138\r\netag: \"6a03ff34-8a\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":138,"size_decoded":292,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7389d931c86b3d7bb6b8af46d8c4172b","sha1":"8d2a4760aa0b47984d11cd1a66448719177fb791","sha256":"301bd9f16f94feedfae7a946a14bac38cb73c43efe6117bc5586835af03d7d6f","sha512":"dd6d1511e4fcd5bc09d821ffe091fb5946ac9654c48664aed504e479e9ac20c1cad44b6df90f42190d47e28f5f96bfb09d24056df6b950243d68ee8100a9a889","ssdeep":"","tlshash":"d9c09b5d755366449913155167c33641d196837f689a84510941c593f0cf69ac4c73a9","first_seen":"2023-03-13T12:56:15Z","last_seen":"2026-09-27T01:35:45.991709Z","times_seen":332539,"resource_available":true,"data":null}},"time_used":244,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":244,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zyzhan.com/stat.aspx?u=hzdarlly\u0026referer=\u0026title=mk%u4F53%u80B2%u7535%u5B50%2Cmk%u4F53%u80B2%u5A31%u4E50\u0026httpreferer=https%3A//dfzzhs.com/","fqdn":"www.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"163.181.131.237","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.zyzhan.com/asyncstat.aspx?u=hzdarlly\u0026referer=\u0026title=mk%u4F53%u80B2%u7535%u5B50%2Cmk%u4F53%u80B2%u5A31%u4E50","date":"2026-09-26T23:57:47.551Z","timestamp":1790467067551,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /stat.aspx?u=hzdarlly\u0026referer=\u0026title=mk%u4F53%u80B2%u7535%u5B50%2Cmk%u4F53%u80B2%u5A31%u4E50\u0026httpreferer=https%3A//dfzzhs.com/ HTTP/1.1\r\nHost: www.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zyzhan.com/asyncstat.aspx?u=hzdarlly\u0026referer=\u0026title=mk%u4F53%u80B2%u7535%u5B50%2Cmk%u4F53%u80B2%u5A31%u4E50\r\nCookie: acw_tc=a3b5839517904670662311056eab3592825262fb1ab2f96e6b93935449; cdn_sec_tc=a3b5839517904670662311056eab3592825262fb1ab2f96e6b93935449; mtcached_mtsession_z3k0i4bwmro5ao1fsc1wniiv=10.115.3.123:9720; mtcached_mtsession_usirydqiclkfr0vcb34f4ncg=10.115.3.121:9711\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: ESA\r\ncontent-type: text/html\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\ncache-control: no-cache\r\ncontent-encoding: gzip\r\ndate: Sat, 26 Sep 2026 23:57:47 GMT\r\nexpires: -1\r\nset-cookie: ASP.NET_SessionId=2vpwsvfytk1c2yszlhqbsnq0; path=/; HttpOnly; SameSite=Lax\nmtcached_mtsession_2vpwsvfytk1c2yszlhqbsnq0=10.115.3.121:9712; domain=.zyzhan.com; path=/; HttpOnly\r\nvary: Accept-Encoding\r\nvia: ens-cache33.l2eo166-17[61,0,DP], ens-cache21.l2de3[305,0,DP], ens-cache1.de7[306,0,DP], ens-cache1.de7[307,0]\r\nx-site-cache-status: DYNAMIC\r\npragma: no-cache\r\nx-aspnet-version: 4.0.30319\r\nx-powered-by: ASP.NET-hg4.91\r\ntiming-allow-origin: *\r\neagleid: a3b5839517904670675401321e\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"ASP.NET_SessionId","value":"2vpwsvfytk1c2yszlhqbsnq0","quoted":false,"path":"/","secure":false,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"ASP.NET_SessionId=2vpwsvfytk1c2yszlhqbsnq0; path=/; HttpOnly; SameSite=Lax"},{"name":"mtcached_mtsession_2vpwsvfytk1c2yszlhqbsnq0","value":"10.115.3.121:9712","quoted":false,"path":"/","domain":".zyzhan.com","secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"mtcached_mtsession_2vpwsvfytk1c2yszlhqbsnq0=10.115.3.121:9712; domain=.zyzhan.com; path=/; HttpOnly"}],"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2788,"size_decoded":2172,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"b22216484180c462ecb56741f09148ad","sha1":"4bc1530eef8c2e6d6fc75fe59f888b8417baa066","sha256":"102a4a6e7a2308d414a8ecb0b6551d354726d6bb9d52ba7b30e16cda59111057","sha512":"b06af7d159e017aeb25e2cc9e0c94b8ff484c573c188784ed596d7a084b6761cfc6b6708cc0ffb61d44b9a2d06482f4ddd000d1930dd093e30025579dd29ece8","ssdeep":"","tlshash":"c951827198d5a1295277c2a2457333dcfd57828fea4007adb1ed33ab9fce1876113504","first_seen":"2025-09-22T09:21:10.376948Z","last_seen":"2026-09-26T23:58:51.331056Z","times_seen":18,"resource_available":true,"data":null}},"time_used":331,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":331,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"www.zyzhan.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"chat.zyzhan.com/chat/KFLeftBox/65392","fqdn":"chat.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"155.102.51.4","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.160Z","timestamp":1790467066160,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /chat/KFLeftBox/65392 HTTP/1.1\r\nHost: chat.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: ESA\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 49\r\nConnection: keep-alive\r\nSet-Cookie: acw_tc=9b66334817904670662523206ef4d9536fadbdd7b609bf35bb14b2d87a;path=/;HttpOnly;Max-Age=3600\ncdn_sec_tc=9b66334817904670662523206ef4d9536fadbdd7b609bf35bb14b2d87a;path=/;HttpOnly;Max-Age=3600\nASP.NET_SessionId=repo0iuvpaw2qjrvuktzzema; path=/; HttpOnly; SameSite=Lax\nmtcached_mtsession_repo0iuvpaw2qjrvuktzzema=10.115.3.123:9720; domain=chat.zyzhan.com; path=/; HttpOnly\r\nStrict-Transport-Security: max-age=15552000; includeSubDomains\r\nCache-Control: private\r\nDate: Sat, 26 Sep 2026 23:57:46 GMT\r\nvia: ens-cache51.l2eo166-17[62,0,DP], ens-cache17.de7[338,0,DP], ens-cache17.de7[340,0]\r\nx-site-cache-status: DYNAMIC\r\nX-AspNet-Version: 4.0.30319\r\nX-AspNetMvc-Version: 3.0\r\nX-Powered-By: ASP.NET-4.94\r\nContent-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval' data:;\r\nTiming-Allow-Origin: *\r\nEagleId: 9b66334817904670662523206e\r\n\r\n","headers":null,"cookies":[{"name":"acw_tc","value":"9b66334817904670662523206ef4d9536fadbdd7b609bf35bb14b2d87a","quoted":false,"path":"/","max_age":3600,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"acw_tc=9b66334817904670662523206ef4d9536fadbdd7b609bf35bb14b2d87a;path=/;HttpOnly;Max-Age=3600"},{"name":"cdn_sec_tc","value":"9b66334817904670662523206ef4d9536fadbdd7b609bf35bb14b2d87a","quoted":false,"path":"/","max_age":3600,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"cdn_sec_tc=9b66334817904670662523206ef4d9536fadbdd7b609bf35bb14b2d87a;path=/;HttpOnly;Max-Age=3600"},{"name":"ASP.NET_SessionId","value":"repo0iuvpaw2qjrvuktzzema","quoted":false,"path":"/","secure":false,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"ASP.NET_SessionId=repo0iuvpaw2qjrvuktzzema; path=/; HttpOnly; SameSite=Lax"},{"name":"mtcached_mtsession_repo0iuvpaw2qjrvuktzzema","value":"10.115.3.123:9720","quoted":false,"path":"/","domain":"chat.zyzhan.com","secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"mtcached_mtsession_repo0iuvpaw2qjrvuktzzema=10.115.3.123:9720; domain=chat.zyzhan.com; path=/; HttpOnly"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}],"data":{"size":49,"size_decoded":1016,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with CRLF line terminators","md5":"b936460ba988b30cd79d99ae93c77106","sha1":"a44405ff5b67abf66ef77714e4364e6c3f1e9940","sha256":"6cd604b71e1e21050b6a41602716b9a722e769a5d7cfb3b97152f3d73dcef5c9","sha512":"ad4731faf916fbb7118af38e25fa7e15814294950676fbd4ec41aeba5c7508ed34b7a7a4c98e1834e1096ea92e6301935699ed6df01a7416632e39063c0c9661","ssdeep":"","tlshash":"3990023209b10052711510915943e1456595959129de9915a00004a572529539a06d51","first_seen":"2023-03-07T12:42:46Z","last_seen":"2026-09-26T23:58:51.313872Z","times_seen":731,"resource_available":true,"data":null}},"time_used":466,"timings":{"blocked":-1,"dns":51,"connect":22,"send":0,"wait":365,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"chat.zyzhan.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?skins/65392/images/cf3.jpg","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.186Z","timestamp":1790467066186,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?skins/65392/images/cf3.jpg HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:46 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: http://www.daliguolv.com/skins/65392/images/cf3.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img68.zyzhan.com/gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf37bc4271bad487df0ce4b554325322b83f771eb5f92fe392aa_284_284_5.jpg","fqdn":"img68.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.225Z","timestamp":1790467066225,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf37bc4271bad487df0ce4b554325322b83f771eb5f92fe392aa_284_284_5.jpg HTTP/1.1\r\nHost: img68.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public\r\ncontent-disposition: inline;filename=637939107202982628132.jpg\r\ncontent-type: image/webp\r\ndate: Sat, 26 Sep 2026 00:57:38 GMT\r\netag: \"1790384259\"\r\nexpires: Sun, 26 Sep 2027 00:57:38 GMT\r\nlast-modified: Sat, 26 Sep 2026 02:53:27 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-aspnet-version: 4.0.30319\r\nx-cache: HIT, server, disk\r\nx-powered-by: ASP.NET-img68\r\ncontent-length: 3806\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3806,"size_decoded":4326,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 284x284, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"50a72467cda563b820dd3013dbb8e364","sha1":"93789e4c213e5fe36900ea9b80a293047a524ac8","sha256":"e030d9f9bd94b19d9771606c6c450403cc19506179f486d7f715e80875584584","sha512":"1f01080146298477a6135c2806e9194c21c7e72b2623b8bd5ce9ce03f468158c0825fabbd0b80872b61f00caf3cc2d096a5d75995564b9d0d13f6e8ef8a42ab4","ssdeep":"","tlshash":"7b716d16d4f6fe73b5f821602be2c3eb5d85981011ba05c0dd092dbcb88d1d1198df0e","first_seen":"2026-09-26T23:58:51.332565Z","last_seen":"2026-09-26T23:58:51.332565Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1036,"timings":{"blocked":936,"dns":0,"connect":24,"send":0,"wait":26,"receive":0,"ssl":41},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img68.zyzhan.com/gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf37b92d66958496e2167d4c2adb346faf647da0d5182a9fcaea_284_284_5.jpg","fqdn":"img68.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.232Z","timestamp":1790467066232,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf37b92d66958496e2167d4c2adb346faf647da0d5182a9fcaea_284_284_5.jpg HTTP/1.1\r\nHost: img68.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public\r\ncontent-disposition: inline;filename=637939107206732270735.jpg\r\ncontent-type: image/webp\r\ndate: Sat, 26 Sep 2026 00:57:41 GMT\r\netag: \"1790384261\"\r\nexpires: Sun, 26 Sep 2027 00:57:41 GMT\r\nlast-modified: Sat, 26 Sep 2026 02:53:27 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-aspnet-version: 4.0.30319\r\nx-cache: HIT, server, disk\r\nx-powered-by: ASP.NET-img68\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}],"data":{"size":7074,"size_decoded":7572,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 284x284, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"1f6feabb1992c0561577b68ca0db87f4","sha1":"be50b165b62239234bca7184fba1ae7a06d72def","sha256":"be1263c077807e9c32de8b475a9c537831a58655d59295ff150c38ea55a55e0b","sha512":"a0ce94be23facd7ceb0c8b492c4856bae15304913573206328a5a59aef6579301807ca13596370f01490a2d76d78f09c1aa398dfcc9414d5823e96db8381d41e","ssdeep":"192:vtd30iTpd86EiREj3q6UgWc+n92QVGzlnTMEWs3V:j30iI6E6gWmHFQEp","tlshash":"24e1aec2384074dac4d8ae9c96757ff0d44060c523a1fee2924e8e8fa26e89b6cc108d","first_seen":"2026-09-26T23:58:51.334303Z","last_seen":"2026-09-26T23:58:51.334303Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1032,"timings":{"blocked":934,"dns":0,"connect":22,"send":0,"wait":33,"receive":0,"ssl":36},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img63.zyzhan.com/gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf37e2d518cb807a461906d4124913a340c3ef0c9118000aa8e2_284_284_5.jpg","fqdn":"img63.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.235Z","timestamp":1790467066235,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf37e2d518cb807a461906d4124913a340c3ef0c9118000aa8e2_284_284_5.jpg HTTP/1.1\r\nHost: img63.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public\r\ncontent-disposition: inline;filename=637939109818196430466.jpg\r\ncontent-type: image/webp\r\ndate: Sat, 26 Sep 2026 00:57:40 GMT\r\netag: \"1790384260_webp\"\r\nexpires: Sun, 26 Sep 2027 00:57:40 GMT\r\nlast-modified: Sat, 26 Sep 2026 00:57:40 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-aspnet-version: 4.0.30319\r\nx-cache: HIT, server, disk\r\nx-powered-by: ASP.NET-img63\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4578,"size_decoded":5081,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 284x284, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2e5934533382c6e5bd67391340ddc09a","sha1":"50a0ee96b268b95ff0b69960d8850552a68a5077","sha256":"759396e12a7d9b1afd7e25ed9944f0c3c832e539ad5659d462775fe90be18602","sha512":"e5c8fc0bafc3c4a639eb32d3834c9d2ef2f8d072eec190fa7c10d598bbf1dfdba7e8a10496439fd54b62799f2a5801f0a1f4a30eea74c29daa5782869fdc47a9","ssdeep":"96:fFbuByV3sWPUEvN7Miu1CCn2czrpkcWLkB8MWgV7oUal6LQBgfv:d6BDWcEv9A1zh8QB/V7LM6Ey","tlshash":"7d918e71f773741c1df630f62403312bd66b96e1194792c858d76aa331a13f91ef2549","first_seen":"2026-09-26T23:58:51.335875Z","last_seen":"2026-09-26T23:58:51.335875Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1006,"timings":{"blocked":932,"dns":1,"connect":20,"send":0,"wait":23,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.daliguolv.com/skins/65392/images/line1.png","fqdn":"www.daliguolv.com","domain":"daliguolv.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.254Z","timestamp":1790467067254,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /skins/65392/images/line1.png HTTP/1.1\r\nHost: www.daliguolv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.daliguolv.com/skins/65392/images/banner2.jpg","fqdn":"www.daliguolv.com","domain":"daliguolv.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:48.203Z","timestamp":1790467068203,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /skins/65392/images/banner2.jpg HTTP/1.1\r\nHost: www.daliguolv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?skins/65392/js/pt_js.js","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.170Z","timestamp":1790467066170,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dfzzhs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:39:12 GMT","end":"Thu, 19 Nov 2026 22:39:11 GMT"},"fingerprint":{"sha1":"5A:71:47:AB:A0:F5:A6:04:56:33:5B:E5:1C:89:E0:29:88:44:89:9E","sha256":"A8:7A:95:05:4C:E7:90:E9:13:57:58:BF:27:FD:E5:67:44:9E:17:B4:4F:09:BC:FF:2B:21:A3:22:81:A6:8C:60"}}},"request":{"raw":"GET /?skins/65392/js/pt_js.js HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:46 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\nlocation: http://www.daliguolv.com/skins/65392/js/pt_js.js\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":358,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":358,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?skins/65392/Images/logo.png","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.176Z","timestamp":1790467066176,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?skins/65392/Images/logo.png HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:46 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: http://www.daliguolv.com/skins/65392/Images/logo.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?skins/65392/images/line1.png","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.177Z","timestamp":1790467066177,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?skins/65392/images/line1.png HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:47 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: http://www.daliguolv.com/skins/65392/images/line1.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?skins/65392/images/line2.png","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.183Z","timestamp":1790467066183,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?skins/65392/images/line2.png HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:46 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: http://www.daliguolv.com/skins/65392/images/line2.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img63.zyzhan.com/gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf3789d2e3408a749e8ac47ed1b6852c7c88b0661736ef3ba1ba_284_284_5.jpg","fqdn":"img63.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.223Z","timestamp":1790467066223,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf3789d2e3408a749e8ac47ed1b6852c7c88b0661736ef3ba1ba_284_284_5.jpg HTTP/1.1\r\nHost: img63.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public\r\ncontent-disposition: inline;filename=637939109808665245837.jpg\r\ncontent-type: image/webp\r\ndate: Sat, 26 Sep 2026 00:57:36 GMT\r\netag: \"1790384257\"\r\nexpires: Sun, 26 Sep 2027 00:57:36 GMT\r\nlast-modified: Sat, 26 Sep 2026 02:53:19 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-aspnet-version: 4.0.30319\r\nx-cache: HIT, server, disk\r\nx-powered-by: ASP.NET-img63\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}],"data":{"size":5108,"size_decoded":5606,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 284x284, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4484256a875d4a06a6229e4fbb68aea4","sha1":"88baf3ee034eec77b5e50c9257d0db6f3955122d","sha256":"e936a137c93600dcdc6f78deddf89b756481138eae0dd6f5bba184eb473225b1","sha512":"709b340967bb8d644c41316e5df07efa2fd0e5c8a8e01ee2f95a3a35329349d9bb748a622bd25b285df2f89c71984f0d66ae04109c515ef9f848659b2eaa268a","ssdeep":"96:CFsysK4V9Cp54iNDwAbyjRo16OJCPHm8mrgdOelqo28lp2:CgFymIwAbWSCfNWgIe642","tlshash":"50b16c3a80241916c28e7569e349cba2fbda66803e37137548ed182ddcb1ead038032a","first_seen":"2026-09-26T23:58:51.337825Z","last_seen":"2026-09-26T23:58:51.337825Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1028,"timings":{"blocked":936,"dns":1,"connect":22,"send":0,"wait":28,"receive":0,"ssl":33},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img68.zyzhan.com/gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf3757fd79c77350a47274db222d7048167b678d37c7a00defa1_284_284_5.jpg","fqdn":"img68.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.232Z","timestamp":1790467066232,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf3757fd79c77350a47274db222d7048167b678d37c7a00defa1_284_284_5.jpg HTTP/1.1\r\nHost: img68.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public\r\ncontent-disposition: inline;filename=637939107211888759390.jpg\r\ncontent-type: image/webp\r\ndate: Sat, 26 Sep 2026 00:57:40 GMT\r\netag: \"1790384261\"\r\nexpires: Sun, 26 Sep 2027 00:57:40 GMT\r\nlast-modified: Sat, 26 Sep 2026 02:53:23 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-aspnet-version: 4.0.30319\r\nx-cache: HIT, server, disk\r\nx-powered-by: ASP.NET-img68\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}],"data":{"size":8478,"size_decoded":8976,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 284x284, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d642bb4d74e64e84aa5eda4cdc1ac32e","sha1":"4f78ef1566c564c92c1e2a72e0dba13383d74e3d","sha256":"c4c015dd72c31dd7f357da2e9f0a33d836a0015bc14ae76abc440038ee576087","sha512":"3bd815d902edb46d7d8dc7e93bb829974780d8c944b9f150bafd18cc920ba8b7cf7d821e0dce716ca79842c3c6d405313024e358c07284866e2b0d430df1b2e3","ssdeep":"192:ozZvI+XGCSgwl0YYYiX0NZoxYXQoLGefmh6YxHwbOL0ipmefk:cvnXGCGiEAYQ4DJSuO48msk","tlshash":"3a02cfea5bd5ee442fe4bc60e3094234ba2305be06da007b48f4da7c59f4c5e93d4630","first_seen":"2026-09-26T23:58:51.339966Z","last_seen":"2026-09-26T23:58:51.339966Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1016,"timings":{"blocked":935,"dns":0,"connect":22,"send":0,"wait":21,"receive":0,"ssl":33},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"public.mtnets.com/Plugins/jQuery/2.2.4/jquery-2.2.4.min.js","fqdn":"public.mtnets.com","domain":"mtnets.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.058Z","timestamp":1790467067058,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.mtnets.com","organization":""},"issuer":{"commonName":"Certum Domain Validation CA SHA2","organization":"Unizeto Technologies S.A."},"validity":{"start":"Fri, 05 Sep 2025 03:48:46 GMT","end":"Mon, 05 Oct 2026 03:48:45 GMT"},"fingerprint":{"sha1":"17:7D:9B:7D:77:E5:75:95:47:DB:97:C3:AB:B8:D0:E9:74:B6:07:84","sha256":"76:5C:C6:79:DF:08:A6:CD:BB:8D:53:C9:B4:57:D8:93:F6:E7:6A:58:6B:73:54:DB:67:7E:12:CE:5D:29:0A:D3"}}},"request":{"raw":"GET /Plugins/jQuery/2.2.4/jquery-2.2.4.min.js HTTP/1.1\r\nHost: public.mtnets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://dfzzhs.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-type: application/javascript\r\ndate: Fri, 25 Sep 2026 09:44:15 GMT\r\netag: \"afbe5c44582d41:0\"\r\nlast-modified: Fri, 25 Sep 2026 09:44:16 GMT\r\nserver: nginx\r\nstrict-transport-security: max-age=31536000\r\nx-cache: HIT, policy, disk\r\nx-powered-by: ASP.NET-4.95\r\ncontent-length: 85578\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Microsoft ASP.NET","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}],"data":{"size":85578,"size_decoded":85953,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32065)","md5":"2f6b11a7e914718e0290410e85366fe9","sha1":"69bb69e25ca7d5ef0935317584e6153f3fd9a88c","sha256":"05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e","sha512":"0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db","ssdeep":"1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2","tlshash":"1e83c6d9b2d6706297b734b850bf410bb17a98dab44c8c60f059d4e47eb4a8e507bf2c","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-09-27T01:27:54.712136Z","times_seen":298026,"resource_available":true,"data":null}},"time_used":105,"timings":{"blocked":0,"dns":2,"connect":19,"send":0,"wait":19,"receive":39,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-26T23:57:44.722Z","timestamp":1790467064722,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dfzzhs.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:39:12 GMT","end":"Thu, 19 Nov 2026 22:39:11 GMT"},"fingerprint":{"sha1":"5A:71:47:AB:A0:F5:A6:04:56:33:5B:E5:1C:89:E0:29:88:44:89:9E","sha256":"A8:7A:95:05:4C:E7:90:E9:13:57:58:BF:27:FD:E5:67:44:9E:17:B4:4F:09:BC:FF:2B:21:A3:22:81:A6:8C:60"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:45 GMT\r\ncontent-type: text/html; charset=gbk\r\nvary: Accept-Encoding\r\nset-cookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"mo4dij65mbmlrlv77si93qlagr","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=mo4dij65mbmlrlv77si93qlagr; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39034,"size_decoded":11215,"mime_type":"text/html; charset=gbk","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (832), with CRLF line terminators","md5":"a7aa344337aa888c05f747db58cd5b47","sha1":"63bb32eac4c1ab7cba1549189121238313cc74ff","sha256":"32339b412531053264038037c8f63b1a84828601fc53c45bb1037d06cbc95f3b","sha512":"f4ad5439aa05e0f10f7d436b2c63810f4e99ba9fc113629cfc2426db42de96ea3ab409ad7f237164b5e96c63d06631c8ab14532106de12942f590d5940077b4b","ssdeep":"768:SZCO+gu55fi8L65EPDqOqluzLDf++K+HGzgrIqbC:SZCOXu55fi8L6Zuzn++JHqgrI8C","tlshash":"6c13b312c9d5282a0477a2d865b467aefda6d267a2538f4572fc2bcbdff1f508d03104","first_seen":"2026-09-26T23:58:51.342691Z","last_seen":"2026-09-26T23:58:51.342691Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1074,"timings":{"blocked":-1,"dns":75,"connect":245,"send":0,"wait":491,"receive":0,"ssl":263},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?skins/65392/images/aCont.png","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.183Z","timestamp":1790467066183,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?skins/65392/images/aCont.png HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:47 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: http://www.daliguolv.com/skins/65392/images/aCont.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?Skins/65392/images/fax.png","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.194Z","timestamp":1790467066194,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?Skins/65392/images/fax.png HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:46 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: http://www.daliguolv.com/Skins/65392/images/fax.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img67.zyzhan.com/gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf376ab9f9bbc734474d68729ca6692d946aef0db5f75f7d5809_284_284_5.jpg","fqdn":"img67.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.236Z","timestamp":1790467066236,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf376ab9f9bbc734474d68729ca6692d946aef0db5f75f7d5809_284_284_5.jpg HTTP/1.1\r\nHost: img67.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public\r\ncontent-disposition: inline;filename=637939110580025227287.jpg\r\ncontent-type: image/webp\r\ndate: Sat, 26 Sep 2026 00:57:40 GMT\r\netag: \"1790384261\"\r\nexpires: Sun, 26 Sep 2027 00:57:40 GMT\r\nlast-modified: Sat, 26 Sep 2026 02:53:20 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-aspnet-version: 4.0.30319\r\nx-cache: HIT, server, disk\r\nx-powered-by: ASP.NET-img67\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7040,"size_decoded":7538,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 284x284, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2e7c0a2380e2eb3c4d8e43786b111cee","sha1":"46860f495437b41c11d00ad282f3030a801fa91f","sha256":"ecdfde7a67f7573e6ea5e1d9195604ac3c8b65bd4c786623db29b22c37d09428","sha512":"a34cc04d0c8c8af64908b1c6ef95cfd9721ad7d191f2f4381120b45328c1dcfe0d6c5ca2b26aef3162fcdc10320d7304e31ebbeb68bf638abebebac816780666","ssdeep":"192:cc+CXKKPAvNSKDO5qZo8jy7uVZkwn28lPrW:cc+CXKKPAvNjO5ay72Z3P6","tlshash":"00e1ae5cecb4de87c7ae55c191bad19037102ec88690ea283a52852cfd21a0d1ab36bc","first_seen":"2026-09-26T23:58:51.344083Z","last_seen":"2026-09-26T23:58:51.344083Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1026,"timings":{"blocked":929,"dns":0,"connect":24,"send":0,"wait":32,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.daliguolv.com/skins/65392/images/line2.png","fqdn":"www.daliguolv.com","domain":"daliguolv.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.843Z","timestamp":1790467066843,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /skins/65392/images/line2.png HTTP/1.1\r\nHost: www.daliguolv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.daliguolv.com/skins/65392/images/cf2.jpg","fqdn":"www.daliguolv.com","domain":"daliguolv.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.142Z","timestamp":1790467067142,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /skins/65392/images/cf2.jpg HTTP/1.1\r\nHost: www.daliguolv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dfzzhs.com/?skins/65392/images/banner2.jpg","fqdn":"dfzzhs.com","domain":"dfzzhs.com","tld":"com"},"ip":{"addr":"154.213.246.120","port":443,"asn":132839,"as":"POWER LINE DATACENTER","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:47.214Z","timestamp":1790467067214,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?skins/65392/images/banner2.jpg HTTP/1.1\r\nHost: dfzzhs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dfzzhs.com/\r\nCookie: PHPSESSID=mo4dij65mbmlrlv77si93qlagr; __vtins__K9hAf3fFNdu885Sn=%7B%22sid%22%3A%20%2266946985-a068-5123-8088-30f42c1f812c%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201790467199999%2C%20%22ct%22%3A%201790467066355%7D; __51uvsct__K9hAf3fFNdu885Sn=1; __51vcke__K9hAf3fFNdu885Sn=5e8d8c22-b55b-5465-91ab-ec6b796594df; __51vuft__K9hAf3fFNdu885Sn=1790467066359\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 23:57:48 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: http://www.daliguolv.com/skins/65392/images/banner2.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T01:46:32.948106Z","times_seen":18679314,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"dfzzhs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img63.zyzhan.com/gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf37c459d3ee0ae087f849538acb09ff3386782c479b88b478bd_284_284_5.jpg","fqdn":"img63.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.211Z","timestamp":1790467066211,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf37c459d3ee0ae087f849538acb09ff3386782c479b88b478bd_284_284_5.jpg HTTP/1.1\r\nHost: img63.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public\r\ncontent-disposition: inline;filename=637939109811633753870.jpg\r\ncontent-type: image/webp\r\ndate: Sat, 26 Sep 2026 00:57:36 GMT\r\netag: \"1790384256_webp\"\r\nexpires: Sun, 26 Sep 2027 00:57:36 GMT\r\nlast-modified: Sat, 26 Sep 2026 00:57:36 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-aspnet-version: 4.0.30319\r\nx-cache: HIT, server, disk\r\nx-powered-by: ASP.NET-img63\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4828,"size_decoded":5331,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 284x284, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b0a453dbd7ec874998b3f0fac96377dd","sha1":"d9823ed2e650eb8571cb9c54d08ae3877b410619","sha256":"60c22b519fe98d816b31c9a34359f5ca6f41b15616ff7259860af95b5a839c3d","sha512":"27f6424af6b33069e90fa8b35322ef892c96de9d72f8ef837ff31077120850e12ca2d5c29934ca17c49e464c293d120516dd8d165b451c859db7383472917cb3","ssdeep":"96:PDXGTO8iE6FiRek2CSuZLfoORiUzMbPVEgT+p4KiY55XMjfxz:PDCO8iiIoZj97UVEo+Hi85X0","tlshash":"03a16ec7808dbb8045d46ffff89f7d9607d186620af958c32e9de25166ee1458032158","first_seen":"2026-09-26T23:58:51.345586Z","last_seen":"2026-09-26T23:58:51.345586Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1047,"timings":{"blocked":954,"dns":1,"connect":29,"send":0,"wait":23,"receive":0,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img67.zyzhan.com/gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf373dd7dc941f567fdd6d8a4ee3d8d54c7507381de08a68d91f_284_284_5.jpg","fqdn":"img67.zyzhan.com","domain":"zyzhan.com","tld":"com"},"ip":{"addr":"130.94.79.190","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dfzzhs.com/","date":"2026-09-26T23:57:46.230Z","timestamp":1790467066230,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zyzhan.com","organization":""},"issuer":{"commonName":"Certum DV TLS G2 R39 CA","organization":"Asseco Data Systems S.A."},"validity":{"start":"Thu, 25 Sep 2025 07:19:01 GMT","end":"Sun, 25 Oct 2026 07:19:00 GMT"},"fingerprint":{"sha1":"E6:3E:BF:20:AD:44:FD:77:47:8E:5F:AB:FB:9D:06:6D:F3:0D:9B:46","sha256":"D0:76:31:48:88:6B:F3:4D:10:17:7A:D3:F3:3A:FF:4B:F1:0C:82:E5:64:DB:1C:87:F3:8C:84:1B:53:A0:6B:53"}}},"request":{"raw":"GET /gxhpic_e8a41187a6/819f05fe9a3ee920c3bf4843ac79bf373dd7dc941f567fdd6d8a4ee3d8d54c7507381de08a68d91f_284_284_5.jpg HTTP/1.1\r\nHost: img67.zyzhan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nReferer: https://dfzzhs.com/\r\nSec-Fetch-Storage-Access: none\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public\r\ncontent-disposition: inline;filename=637939110582837856410.jpg\r\ncontent-type: image/webp\r\ndate: Sat, 26 Sep 2026 00:57:40 GMT\r\netag: \"1790384261\"\r\nexpires: Sun, 26 Sep 2027 00:57:40 GMT\r\nlast-modified: Sat, 26 Sep 2026 02:53:20 GMT\r\nserver: nginx/1.28.1\r\nstrict-transport-security: max-age=31536000\r\nx-aspnet-version: 4.0.30319\r\nx-cache: HIT, server, disk\r\nx-powered-by: ASP.NET-img67\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft ASP.NET:4.0.30319","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7016,"size_decoded":7514,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 284x284, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"8f8ea18800acf2b60ed55a7e8b466089","sha1":"6e8058ec3a31c0ed2e53597ddb2b029fe41b6555","sha256":"dd9434e157b2e3d9baa81fbfd8b7ab22e1be0e3fd3ad460f2206968225c73ecf","sha512":"6e7587787995cd0970f5af601fabb523b502721fb7760694ec3ca711e523e732a63d052b3dbdf06a4dedea21e3bb786df2ea4cbb6d21da27be05fc3d9de122bc","ssdeep":"192:OTYvPSIJ+7eGRTviSDe/b0UQF7XnG2mOd:OTYXSI8eGRTvinj0VF7XG2mOd","tlshash":"04e1ae64cf033db5bdd8cfc35c5cb5b6594168f148eb9d52b292eaa43238c5905d0768","first_seen":"2026-09-26T23:58:51.347633Z","last_seen":"2026-09-26T23:58:51.347633Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1017,"timings":{"blocked":935,"dns":0,"connect":24,"send":0,"wait":18,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}